Calculation power resource scheduling method and device, equipment, medium and product

Abstract

The invention relates to the technical field of network security, and particularly provides a computing power resource scheduling method, device and equipment, a medium and a product, and the method comprises the steps: obtaining alarm information of a target computing power resource; wherein the alarm information is used for indicating the node security state information of the node of the target computing power resource; determining a response strategy of the target computing power resource based on the alarm information; wherein the response strategy is used for indicating a scheduling mode of the target computing power resource; and performing computing power resource scheduling on the target computing power resource based on the response strategy.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to a method, device, equipment, medium and product for scheduling computing resources. Background Art

[0002] The computing network is a new network architecture that deeply integrates computing and networking. The computing network can uniformly schedule and manage decentralized and heterogeneous computing resources, and realize dynamic allocation and efficient utilization of computing power.

[0003] In related technologies, the computing power network collects node information of nodes to which computing power resources belong through the network control plane, and distributes computing power resources to computing tasks through distributed routing nodes or a central controller, thereby achieving computing optimization. However, computing power resources may have high-risk vulnerabilities, are under attack, or are very likely to be attacked, and are in a "dangerous" state. Therefore, the current scheduling mechanism for computing power resources is not perfect in terms of security considerations. This may cause computing tasks to be executed by risky computing power resources, making the computing tasks dangerous. Summary of the invention

[0004] In view of the above problems, the present disclosure is proposed. The present disclosure provides a method, device, equipment, medium and product for scheduling computing resources.

[0005] According to one aspect of the present disclosure, a method for scheduling computing resources is provided, the method comprising:

[0006] Obtaining alarm information of a target computing resource; wherein the alarm information is used to indicate node security status information of a node to which the target computing resource belongs;

[0007] Based on the alarm information, determining a response strategy for the target computing resource; wherein the response strategy is used to indicate a scheduling method for the target computing resource;

[0008] The target computing resources are scheduled based on the response strategy.

[0009] In addition, according to another embodiment of one aspect of the present disclosure, determining a response strategy of the target computing power resource based on the alarm information includes:

[0010] Based on the warning information, determining a response level of the target computing power resource; wherein the response level is used to indicate the degree of danger of the target computing power resource;

[0011] Based on the response level, the scheduling priority of the computing resources to which the target computing resources belong is determined, and the response strategy of the target computing resources is determined according to the scheduling priority.

[0012] In addition, according to another embodiment of one aspect of the present disclosure, determining the response level of the target computing power resource based on the alarm information includes:

[0013] When the alarm information meets the preset safety conditions, determining the alarm type and alarm severity of the alarm information;

[0014] Based on the alarm type and the alarm severity, a response level of the target computing power resource is determined.

[0015] In addition, according to another embodiment of one aspect of the present disclosure, determining the response level of the target computing power resource based on the alarm information includes:

[0016] If the warning information does not meet the preset safety condition, determine the warning type of the warning information;

[0017] Based on the alarm type, determine the response level of the target computing power resource.

[0018] In addition, according to another embodiment of one aspect of the present disclosure, determining the scheduling priority of the computing power resource to which the target computing power resource belongs based on the response level includes:

[0019] When the response level of the target computing power resource is the first response level, adding the target computing power resource to the first computing power resource list;

[0020] When the response level of the target computing power resource is the second response level, the target computing power resource is added to the second computing power resource list; wherein the danger level corresponding to the second response level is greater than the danger level corresponding to the first response level, and the calling priority of the computing power resources in the first computing power resource list is higher than the calling priority of the computing power resources in the second computing power resource list.

[0021] In addition, according to another embodiment of one aspect of the present disclosure, after adding the target computing power resource to the first computing power resource list, the method further includes:

[0022] Determine the response level of the target computing power resource within the target time period;

[0023] When the response level of the target computing power resource within the target time period does not reach the first response level, the target computing power resource is deleted from the first computing power resource list.

[0024] In addition, according to another embodiment of one aspect of the present disclosure, the obtaining of the alarm information of the target computing power resource includes:

[0025] Determine an alarm rule for the target computing resource; wherein the alarm rule carries an attribute value of at least one key attribute;

[0026] Sending the alarm rule to the target node;

[0027] The alarm information sent by the target node after matching according to the alarm rule is obtained.

[0028] In addition, according to another embodiment of one aspect of the present disclosure, the scheduling of computing resources for the target computing resources based on the response strategy and the target computing resources includes:

[0029] The response strategy is sent to a path decision node, so that the path decision node schedules the target computing power resource based on the response strategy.

[0030] According to another aspect of the present disclosure, a method for scheduling computing resources is provided, the method comprising:

[0031] Obtaining a response strategy sent by a safety indicator proxy node; wherein the response strategy is determined by the safety indicator proxy node according to any of the methods described above;

[0032] The target computing resources are scheduled based on the response strategy.

[0033] According to another aspect of the present disclosure, there is provided a scheduling device for computing resources, including: a safety indicator proxy node and a path decision node;

[0034] The security indicator proxy node obtains the alarm information of the target computing power resource; wherein the alarm information is used to indicate the node security status information of the node to which the target computing power resource belongs; based on the alarm information, a response strategy of the target computing power resource is determined; wherein the response strategy is used to indicate the scheduling method of the target computing power resource; and the computing power resource is scheduled for the target computing power resource based on the response strategy.

[0035] The path decision node is used to receive the response strategy; and schedule the target computing resources based on the response strategy.

[0036] According to another aspect of the present disclosure, a computer device is provided, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement steps of a method for determining a log template.

[0037] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the steps of a method for determining a log template are implemented.

[0038] According to another aspect of the present disclosure, a computer program product is provided, including a computer program / instruction, which implements the steps of a method for determining a log template when the computer program / instruction is executed by a processor.

[0039] As will be described in detail below, according to an embodiment of the present disclosure, a method, device, equipment, medium and product for scheduling computing power resources. In the embodiment of the present disclosure, by obtaining the alarm information of the target computing power resource, the node security status information of the node to which the target computing power resource belongs can be determined, so that the security of the target computing power resource can be determined. Therefore, the scheduling method of the target computing power resource determined based on the alarm information can ensure the security of computing power scheduling, avoid the invocation of computing power resources with low security, and thus alleviate the security risk problems such as data tampering, leakage, and service unavailability in computing tasks caused by the poor security of computing power scheduling in the prior art.

[0040] It is to be understood that both the foregoing general description and the following detailed description are exemplary, and are intended to provide further explanation of the technology as claimed. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The above and other purposes, features and advantages of the present disclosure will become more apparent by describing the embodiments of the present disclosure in more detail in conjunction with the accompanying drawings. The accompanying drawings are used to provide a further understanding of the embodiments of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the present disclosure and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0042] Figure 1 A flowchart of a method for scheduling computing resources provided in an embodiment of the present disclosure.

[0043] Figure 2 A schematic diagram of a computing resource scheduling device provided in an embodiment of the present disclosure.

[0044] Figure 3 A schematic diagram of a scheduling architecture for computing resources provided in an embodiment of the present disclosure.

[0045] Figure 4 A schematic diagram of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the present disclosure more obvious, the exemplary embodiments according to the present disclosure will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments of the present disclosure, and it should be understood that the present disclosure is not limited to the exemplary embodiments described here.

[0047] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0048] The term "and / or" herein only describes an association relationship, indicating that three relationships may exist. For example, A and / or B may represent the following three situations: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of. For example, including at least one of A, B, and C may represent including any one or more elements selected from the set consisting of A, B, and C.

[0049] Research has found that computing power network is a new type of network architecture that deeply integrates computing and network. The computing power network can uniformly schedule and manage decentralized and heterogeneous computing power resources, and realize dynamic allocation and efficient utilization of computing power.

[0050] In the related technology, by obtaining the alarm information of the target computing power resource, the node security status information of the node to which the target computing power resource belongs can be determined, thereby determining the security of the target computing power resource. Therefore, the scheduling method of the target computing power resource determined based on the alarm information can ensure the security of computing power scheduling, avoid the invocation of computing power resources with low security, and thus alleviate the security risk problems such as data tampering, leakage, and service unavailability caused by the poor security of computing power scheduling in the prior art.

[0051] Based on the above research, the present disclosure provides a method for scheduling computing power resources. By obtaining the alarm information of the target computing power resources, the node security status information of the node to which the target computing power resources belong can be determined, thereby determining the security of the target computing power resources. Therefore, the scheduling method of the target computing power resources determined based on the alarm information can ensure the security of computing power scheduling, avoid the invocation of computing power resources with low security, and thus alleviate the security risk problems of data tampering, leakage, service unavailability, etc. in computing tasks caused by the poor security of computing power scheduling in the prior art.

[0052] To facilitate understanding of this embodiment, a method for scheduling computing resources disclosed in an embodiment of the present disclosure is first introduced in detail. The execution subject of the method for scheduling computing resources provided in an embodiment of the present disclosure is generally an electronic device with certain computing capabilities. In some possible implementations, the method for scheduling computing resources can be implemented by a processor calling a computer-readable instruction stored in a memory.

[0053] See also Figure 1 As shown, it is a flowchart of a method for scheduling computing resources provided by an embodiment of the present disclosure, the method comprising steps S101 to S103, which are applied to a security indicator proxy node, wherein:

[0054] S101. Obtain alarm information of a target computing resource; wherein the alarm information is used to indicate node security status information of a node to which the target computing resource belongs.

[0055] In the embodiments of the present disclosure, nodes and computing resources (i.e., service nodes) (i.e., target nodes) deployed with security functions can determine alarm information. The alarm information also includes: network security status information of the network to which the target computing resource belongs.

[0056] Here, security functions include network security functions and computing power resource security functions. Among them, network security functions, that is, security functions in the network, can be deployed by computing power service operators or network providers, including but not limited to: scanning and detection security functions. Computing power resource security functions, that is, security functions in computing power resources, can be deployed and managed by service providers, including but not limited to: various security functions.

[0057] The network security function can collect network security status information, including but not limited to: leak scanning, baseline scanning, and network abnormal behavior detection functions.

[0058] Among them, the computing power resource security function can collect node security status information. Among them, the node security status information includes but is not limited to: anomaly detection, threat attack tracing, and anti-virus.

[0059] S102. Determine a response strategy for the target computing resources based on the alarm information; wherein the response strategy is used to indicate a scheduling method for the target computing resources.

[0060] In an embodiment of the present disclosure, the alarm information can be comprehensively analyzed by the security indicator agent node (i.e., C-SeMA) to determine the response level of the target computing power resources corresponding to the alarm information; thereafter, the response strategy of the target computing power resources can be determined based on the response level of the target computing power resources.

[0061] Here, the response strategy includes but is not limited to: stopping scheduling of the computing resources to which the target computing resources belong, and lowering the scheduling priority of the target computing resources.

[0062] Among them, the credibility status, alarm type and alarm severity of the alarm information can be determined to conduct a comprehensive analysis of the alarm information, thereby determining the response level of the alarm information.

[0063] Here, after the response strategy is determined, the response strategy can be sent to the path decision node (ie, C-PS) through the security indicator proxy node.

[0064] S103: Scheduling the target computing resources based on the response strategy and the target computing resources.

[0065] In an embodiment of the present disclosure, the path decision node may determine the computing power information and network information of the target computing power resource, and then schedule the computing power resource for the target computing power resource based on the computing power information, network information and response strategy of the target computing power resource.

[0066] Here, the network information includes at least one of the following: network traffic information and baseline information of the network to which the target computing power resources are connected.

[0067] Here, the path decision node can preferentially determine the computing power resources and network information required for the computing task to be processed. Afterwards, the computing power resources that meet the computing power resources and network information required for the computing task to be processed are determined in the computing power resource library.

[0068] In the case where the determined computing power resources include the target computing power resources, it is determined whether to use the target computing power resources to process the pending computing task according to the response strategy of the target computing power resources.

[0069] In the disclosed embodiment, first, the alarm information of the target computing power resources is obtained; wherein the alarm information is used to indicate the node security status information of the node to which the target computing power resources belong; secondly, based on the alarm information, the response strategy of the target computing power resources is determined; wherein the response strategy is used to indicate the scheduling method of the target computing power resources; finally, the computing power resources are scheduled for the target computing power resources based on the response strategy.

[0070] In the above embodiment, by obtaining the alarm information of the target computing power resource, the node security status information of the node to which the target computing power resource belongs can be determined, thereby determining the security of the target computing power resource. Therefore, the scheduling method of the target computing power resource determined based on the alarm information can ensure the security of computing power scheduling, avoid the invocation of computing power resources with low security, and thus alleviate the security risk problems of data tampering, leakage, service unavailability, etc. in computing tasks caused by the poor security of computing power scheduling in the prior art.

[0071] In an optional implementation, the above steps determine the response strategy of the target computing power resource based on the alarm information, and specifically include the following steps:

[0072] First, based on the alarm information, the response level of the target computing resource is determined; wherein the response level is used to indicate the degree of danger of the target computing resource;

[0073] Then, based on the response level, the scheduling priority of the computing resources to which the target computing resources belong is determined, and the response strategy of the target computing resources is determined according to the scheduling priority.

[0074] In the example disclosed herein, the security indicator agent node can determine the response level of the target computing power resource based on the alarm information of the target computing power resource within the target period.

[0075] Here, the security indicator agent node can define the trust status, type and alarm level of different alarm information; then, when the alarm information is received, a comprehensive analysis is performed based on the trust status, type and alarm level of the alarm information to determine the response level of the target computing power resources.

[0076] Here, different scheduling priorities can be set for different response levels. The scheduling priorities of target computing resources are different, and the handling strategies (ie, response strategies) for the target computing resources are also different.

[0077] For example, when the scheduling priority is the first scheduling priority (i.e., the scheduling priority corresponding to the first response level described below), if there are computing resources with the same computing power, network and other conditions as the target computing resources, other computing resources will be called first. When the scheduling priority is the second scheduling priority (i.e., the scheduling priority corresponding to the second response level described below), the target computing resources will be disabled.

[0078] In an optional implementation, the above steps determine the response level of the target computing power resource based on the alarm information, and specifically include the following steps:

[0079] First, when the alarm information meets the preset safety conditions, the response level of the target computing resources is determined based on the alarm type and alarm level of the alarm information.

[0080] In the embodiment of the present disclosure, the preset security condition is that the alarm information does not carry unreliable attack information. In the case that the alarm information does not carry unreliable information, the alarm type and alarm level of the alarm information can be determined, and then the response level of the target computing power resource can be determined according to the alarm type and alarm level.

[0081] In the specific implementation, first, determine the trust status of the alarm information; wherein the trust status is used to indicate whether the alarm information carries untrustworthy attack information; then, determine the response level of the target computing resources based on the trust status and the alarm information.

[0082] In an embodiment of the present disclosure, the security indicator proxy node may define a trustworthy status judgment rule for alarm information, and then determine the trustworthy status of the alarm information based on the trustworthy status judgment rule.

[0083] For example, the alarm information reported by the node with security functions deployed, and the alarm information of the computing resources reported by the computing resources, the credible status of the alarm information is regarded as not carrying the untrusted attack information. The credible status is that the alarm information does not carry the untrusted attack information, which can reflect the vulnerability and attack status of the corresponding computing resources.

[0084] The alarm information of other computing resources reported by the computing resources is regarded as not carrying the untrustworthy attack information.

[0085] Here, when the credible state of the alarm information is deemed not to carry the untrusted attack information (i.e., when the preset security conditions are met), the response level of the target computing power resource can be determined based on the alarm type and alarm degree of the alarm information. When the credible state of the alarm information is deemed not to carry the untrusted attack information, the response level of the target computing power resource can be determined based on the alarm type of the alarm information.

[0086] Here, first, when it is determined based on the trusted state that the alarm information does not carry untrustworthy attack information, the alarm type of the alarm information and the alarm degree of the alarm information are determined; secondly, based on the alarm type and the alarm degree, the target alarm score of the target computing power resource is determined; finally, based on the first mapping relationship, the response level that matches the target alarm score is determined; wherein the first mapping relationship is used to indicate the association between each alarm score and each response level.

[0087] In an embodiment of the present disclosure, the security indicator proxy node can set a determination factor and a first determination rule for the alarm information that does not carry untrustworthy attack information, wherein the determination factor includes but is not limited to: the alarm type and the alarm severity of the alarm information.

[0088] Here, the security indicator proxy node can set the first judgment rule for the alarm levels contained in different alarm types. For example, set corresponding scores for the different alarm levels contained in the alarm type; when the alarm type is a vulnerability, the corresponding alarm levels are low-risk vulnerabilities, medium-risk vulnerabilities, and high-risk vulnerabilities. Among them, low-risk vulnerabilities correspond to 1 point, medium-risk vulnerabilities correspond to 2 points, and high-risk vulnerabilities correspond to 3 points. When the alarm type is a threat attack, the corresponding alarm levels are low-risk threat attacks, medium-risk threat attacks, and high-risk threat attacks. Among them, low-risk threat attacks correspond to 1 point, medium-risk threat attacks correspond to 2 points, and high-risk threat attacks correspond to 3 points.

[0089] Here, in the case that there are multiple alarm information in the first cycle, the corresponding score of each alarm information can be determined. Then, based on the score corresponding to each alarm information and the first mapping relationship, a response level matching the target alarm score is determined.

[0090] Here, the first determination rule also includes a preset score threshold and a response level corresponding to the preset score threshold. For example, including a first preset score threshold and a second preset score threshold, when the target alarm score is greater than the preset first preset score threshold and less than the second preset score threshold, the response level is determined to be the first response level; when the target alarm score is greater than the second preset score threshold, the response level is determined to be the second response level.

[0091] Among them, the second preset score threshold is greater than the first preset score threshold, and the risk level of the computing power resources corresponding to the second response level is higher than the risk level of the computing power resources corresponding to the first response level.

[0092] Here, first, the alarm sub-score of each alarm type for the alarm degree in the first period may be determined; then, the target alarm score may be determined based on the alarm sub-scores corresponding to all alarm types.

[0093] In an embodiment of the present disclosure, there may be multiple pieces of corresponding alarm information in the first period, and the alarm types corresponding to each piece of alarm information may be different.

[0094] Here, the alarm sub-score of the alarm type of each alarm information of the target computing power resource in the first period against the alarm degree can be recorded to determine the target alarm score of the target computing power resource.

[0095] Here, the alarm sub-scores of the alarm types of each alarm information of the target computing power resource in the first period can be added according to the alarm degree to obtain the target alarm score.

[0096] For example, in the first cycle, there are two alarm messages for the target computing power resource. Among them, the alarm type of the first alarm message is vulnerability, and the corresponding alarm level is low-risk vulnerability, so the alarm sub-score of the alarm message is 1 point. The alarm type of the second alarm message is threat attack, and the corresponding alarm level is medium-risk threat attack, so the alarm sub-score of the alarm message is 2 points. At this time, the target alarm score of the target computing power resource is 3 points.

[0097] In an optional implementation, the above steps determine the response level of the target computing power resource based on the alarm information, and specifically include the following steps:

[0098] First, when the alarm information does not meet the preset safety conditions, the alarm type of the alarm information is determined;

[0099] Then, based on the alarm type, determine the response level of the target computing resource.

[0100] Here, first, the alarm type of the alarm information can be determined based on the trusted state when the alarm information carries untrustworthy attack information; secondly, the number of alarm information corresponding to each alarm type in the second period can be counted; finally, the response level of the target computing power resource can be determined based on the number.

[0101] In an embodiment of the present disclosure, the security indicator proxy node may set a second determination rule for attack information that carries unreliable information, wherein the attack information that carries unreliable information is warning information for the node.

[0102] Here, the safety indicator agent node may set a second determination rule for different alarm types.

[0103] Here, in the case where there are multiple alarm information in the second cycle, the corresponding alarm type of each alarm information can be determined. Then, based on the alarm type corresponding to each alarm information and the second mapping relationship, a response level matching the target computing power resource is determined.

[0104] Here, the second determination rule also includes a preset quantity threshold and a response level corresponding to the preset quantity threshold. For example, when the alarm type is an attack alarm for computing power resources, it includes a first preset quantity threshold and a second preset quantity threshold. When the alarm type is an abnormal behavior alarm for computing power resources, it includes a third preset quantity threshold and a fourth preset quantity threshold.

[0105] When the number of alarm messages whose alarm type is attack alarm against computing power resources in the second period is greater than the first preset number threshold and less than the second preset number threshold, the response level is determined to be the first response level; when the number of alarm messages whose alarm type is attack alarm against computing power resources in the second period is greater than the second preset number threshold, the response level is determined to be the second response level.

[0106] When the number of alarm messages whose alarm type is abnormal behavior alarm for computing power resources in the second cycle is greater than the third preset number threshold and less than the fourth preset number threshold, the response level is determined to be the first response level; when the number of alarm messages whose alarm type is abnormal behavior alarm for computing power resources in the second cycle is greater than the fourth preset number threshold, the response level is determined to be the second response level.

[0107] The second preset quantity threshold is greater than the first preset quantity threshold, and the fourth preset quantity threshold is greater than the third preset quantity threshold.

[0108] In an optional implementation, the above steps determine the scheduling priority of the computing resources to which the target computing resources belong based on the response level, including:

[0109] First, when the response level of the target computing power resource is the first response level, the target computing power resource is added to the first computing power resource list;

[0110] Then, when the response level of the target computing power resource is the second response level, the target computing power resource is added to the second computing power resource list; wherein the degree of danger corresponding to the second response level is greater than the degree of danger corresponding to the first response level, and the calling priority of the computing power resources in the first computing power resource list is higher than the calling priority of the computing power resources in the second computing power resource list.

[0111] In the embodiments of the present disclosure, different response levels correspond to different handling strategies (i.e., response strategies), wherein the handling strategies include setting a first list, a second list (i.e., a first computing resource list), and a third list (i.e., a second computing resource list).

[0112] Here, the first list is the white list, that is, the list with the highest scheduling priority. The second list is the gray list, that is, the list with a scheduling priority lower than the scheduling priority corresponding to the first list. The third list is the black list, that is, the list with a scheduling priority lower than the scheduling priority corresponding to the second list.

[0113] Here, when scheduling computing resources for computing tasks, if there are no idle computing resources in the first list, or if there are no computing resources in the first list that meet the computing requirements of the computing tasks, the computing resources in the second list may be called. Here, calling computing resources in the third list may be prohibited.

[0114] In an optional implementation, after adding the target computing power resource to the first computing power resource list, the following steps are further included:

[0115] First, determine the response level of the target computing resources within the target time period;

[0116] Then, if the response level of the target computing power resource within the target time period does not reach the first response level, the target computing power resource is deleted from the first computing power resource list.

[0117] In an embodiment of the present disclosure, after the target computing resource is added to the first computing resource list, a target time period may be set for the target computing resource. Afterwards, if the response level of the target computing resource within the target time period does not reach the first response level, the target computing resource is removed from the first computing resource list (i.e., the target computing resource is deleted from the first computing resource list).

[0118] Here, after the target computing power resource is added to the second computing power resource list, a specified time period may be set for the target computing power resource. Afterwards, if the response level of the target computing power resource within the specified time period does not reach the second response level, the target computing power resource is removed from the second computing power resource list (i.e., the target computing power resource is deleted from the second computing power resource list). The specified time period is longer than the target time period.

[0119] In an optional implementation, the above step of obtaining the alarm information of the target computing power resource specifically includes the following steps:

[0120] First, determine the alarm rule of the target computing power resource; wherein the alarm rule carries the attribute value of at least one key attribute;

[0121] Secondly, send the alarm rules to the target node;

[0122] Finally, the alarm information sent by the target node after matching the alarm rules is obtained.

[0123] In an embodiment of the present disclosure, the security indicator agent node may determine the attribute value of the key attribute among the attributes of the security status information and the network security information.

[0124] Here, the security indicator agent node can determine the attribute value of the key attribute according to the influence degree and danger degree of each attribute of the security status information and the network security information.

[0125] For example, the specified vulnerability information and baseline information of computing resources obtained through network scanning in network security information, as well as the specified abnormal behavior information of computing resources obtained through network traffic monitoring are determined as the attribute values ​​of key attributes. The specified attack type, threat source IP address, domain name or MAC address, etc. of computing resources in security status information, as well as the specified abnormal behavior information of computing resources cooperating with computing resources, and the specified vulnerability information of computing resources are determined as the attribute values ​​of key attributes.

[0126] Here, after determining the alarm rule, the security indicator agent node can send the alarm rule to the target node deployed with the security function.

[0127] Here, after the target node receives the alarm rule, the security status information and network security information of the detected target computing resources can be matched through the alarm rule, the alarm information matching the alarm rule can be determined, and the alarm information can be sent to the security indicator agent node.

[0128] In an optional implementation, the above steps schedule the target computing resources based on the response strategy and the computing resources of the target computing resources, specifically including the following steps:

[0129] The response strategy is sent to the path decision node so that the path decision node schedules the target computing resources based on the response strategy and the target computing resources.

[0130] In the embodiments of the present disclosure, in the above Figure 1 Based on the described embodiment, the method is applied to a path decision node and further includes the following steps:

[0131] Get the response strategy sent by the security indicator agent node;

[0132] The target computing resources are scheduled based on the response strategy and the target computing resources.

[0133] Here, the security indicator proxy node can send the response strategy to the path decision node. Afterwards, the path decision node can determine the computing power resources and network information of the target computing power resources. Afterwards, when receiving the computing task, the path decision node can schedule the computing power resources according to the computing power resources, network information and response strategy of the target computing power resources. Those skilled in the art can understand that in the above method of the specific implementation method, the writing order of each step does not mean a strict execution order and constitutes any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0134] Based on the same inventive concept, the embodiments of the present disclosure also provide a scheduling device for computing power resources corresponding to the scheduling method for computing power resources. Since the principle of solving the problem by the device in the embodiments of the present disclosure is similar to the scheduling method for computing power resources in the embodiments of the present disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0135] The device comprises: a safety index proxy node and a path decision node;

[0136] The security indicator proxy node is used to obtain alarm information of the target computing power resources; wherein the alarm information is used to indicate the node security status information of the node to which the target computing power resources belong; based on the alarm information, a response strategy of the target computing power resources is determined; wherein the response strategy is used to indicate the scheduling method of the target computing power resources; and the computing power resources of the target computing power resources are scheduled based on the response strategy.

[0137] The path decision node is used to receive the response strategy; and schedule the target computing resources based on the response strategy.

[0138] In the embodiments of the present disclosure, nodes and computing resources (ie, service nodes) deployed with security functions (ie, target nodes described below) can determine alarm information.

[0139] Here, security functions include network security functions and computing power resource security functions. Among them, network security functions, that is, security functions in the network, can be deployed by computing power service operators or network providers, including but not limited to: scanning and detection security functions. Computing power resource security functions, that is, security functions in computing power resources, can be deployed and managed by service providers, including but not limited to: various security functions.

[0140] The network security function can collect network security status information, including but not limited to: leak scanning, baseline scanning, and network abnormal behavior detection functions.

[0141] Among them, the computing power resource security function can collect node security status information. Among them, the node security status information includes but is not limited to: anomaly detection, threat attack tracing, and anti-virus.

[0142] In an embodiment of the present disclosure, the alarm information can be comprehensively analyzed by the security indicator agent node (i.e., C-SeMA) to determine the response level of the target computing power resources corresponding to the alarm information; thereafter, the response strategy of the target computing power resources can be determined based on the response level of the target computing power resources.

[0143] Here, the response strategy includes but is not limited to: stopping scheduling of the computing resources to which the target computing resources belong, and reducing the scheduling priority of the computing resources to which the target computing resources belong.

[0144] Among them, the credibility status, alarm type and alarm severity of the alarm information can be determined to conduct a comprehensive analysis of the alarm information, thereby determining the response level of the alarm information.

[0145] Here, after the response strategy is determined, the response strategy can be sent to the path decision node (ie, C-PS) through the security indicator proxy node.

[0146] In an embodiment of the present disclosure, the path decision node may determine the computing power resources (i.e., computing power information) and network information of the target computing power resources. Afterwards, the computing power resources of the target computing power resources may be scheduled based on the computing power resources, network information and response strategy of the target computing power resources.

[0147] Here, the network information includes at least one of the following: network traffic information and baseline information of the network to which the target computing power resources are connected.

[0148] Here, the path decision node can preferentially determine the computing power resources and network information required for the computing task to be processed. Afterwards, the computing power resources that meet the computing power resources and network information required for the computing task to be processed are determined in the computing power resource library.

[0149] In the case where the determined computing power resources include the target computing power resources, it is determined whether to use the target computing power resources to process the pending computing task according to the response strategy of the target computing power resources.

[0150] In the above embodiment, by obtaining the alarm information of the target computing power resource, the node security status information of the node to which the target computing power resource belongs can be determined, thereby determining the security of the target computing power resource. Therefore, the scheduling method of the target computing power resource determined based on the alarm information can ensure the security of computing power scheduling, avoid the invocation of computing power resources with low security, and thus alleviate the security risk problems of data tampering, leakage, service unavailability, etc. in computing tasks caused by the poor security of computing power scheduling in the prior art.

[0151] like Figure 2 As shown, it is a schematic diagram of a scheduling device for computing resources provided by an embodiment of the present disclosure, including: a target node, a security indicator proxy node and a path decision node, wherein:

[0152] First, the security indicator proxy node determines the alarm rule and sends the alarm rule to the target node. Secondly, the target node determines the alarm information that matches the alarm rule through the alarm rule and sends the alarm information to the security indicator proxy node. Secondly, the security indicator proxy node determines the response level of the target computing power resource based on the alarm category of the alarm information. Secondly, the security indicator proxy node determines the response strategy of the target computing power resource based on the response level of the target computing power resource and sends the response strategy to the path decision node. Secondly, the path decision node schedules the computing power resource for the target computing power resource based on the response strategy and the computing power resource of the target computing power resource. Secondly, the security indicator proxy node determines whether the response level of the target computing power resource changes within the target time period or the specified time period, and updates the response level of the target computing power resource if the response level of the target computing power resource changes. Finally, the security indicator proxy node sends the updated response level to the path decision node if the response level of the target computing power resource is updated.

[0153] Based on the same inventive concept, the embodiments of the present disclosure also provide a scheduling architecture for computing power resources corresponding to the scheduling method for computing power resources. Since the principle of solving the problem by the architecture in the embodiments of the present disclosure is similar to the scheduling method for computing power resources in the embodiments of the present disclosure, the implementation of the architecture can refer to the implementation of the method, and the repeated parts will not be repeated.

[0154] For descriptions of the processing flow of each node in the device and the interaction flow between each node, reference may be made to the relevant descriptions in the above method embodiment, which will not be described in detail here.

[0155] like Figure 3 As shown, it is a schematic diagram of a scheduling architecture of computing resources provided by an embodiment of the present disclosure, including: clients (clients), C-SeMA (security indicator agent node), C-PS (path decision node), Security function (target node), CATS-forwarder (request forwarding node) and Service-contact Instance (service instance interacting with the client), wherein:

[0156] Clients are used to submit computing tasks to the scheduling architecture of computing resources.

[0157] C-SeMA is used to receive the alarm information about the node security status and network security status of computing resources collected by the Security function, and determine the response strategy based on the alarm information; then, it is sent to the C-PS with good network conditions, or CATS-forwarder.

[0158] C-PS / CATS-forwarder is used to schedule computing resources based on response strategies and computing resources.

[0159] Service-contact Instance is the service instance that interacts directly with the client.

[0160] Among them, clients (clients), C-SeMA (security indicator agent node), C-PS (path decision node), Security function (target node), CATS-forwarder (request forwarding node) and Service-contactInstance (service instance that interacts with the client) can all communicate and connect.

[0161] In the above embodiment, by obtaining the alarm information of the target computing power resource, the node security status information of the node to which the target computing power resource belongs can be determined, thereby determining the security of the target computing power resource. Therefore, the scheduling method of the target computing power resource determined based on the alarm information can ensure the security of computing power scheduling, avoid the invocation of computing power resources with low security, and thus alleviate the security risk problems of data tampering, leakage, service unavailability, etc. in computing tasks caused by the poor security of computing power scheduling in the prior art.

[0162] Corresponds to Figure 1 The present disclosure also provides an electronic device 400, such as Figure 4 FIG. 4 is a schematic diagram of the structure of an electronic device 400 provided in an embodiment of the present disclosure, including:

[0163] Processor 41, memory 42, and bus 43; memory 42 is used to store execution instructions, including internal memory 421 and external memory 422; the internal memory 421 is also called internal memory, which is used to temporarily store the operation data in the processor 41 and the data exchanged with the external memory 422 such as a hard disk. The processor 41 exchanges data with the external memory 422 through the internal memory 421. When the electronic device 400 is running, the processor 41 communicates with the memory 42 through the bus 43, so that the processor 41 executes the following instructions:

[0164] Obtaining alarm information of the target computing power resource; wherein the alarm information is used to indicate node security status information of the target computing power resource and / or network security status information of the network to which the target computing power resource belongs;

[0165] Based on the alarm information, determine a response strategy for the target computing resource; wherein the response strategy is used to indicate a scheduling method for computing resources to which the target computing resource belongs;

[0166] The target computing resource is scheduled based on the response strategy and the computing resource of the target computing resource.

[0167] The basic principles of the present disclosure are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present disclosure are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, and are not limitations. The above details do not limit the present disclosure to the necessity of adopting the above specific details to be implemented.

[0168] The block diagrams of the devices, apparatuses, equipment, and systems involved in this disclosure are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including," "comprising," "having," and the like are open words, referring to "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or," and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0169] Additionally, as used herein, "or" used in a list of items beginning with "at least one" indicates a separate list, so that, for example, a list of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not mean that the example described is preferred or better than other examples.

[0170] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0171] Various changes, substitutions, and modifications of the techniques described herein may be made without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of the present disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of events, means, methods, and actions described above. Currently existing or later to be developed processes, machines, manufactures, compositions of events, means, methods, or actions that perform substantially the same functions or achieve substantially the same results as the corresponding aspects described herein may be utilized. Thus, the appended claims include such processes, machines, manufactures, compositions of events, means, methods, or actions within their scope.

[0172] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0173] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims

1. A method for scheduling computing resources, characterized in that: The method comprises: Obtaining alarm information of a target computing resource; wherein the alarm information is used to indicate node security status information of a node to which the target computing resource belongs; Based on the alarm information, determining a response strategy for the target computing resource; wherein the response strategy is used to indicate a scheduling method for the target computing resource; The target computing resources are scheduled based on the response strategy.

2. The method according to claim 1, characterized in that The determining, based on the alarm information, a response strategy of the target computing power resource includes: Based on the warning information, determining a response level of the target computing power resource; wherein the response level is used to indicate the degree of danger of the target computing power resource; Based on the response level, the scheduling priority of the target computing power resource is determined, and the response strategy of the target computing power resource is determined according to the scheduling priority.

3. The method according to claim 2, characterized in that The determining, based on the alarm information, a response level of the target computing power resource includes: When the alarm information meets the preset safety conditions, the response level of the target computing power resource is determined based on the alarm type and alarm severity of the alarm information.

4. The method according to claim 2, characterized in that The determining, based on the alarm information, a response level of the target computing power resource includes: When the alarm information does not meet the preset safety conditions, the response level of the target computing power resource is determined based on the alarm type of the alarm information.

5. The method according to claim 2, characterized in that The determining, based on the response level, the scheduling priority of the computing power resource to which the target computing power resource belongs includes: When the response level of the target computing power resource is the first response level, adding the target computing power resource to the first computing power resource list; When the response level of the target computing power resource is the second response level, the target computing power resource is added to the second computing power resource list; wherein the danger level corresponding to the second response level is greater than the danger level corresponding to the first response level, and the calling priority of the computing power resources in the first computing power resource list is higher than the calling priority of the computing power resources in the second computing power resource list.

6. The method according to claim 5, characterized in that After adding the target computing power resource to the first computing power resource list, the method further includes: Determine the response level of the target computing power resource within the target time period; When the response level of the target computing power resource within the target time period does not reach the first response level, the target computing power resource is deleted from the first computing power resource list.

7. The method according to claim 1, characterized in that The obtaining of the target computing resource warning information includes: Determine an alarm rule for the target computing resource; wherein the alarm rule carries an attribute value of at least one key attribute; Sending the alarm rule to the target node; The alarm information sent by the target node after matching according to the alarm rule is obtained.

8. The method according to claim 1, characterized in that The computing resource based on the response strategy and the target computing resource schedules the target computing resource, including: The response strategy is sent to a path decision node, so that the path decision node schedules the target computing power resource based on the response strategy and the target computing power resource.

9. A method for scheduling computing resources, characterized in that: The method comprises: Obtaining a response strategy sent by a safety indicator proxy node; wherein the response strategy is determined by the safety indicator proxy node according to the method described in any one of claims 1 to 8 above; The target computing resources are scheduled based on the response strategy.

10. A computing resource scheduling device, characterized in that: include: Safety indicator proxy nodes and path decision nodes; The security indicator proxy node obtains the alarm information of the target computing power resource; wherein the alarm information is used to indicate the node security status information of the node to which the target computing power resource belongs; based on the alarm information, a response strategy of the target computing power resource is determined; wherein the response strategy is used to indicate the scheduling mode of the target computing power resource; and the computing power resource is scheduled for the target computing power resource based on the response strategy; The path decision node is used to receive the response strategy; and schedule the target computing resources based on the response strategy.

11. A computer device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method of claims 1 to 9.

12. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to claims 1 to 9 are implemented.

13. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to claims 1 to 9 are implemented.

Images