Defense resource determination method and device, equipment and medium

Abstract

The embodiment of the invention provides a defense resource determination method and device, equipment and a medium, which are used for solving the problems that the accuracy of manual defense resource allocation is low and the security of defense equipment cannot be effectively improved in the related technology. In the embodiment of the invention, the electronic equipment maps the topological connection relation of the network into the undirected graph and takes the traffic of each link as the weight of the edge, so that the actual traffic distribution condition of the network can be intuitively and accurately reflected, and the minimum cut set is determined on the undirected graph by utilizing the minimum cut algorithm, so that the traffic distribution accuracy is improved. The electronic equipment can quickly identify the key link in the network. Based on the traffic of each link, the preset link parameter and the target function, the electronic device can scientifically predict the target newly-added defense resource quantity required by each link. The prediction method not only considers the current network flow condition, but also combines the characteristics and defense requirements of the link, thereby ensuring the rationality and effectiveness of resource allocation, and improving the security of defense equipment.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a defense resource determination method, device, equipment and medium. Background Art

[0002] In recent years, the Internet of Things (IoT) has developed very rapidly. With the continuous popularization of the fifth generation of mobile communication technology, more and more IoT devices have entered thousands of households. However, these IoT devices that can be seen everywhere in life are often limited by resources, volume, energy consumption and other aspects. They can only perform their basic functions and are difficult to guarantee security. This makes the security of IoT devices worrying. For hackers, they are very easy to be remotely implanted with malicious programs and then completely controlled. Unknowingly, the various IoT devices in the user's home are no longer under the control of their users. In addition to the destruction of these IoT devices themselves, a more serious threat is that hackers control these devices to form zombie armies or zombie networks to launch distributed denial of service (DDoS) attacks. DDoS attacks often paralyze the network or target nodes quickly in a short period of time through a large number of requests or flooding attack traffic.

[0003] Therefore, this requires staff to be able to reasonably allocate defense resources, where defense resources refer to disaster recovery nodes, backup links, and adjusted link bandwidth, etc. In related technologies, defense resources are usually allocated manually, which is subjective and has a low accuracy rate, and cannot accurately and effectively solve the security of defense equipment. Summary of the invention

[0004] The embodiments of the present application provide a defense resource determination method, apparatus, device and medium, which are used to solve the problem in the related art that manual allocation of defense resources has low accuracy and cannot effectively improve the security of defense equipment.

[0005] In a first aspect, an embodiment of the present application provides a method for determining defense resources, the method comprising:

[0006] Obtaining an undirected graph corresponding to a topological connection relationship of a network of defense devices; monitoring the traffic of a link between each device in the topological connection relationship;

[0007] Determine the flow of each link as the weight of the corresponding edge in the undirected graph; determine a minimum cut set based on the undirected graph recording the weight of each edge and the minimum cut algorithm; determine the link corresponding to each edge in the minimum cut set as a key link;

[0008] Based on the traffic of each link, the preset parameters corresponding to each link and the preset objective function, the target additional defense resource amount corresponding to each link is predicted.

[0009] In a second aspect, an embodiment of the present application further provides a defense resource determination device, the device comprising:

[0010] A processing module, used to obtain an undirected graph corresponding to a topological connection relationship of a network of defense devices; and monitor the traffic of a link between each device in the topological connection relationship;

[0011] A determination module is used to determine the flow of each link as the weight of the corresponding edge in the undirected graph; determine a minimum cut set based on the undirected graph recording the weight of each edge and a minimum cut algorithm; and determine the link corresponding to each edge in the minimum cut set as a key link;

[0012] The prediction module is used to predict the target additional defense resource amount corresponding to each link based on the traffic of each link, the preset parameters corresponding to each link and the preset objective function.

[0013] In a third aspect, an embodiment of the present application further provides an electronic device, including:

[0014] A memory for storing program instructions;

[0015] The processor is used to call the program instructions stored in the memory and execute the steps included in any one of the above-mentioned methods for determining defense resources according to the obtained program instructions.

[0016] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes a method for determining defense resources as described in any one of the above items.

[0017] In an embodiment of the present application, the electronic device obtains an undirected graph corresponding to the topological connection relationship of the network of the defense device; monitors the flow of the link between each device in the topological connection relationship; determines the flow of each link as the weight of the corresponding edge in the undirected graph; determines the minimum cut set based on the undirected graph with the weight of each edge recorded and the minimum cut algorithm; determines the link corresponding to each edge in the minimum cut set as a key link; predicts the target newly added defense resource amount corresponding to each link based on the flow of each link, the preset parameters corresponding to each link, and the preset objective function. Since in the embodiment of the present application, the electronic device can intuitively and accurately reflect the actual flow distribution of the network by mapping the topological connection relationship of the network to an undirected graph and using the flow of each link as the weight of the edge, and determines the minimum cut set on the undirected graph using the minimum cut algorithm, the electronic device can quickly identify the key links in the network. Based on the flow of each link, the preset link parameters and the objective function, the electronic device can scientifically predict the target newly added defense resource amount required for each link. This prediction method not only takes into account the current network flow status, but also combines the characteristics of the link and the defense requirements, thereby ensuring the rationality and effectiveness of resource allocation and improving the security of the defense device. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical application embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 A schematic diagram of a method for determining defense resources provided in an embodiment of the present application;

[0020] Figure 2 A schematic diagram of an undirected graph provided in an embodiment of the present application;

[0021] Figure 3 A schematic diagram of a typical DDoS attack scenario provided in an embodiment of the present application;

[0022] Figure 4 A detailed schematic diagram of a process for determining defense resources provided in an embodiment of the present application;

[0023] Figure 5 A structural diagram of a defense resource determination device provided in an embodiment of the present application;

[0024] Figure 6 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical application embodiments and advantages of this application clearer, the technical application embodiments in the embodiments of this application will be described clearly and completely in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field belong to the scope of protection of this application.

[0026] Obviously, the drawings described below are only some examples or embodiments of the present application. For ordinary technicians in this field, the present application can also be applied to other similar scenarios based on these drawings without creative work. In addition, it can also be understood that although the efforts made in this development process may be complicated and lengthy, for ordinary technicians in this field related to the content disclosed in this application, some changes in design, manufacturing or production based on the technical content disclosed in this application are just conventional technical means, and should not be understood as insufficient content disclosed in this application.

[0027] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those of ordinary skill in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0028] The words "connected", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The "plurality" involved in this application refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previous and subsequent associated objects are in an "or" relationship. The terms "first", "second", "third" and the like involved in this application are merely used to distinguish similar objects, and do not represent a specific ordering of objects.

[0029] In addition, the technical application embodiments between the various embodiments may be combined with each other, but this must be based on the fact that they can be implemented by ordinary technicians in the field. When the combination of the technical application embodiments is mutually contradictory or cannot be implemented, it should be deemed that such combination of the technical application embodiments does not exist and is not within the scope of protection required by this application.

[0030] In order to accurately and effectively determine defense resources and improve the security of defense equipment, the embodiments of the present application provide a defense resource determination method, apparatus, device and medium.

[0031] The method for determining defense resources includes: an electronic device obtains an undirected graph corresponding to the topological connection relationship of a network of defense devices; monitors the traffic of links between each device in the topological connection relationship; determines the traffic of each link as the weight of the corresponding edge in the undirected graph; determines a minimum cut set based on the undirected graph recording the weight of each edge and a minimum cut algorithm; determines the link corresponding to each edge in the minimum cut set as a key link; and predicts the target additional defense resource amount corresponding to each link based on the traffic of each link, preset parameters corresponding to each link, and a preset objective function.

[0032] Embodiment 1:

[0033] Figure 1 A schematic diagram of a method for determining defense resources provided in an embodiment of the present application, the process comprising the following steps:

[0034] S101: Obtain an undirected graph corresponding to a topological connection relationship of a network of defense devices; and monitor the traffic of a link between each device in the topological connection relationship.

[0035] The defense resource determination method provided in the embodiment of the present application is applied to an electronic device, which may be a smart device such as a PC or a server.

[0036] In order to accurately and effectively determine the defense resources, the electronic device can obtain the topological connection relationship of the network of the defense device. After obtaining the topological connection relationship, the electronic device abstracts the topological connection relationship into an undirected graph. Specifically, the servers and devices in the network can be periodically abstracted as nodes, and the links are abstracted as edges to form an undirected graph. It should be noted that the selection of an undirected graph rather than a directed graph for design in the embodiment of the present application is mainly based on cost-effectiveness and system complexity considerations. Specifically, if specific data on the direction of the flow needs to be collected, the IP address or routing details must be collected additionally, which will significantly increase the implementation cost and increase the complexity of the system architecture. From the perspective of alleviating network pressure alone, without considering the specific direction of the flow, focusing only on the link load situation, the goal can also be effectively achieved. Therefore, the use of an undirected graph design has become an economical and practical choice.

[0037] The electronic device monitors the traffic of the link between each device in the topological connection relationship.

[0038] S102: Determine the traffic of each link as the weight of the corresponding edge in the undirected graph; determine a minimum cut set based on the undirected graph recording the weight of each edge and a minimum cut algorithm; determine the link corresponding to each edge in the minimum cut set as a critical link.

[0039] The electronic device can determine the traffic of each link as the weight of the corresponding edge in the undirected graph.

[0040] After determining the weight of each edge in the undirected graph, the electronic device can use the undirected graph containing the weight of each edge and the minimum cut algorithm to determine the minimum cut set. Among them, the minimum cut algorithm can be the Stoer-Wagner algorithm, Karger's algorithm or Edmonds-Karp algorithm, etc. The minimum cut set refers to a set of edges that can cause the topological connection relationship of the network to be broken after removal, and the total weight of this set of edges is the smallest. Removing these edges may hinder normal traffic from reaching the defense device. In view of the small weight of the minimum cut set, the link corresponding to each edge in the minimum cut set is determined as a critical link. Among them, the minimum cut set is the cut with the smallest edge weight. The cut of a graph or network represents a section or tangent, which divides the graph or network into two subsets containing source points and sink points respectively. The set of edges or edges where the tangent or section intersects with the network is called the cut of the image.

[0041] In a possible implementation, in the process of setting weights based on traffic, the weights corresponding to the edges corresponding to the links connecting the terminal and the firewall device with other devices may not be determined temporarily.

[0042] Figure 2 A schematic diagram of an undirected graph provided in an embodiment of the present application.

[0043] Depend on Figure 2 It can be seen that the undirected graph includes attackers, multiple firewalls, multiple routes, and hosts. Figure 2 The Host in is the defense device described in the embodiment of the present application. Figure 2 It can be seen that Route 1 With Route 4 The weight of the edge corresponding to the connected link is 10; 2 With Route 4 The weight of the edge corresponding to the connected link is 7; Route 2 With Route 5 The weight of the edge corresponding to the connected link is 8; 3 With Route 5 The weight of the edge corresponding to the connected link is 5; 4 With Route 6The weight of the edge corresponding to the connected link is 10; 4 With Route 7 The weight of the edge corresponding to the connected link is 10; 5 With Route 7 The weight of the edge corresponding to the connected link is 15; 5 With Route 8 The weight of the edge corresponding to the connected link is 10; 6 The weight of the edge corresponding to the link connected to the Host is 10; 7 The weight of the edge corresponding to the link connected to the Host is 10; 58 The weight of the edge corresponding to the link connected to Host is 5.

[0044] After determining the minimum cut set, the indicator function can be generated and defined for each edge (i, j):

[0045]

[0046] Among them, C min-cut is the minimum cut set. min(i,j) is the indicator function.

[0047] S103: Based on the traffic of each link, the preset parameters corresponding to each link, and the preset objective function, predict the target additional defense resource amount corresponding to each link.

[0048] In an embodiment of the present application, the electronic device can predict the target additional defense resource amount corresponding to each link based on the traffic of each link, the preset parameters corresponding to each link, and the preset objective function.

[0049] In one possible implementation, the electronic device may perform the following operations for each link in the topological connection relationship: first, calculate the first product of the traffic of each link and its risk coefficient, and simultaneously calculate the second product of the amount of new resources to be added to the link and its resource cost coefficient; then, find the ratio of these two products. Subsequently, add the ratios of all non-critical links to obtain a global risk term, and add the ratios of all critical links to obtain a critical link risk term. Finally, construct an objective function based on the sum of the global risk term and the critical link risk term. The optimization goal of the objective function is to minimize it. By solving the objective function, when the minimum value is reached, the target amount of new defense resources required for each link can be determined.

[0050] Figure 3 A schematic diagram of a typical DDoS attack scenario provided in an embodiment of the present application.

[0051] Depend on Figure 3 It can be seen that in this network scenario, when hackers send DDoS attack traffic from the network boundary into the network to reach the target, the defender needs to block the attack traffic as soon as possible, perform routing switching on the congested links in the network, start backup links, and execute corresponding strategies to mitigate the impact of the DDoS attack.

[0052] The embodiment of the present application proposes a method for dynamically confirming key links based on the minimum cut, collects traffic data of communication links between nodes in real time, monitors changes in network topology, periodically calculates the minimum cut set existing in the current cycle in the network and confirms the elements existing in the set, provides a data basis for the calculation of subsequent objective functions, and improves the accuracy of resource allocation. In the existing Internet scenario, according to the network topology and traffic characteristic status, combined with resource defense effect and investment cost, an optimal balance point can be quickly found between the two, and reasonable resource allocation can be completed, the impact of DDoS attacks on the network can be reduced, the user's service availability can be guaranteed, and the operation and maintenance costs can be controlled as much as possible.

[0053] In actual scenarios, attackers will also intentionally attack nodes with relatively scarce processing resources or links with weak bandwidth resources. In addition to traditional User Datagram Protocol (UDP) attacks and Synchronize Sequence Numbers (SYN) attacks, these attacks also include reflection amplification attacks, slow attacks and link flooding attacks that have appeared more widely in recent years. Even though there are many types of attacks, the purpose of denial of service is ultimately achieved by exhausting resources or bandwidth. Therefore, this requires the defender to reasonably allocate defense resources and control redundant costs in order to find a better balance between the two. In addition, it is also necessary to have a faster response speed or stronger real-time performance so that decisions can be made quickly based on the size and degree of damage of the attack. Based on this, the embodiment of the present application uses the minimum cut in graph theory to establish a model and an objective function, and uses the interior point method to solve the optimal resource allocation application embodiment, combining the actual operating costs and required resources, and providing a design basis for defense and deployment resources from a theoretical level. The interior point method is an algorithm for solving linear programming or nonlinear convex optimization problems. There is a penalty function in the interior point method for describing convex sets. Unlike the simplex method, it searches for the optimal solution by traversing the interior feasible region.

[0054] In the embodiment of the present application, the electronic device can intuitively and accurately reflect the actual traffic distribution of the network by mapping the topological connection relationship of the network into an undirected graph and using the traffic of each link as the weight of the edge. The minimum cut algorithm is used to determine the minimum cut set on the undirected graph, and the electronic device can quickly identify the key links in the network. Based on the traffic of each link, the preset link parameters and the objective function, the electronic device can scientifically predict the target additional defense resource amount required for each link. This prediction method not only takes into account the current network traffic status, but also combines the characteristics of the link and the defense requirements, thereby ensuring the rationality and effectiveness of resource allocation and improving the security of defense equipment.

[0055] Embodiment 2:

[0056] In order to accurately and effectively determine the defense resources, based on the above embodiment, in the embodiment of the present application, the flow of each link is determined as the weight of the corresponding edge in the undirected graph, including:

[0057] Normalize or standardize the traffic of each link;

[0058] The normalized or standardized traffic of each link is determined as the weight of the corresponding edge in the undirected graph.

[0059] In an embodiment of the present application, the electronic device can normalize or standardize the traffic of each link. Specifically, the process of performing normalization or standardization operations on the traffic is intended to eliminate the comparison barriers caused by differences in the dimensions and magnitudes of the original data between different links, so that the traffic data is comparable. Normalization usually scales the traffic number to a specific range, which can be from 0 to 1, and standardization converts the traffic data into a value with standard normal distribution characteristics by subtracting the mean and dividing by the standard deviation.

[0060] After normalizing or standardizing all link traffic, these processed traffic values ​​are directly mapped to the corresponding edges in the undirected graph model as edge weights. An undirected graph is a graphical representation method in which nodes represent entities in the network, while edges represent connections or communication links between these entities, and edge weights reflect the traffic intensity or importance on the connection.

[0061] In order to accurately and effectively determine the defense resources, on the basis of the above embodiments, in the embodiment of the present application, the preset parameters corresponding to each link include:

[0062] Resource cost factor, risk factor and current defense cost.

[0063] The parameters corresponding to each link in the embodiment of the present application include the resource cost coefficient, risk coefficient and current defense cost of each link. It should be noted that the key link no longer has its own risk coefficient, but is replaced by a unified risk coefficient to strengthen the protection of the key link.

[0064] Embodiment 3:

[0065] In order to accurately and effectively determine the defense resources, based on the above embodiments, in the embodiment of the present application, the target additional defense resource amount corresponding to each link is predicted based on the traffic of each link, the preset parameters corresponding to each link, and the preset objective function, including:

[0066] According to the following objective function, the amount of newly added defense resources on the link (i, j) when the value of the objective function is the smallest is determined as the target amount of newly added defense resources for the link (i, j):

[0067]

[0068] Among them, x ij is the amount of new defense resources on link (I, j), k ij is the resource cost coefficient on link (i, j), a ij is the traffic on link (i, j), r ij is the risk coefficient of the traffic on link (i, j), c ij is the current defense cost of link (i, j), C min-cut The link in is a key link, β is a preset weight value, and E is each link in the topological connection relationship.

[0069] In order to accurately and effectively determine the defense resources, the electronic device can determine the target additional defense resource amount for each link according to the constructed objective function. Specifically, the objective function is:

[0070]

[0071] Among them, x ij is the amount of new defense resources on link (i, j), k ij is the resource cost coefficient on link (i, j), a ij is the traffic on link (i, j), r ij is the risk coefficient of the traffic on link (i, j), c ij is the current defense cost of link (i, j), C min-cut The link in is the key link, β is the preset weight value, and the link in E is each link in the topological connection relationship.

[0072] Sum the first term, that is is a new defense cost term, which represents the total cost of newly allocated defense resources on all links (i, j). is the global risk term, which represents the basic risk of all links. Sum the third term, that is is the key link risk term, which is similar to the second term, but the edges here all belong to the minimum cut set, and they no longer have their own risk coefficient r ij , and is replaced by a unified risk coefficient γ, which is used to strengthen the protection of the minimum cut link. In addition, β is used to balance the weight between cost and risk. For network defenders, by adjusting the value of β, the sensitivity of the model to cost and risk can be controlled. The larger the β, the more the model pays attention to reducing risks. Even if the cost is increased, it hopes to minimize the economic losses caused by the attack. The smaller β means that the model pays more attention to controlling costs, that is, in the case of limited resources, it will reduce expenses as much as possible, and may even accept higher risks.

[0073] Embodiment 4:

[0074] In order to accurately and effectively determine the defense resources, based on the above embodiments, in the embodiment of the present application, the target additional defense resource amount corresponding to each link is predicted based on the traffic of each link, the preset parameters corresponding to each link, and the preset objective function, including:

[0075] According to the following objective function, the amount of newly added defense resources on the link (i, j) when the value of the objective function is the smallest is determined as the target amount of newly added defense resources for the link (i, j):

[0076]

[0077] Among them, x ij is the amount of new defense resources on link (i, j), k ij is the resource cost coefficient on link (i, j), a ij is the traffic on link (i, j), r ij is the risk coefficient of the traffic on link (i, j), c ij is the current defense cost of link (i, j), C min-cut The link in is the key link, β is the preset weight value, E is each link in the topological connection relationship, γ is the risk coefficient of the traffic on the preset key link, and λ 1 , 2 , μ 1 , μ 2 is the Lagrange multiplier, M total is the preset cost cap, X total The preset upper limit of resource allocation.

[0078] It should be noted that the newly added defense cost term in the objective function is a linear function and is therefore convex. The global risk term is the same as the key link risk term. is convex, and the numerator is also convex, so both are linear combinations of convex functions and maintain convexity. In summary, since the objective function is the weighted sum of three convex functions, the entire objective function is convex.

[0079] In order to accurately determine the defense resources, the electronic device needs to ensure that the newly added defense resources and resource cost coefficients for each link are non-negative and consistent with objective facts. Secondly, the sum of the newly added defense resources of the link should not exceed the range of resources that can be allocated. Similarly, the cost of the newly added defense resources should not exceed the range that the defender can bear. The significance of these constraints makes the entire model closer to the actual situation, which is convenient for increasing the actual value of the optimized resource allocation application implementation example.

[0080] Therefore, the constraints determined by the electronics are as follows:

[0081] x ij ≥0,k ij ≥0,

[0082]

[0083] Among them, x ij is the amount of new defense resources on link (i, j), k ij is the resource cost coefficient on link (i, j), the links in E are each link in the topological connection relationship, X total is the preset upper limit of defense resources, M total The preset cost cap.

[0084] If the upper limit of newly allocated resources in the network is X total =50, the upper limit of the available cost is M total =5000, then the constraint condition is determined as:

[0085] x ij ≥0,k ij ≥0,

[0086]

[0087] After determining the objective function, decision variables and constraints, the embodiment of the present application adopts the interior point method to solve. First, the Lagrange multiplier λ is introduced. 1 , 2 and μ 1 , μ 2 Then the constraints are integrated into the objective function to construct the Lagrangian function L, which is the integrated objective function:

[0088]

[0089] Among them, x ij is the amount of new defense resources on link (i, j), k ij is the resource cost coefficient on link (i, j), a ij is the traffic on link (i, j), r ij is the risk coefficient of the traffic on link (i, j), c ij is the current defense cost of link (i, j), C min-cut The link in is the key link, β is the preset weight value, E is each link in the topological connection relationship, γ is the risk coefficient of the traffic on the preset key link, and λ 1 , 2 , μ 1 , μ 2 is the Lagrange multiplier, M total is the preset cost cap, X total The preset upper limit of resource allocation.

[0090] Then construct the pair x ij and k ij The partial derivative of is solved when the partial derivative is 0, and the complementary relaxation condition is calculated. The optimal solution is obtained by selecting the initial value, iterative update, controlling the step size, and convergence judgment. That is, the solution with the minimum value of the integrated objective function is obtained. Since the specific solution of the Lagrangian function belongs to the existing technology, it will not be repeated here. Finally, the amount of additional defense resources is determined for each link in the network under attack through the solution result, and the cost control effect is achieved.

[0091] That is to say, after determining the objective function, decision variables and constraints, the electronic device will construct a Lagrangian function, and then use the interior point method to iteratively solve the optimal allocation application implementation example according to the traffic of each link and the preset parameters corresponding to each link. In the solution process, the iteration step size will also be set, such as t = 1, and the iteration termination condition will be set, such as the number of iterations t_max = 500. According to the optimization solution results, the optimal resource allocation application implementation example is determined, and network resources are scheduled to resist DDoS attacks.

[0092] Method for electronic devices to dynamically confirm key links based on minimum cut. Collect traffic data of communication links between nodes in real time, monitor changes in network topology, periodically calculate the minimum cut set in the current cycle in the network and confirm the elements in the set, provide data basis for the calculation of subsequent objective functions, and improve the accuracy of the solution; integrate the method of establishing the objective function of minimum cut. Construct an objective function that comprehensively considers defense costs, risks, and the importance of key links to improve the comprehensiveness and robustness of the model; method for determining key variables and constraints. Determine the value range of decision variables based on network characteristics and construction investment-related restrictions to improve the practical application value and feasibility of the solution; use the solution optimization mechanism of the interior point method. Optimize and solve the abstracted mathematical function from the mathematical theory level, and make specific allocation of resources and costs based on the solution results to improve the integrity of the solution.

[0093] Embodiment 5:

[0094] Figure 4 A detailed schematic diagram of a process for determining defense resources provided in an embodiment of the present application;

[0095] Step 1:

[0096] The topological link relationship of the network is abstracted into an undirected graph, and the traffic situation of each link in the network is monitored. The absolute value of the traffic on each link needs to be periodically counted and normalized or standardized to obtain the edge weight of the undirected graph.

[0097] Step 2:

[0098] According to the weight of each link, the minimum cut set is obtained. Figure 2 For example, let the source node be the attacker in the graph and the sink node be the Host. By calculating different cut sets, the minimum cut set is finally obtained as Router 6 To the Host and the Router 7 To the host's side.

[0099] Step 3:

[0100] The objective function is established based on the minimum cut set and convex optimization theory. The objective function is used to represent the balance between the defense effect and the cost of additional allocated resources.

[0101] Step 4:

[0102] The constraints are determined according to the range of all decision variables that can be called in the network and the actual physical conditions, and the allocation range is delineated according to the resources reserved by the defender and the maximum acceptable cost.

[0103] Step 5:

[0104] The problem is solved using the interior point method to optimize the allocation of new resources for each edge. Network resources are scheduled to mitigate DDoS attacks.

[0105] The purpose of the embodiment of the present application is to provide a method for solving the optimal resource scheduling and cost optimization scheme in the network based on the minimum cut and interior point method, starting from using the minimum cut to confirm the key links of the network, combining the two theories of graph theory and convex optimization to establish the objective function, comprehensively considering the defense cost, risk and key links, and providing the defender with the theoretical basis and specific technical solutions for resource allocation and disaster recovery and mitigation equipment construction. The embodiment of the present application is to deal with the proliferation of DDoS attacks in the existing Internet, and lacks the optimal application embodiment design and theoretical basis in terms of defending DDoS attacks and alleviating network pressure. The embodiment of the present application confirms the key links in the network based on the minimum cut concept in graph theory, establishes the objective function according to the allocation of defense resources, the relevant information of attack traffic and the cost required to deploy related resources, uses the actual network conditions to confirm the key variables and constraints, and finally uses the interior point method in convex optimization to quickly and accurately solve the resource allocation application embodiment with the lowest cost and the best effect. Not only comprehensively consider the defense resource allocation and cost control, but also give priority to the protection of key links in the network. Help network managers to allocate resources more effectively in the face of DDoS attacks and ensure the overall security and connectivity of the network.

[0106] Based on this, the embodiment of the present application proposes a method for establishing an objective function that integrates the minimum cut, constructs an objective function that comprehensively considers the defense cost, risk, and importance of key links, and improves the integration and robustness of the model; proposes a method for determining key variables and constraints, determines the value range of decision variables based on network characteristics and construction investment-related restrictions, and improves the practical application value and feasibility of the embodiment of the application; proposes a solution optimization mechanism using the interior point method, optimizes and solves the abstracted mathematical function from a mathematical theory level, and makes specific allocation of resources and costs based on the solution results, thereby improving the integrity of the embodiment of the application.

[0107] Embodiment 6:

[0108] Based on the same inventive concept, the present application embodiment also provides a defense resource determination device, please refer to Figure 5 , the device comprises:

[0109] Processing module 501 is used to obtain an undirected graph corresponding to the topological connection relationship of the network of defense devices; monitor the traffic of the link between each device in the topological connection relationship;

[0110] The determination module 502 is used to determine the flow of each link as the weight of the corresponding edge in the undirected graph; determine the minimum cut set based on the undirected graph recording the weight of each edge and the minimum cut algorithm; determine the link corresponding to each edge in the minimum cut set as a key link;

[0111] The prediction module 503 is used to predict the target newly added defense resource amount corresponding to each link based on the traffic of each link, the preset parameters corresponding to each link and the preset objective function.

[0112] In a possible implementation, the determination module 501 is specifically configured to normalize or standardize the traffic of each link; and determine the traffic of each link after the normalization or standardization as the weight of the corresponding edge in the undirected graph.

[0113] In a possible implementation manner, the prediction module 503 is specifically configured to determine, according to the following objective function, the newly added defense resource amount on the link (i, j) when the value of the objective function is the minimum as the target newly added defense resource amount of the link (i, j):

[0114]

[0115] Among them, x ij is the amount of new defense resources on link (i, j), k ij is the resource cost coefficient on link (i, j), a ij is the traffic on link (i, j), r ij is the risk coefficient of the traffic on link (i, j), c ij is the current defense cost of link (i, j), C min-cut The link in is a key link, β is a preset weight value, and E is each link in the topological connection relationship.

[0116] In a possible implementation manner, the prediction module 503 is specifically configured to determine the target additional defense resource amount of the link (i, j) according to the following objective function:

[0117]

[0118] Among them, x ij is the amount of new defense resources on link (i, j), k ij is the resource cost coefficient on link (i, j), a ij is the traffic on link (i, j), r ij is the risk coefficient of the traffic on link (i, j), c ij is the current defense cost of link (i, j), C min-cutThe link in is the key link, β is the preset weight value, E is each link in the topological connection relationship, γ is the risk coefficient of the traffic on the preset key link, and λ 1 , 2 , μ 1 , μ 2 is the Lagrange multiplier, M total is the preset cost cap, X total The preset upper limit of resource allocation.

[0119] Embodiment 7:

[0120] Based on the same inventive concept, the present application embodiment provides an electronic device, which can implement the function of determining the defense resources mentioned above. Please refer to Figure 6 The device includes a processor 601, a memory 603 and a communication bus 604, wherein the processor 601, the communication interface 602 and the memory 603 communicate with each other through the communication bus 604.

[0121] The memory 603 stores a computer program. When the program is executed by the processor 401, the processor 601 performs the following steps:

[0122] Obtaining an undirected graph corresponding to a topological connection relationship of a network of defense devices; monitoring the traffic of a link between each device in the topological connection relationship;

[0123] Determine the flow of each link as the weight of the corresponding edge in the undirected graph; determine a minimum cut set based on the undirected graph recording the weight of each edge and the minimum cut algorithm; determine the link corresponding to each edge in the minimum cut set as a key link;

[0124] Based on the traffic of each link, the preset parameters corresponding to each link and the preset objective function, the target additional defense resource amount corresponding to each link is predicted.

[0125] In a possible implementation manner, determining the flow of each link as the weight of the corresponding edge in the undirected graph includes:

[0126] Normalize or standardize the traffic of each link;

[0127] The normalized or standardized traffic of each link is determined as the weight of the corresponding edge in the undirected graph.

[0128] In a possible implementation manner, the preset parameters corresponding to each link include:

[0129] Resource cost factor, risk factor and current defense cost.

[0130] In a possible implementation manner, the predicting the target additional defense resource amount corresponding to each link based on the traffic of each link, the preset parameters corresponding to each link, and the preset objective function includes:

[0131] According to the following objective function, the amount of newly added defense resources on the link (i, j) when the value of the objective function is the smallest is determined as the target amount of newly added defense resources for the link (i, j):

[0132]

[0133] Among them, x ij is the amount of new defense resources on link (i, j), k ij is the resource cost coefficient on link (i, j), a ij is the traffic on link (i, j), r ij is the risk coefficient of the traffic on link (i, j), c ij is the current defense cost of link (i, j), C min-cut The link in is a key link, β is a preset weight value, and E is each link in the topological connection relationship.

[0134] In a possible implementation manner, the predicting the target additional defense resource amount corresponding to each link based on the traffic of each link, the preset parameters corresponding to each link, and the preset objective function includes:

[0135] According to the following objective function, the target additional defense resource amount of link (i, j) is determined:

[0136]

[0137] Among them, x ij is the amount of new defense resources on link (i, j), k ij is the resource cost coefficient on link (i, j), a ij is the traffic on link (i, j), r ij is the risk coefficient of the traffic on link (i, j), c ij is the current defense cost of link (i, j), C min-cut The link in is the key link, β is the preset weight value, E is each link in the topological connection relationship, γ is the risk coefficient of the traffic on the preset key link, and λ 1 , 2 , μ 1 , μ 2 is the Lagrange multiplier, M total is the preset cost cap, X total The preset upper limit of resource allocation.

[0138] The communication bus mentioned in the above server can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0139] The communication interface 602 is used for communication between the electronic device and other devices.

[0140] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0141] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (Network Processor, NP), etc.; it can also be a digital signal processing processor (Digital Signal Processing, DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0142] Embodiment 8:

[0143] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program executable by an electronic device. When the program runs on the electronic device, the electronic device implements the following steps when executing:

[0144] Obtaining an undirected graph corresponding to a topological connection relationship of a network of defense devices; monitoring the traffic of a link between each device in the topological connection relationship;

[0145] Determine the flow of each link as the weight of the corresponding edge in the undirected graph; determine a minimum cut set based on the undirected graph recording the weight of each edge and the minimum cut algorithm; determine the link corresponding to each edge in the minimum cut set as a key link;

[0146] Based on the traffic of each link, the preset parameters corresponding to each link and the preset objective function, the target additional defense resource amount corresponding to each link is predicted.

[0147] In a possible implementation manner, determining the flow of each link as the weight of the corresponding edge in the undirected graph includes:

[0148] Normalize or standardize the traffic of each link;

[0149] The normalized or standardized traffic of each link is determined as the weight of the corresponding edge in the undirected graph.

[0150] In a possible implementation manner, the preset parameters corresponding to each link include:

[0151] Resource cost factor, risk factor and current defense cost.

[0152] In a possible implementation manner, the predicting the target additional defense resource amount corresponding to each link based on the traffic of each link, the preset parameters corresponding to each link, and the preset objective function includes:

[0153] According to the following objective function, the amount of newly added defense resources on the link (i, j) when the value of the objective function is the smallest is determined as the target amount of newly added defense resources for the link (i, j):

[0154]

[0155] Among them, x ij is the amount of new defense resources on link (i, j), k ij is the resource cost coefficient on link (i, j), a ij is the traffic on link (i, j), r ij is the risk coefficient of the traffic on link (i, j), c ij is the current defense cost of link (i, j), C min-cut The link in is a key link, β is a preset weight value, and E is each link in the topological connection relationship.

[0156] In a possible implementation manner, the predicting the target additional defense resource amount corresponding to each link based on the traffic of each link, the preset parameters corresponding to each link, and the preset objective function includes:

[0157] According to the following objective function, the target additional defense resource amount of link (i, j) is determined:

[0158]

[0159] Among them, x ij is the amount of new defense resources on link (i, j), k ij is the resource cost coefficient on link (i, j), a ijis the traffic on link (i, j), r ij is the risk coefficient of the traffic on link (i, j), c ij is the current defense cost of link (i, j), C min-cut The link in is the key link, β is the preset weight value, E is each link in the topological connection relationship, γ is the risk coefficient of the traffic on the preset key link, and λ 1 , 2 , μ 1 , μ 2 is the Lagrange multiplier, M total is the preset cost cap, X total The preset upper limit of resource allocation.

[0160] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0161] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0162] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0163] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0164] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for determining defense resources, characterized in that: The method comprises: Obtaining an undirected graph corresponding to a topological connection relationship of a network of defense devices; monitoring the traffic of a link between each device in the topological connection relationship; Determine the flow of each link as the weight of the corresponding edge in the undirected graph; determine a minimum cut set based on the undirected graph recording the weight of each edge and the minimum cut algorithm; determine the link corresponding to each edge in the minimum cut set as a key link; Based on the traffic of each link, the preset parameters corresponding to each link and the preset objective function, the target additional defense resource amount corresponding to each link is predicted.

2. The method according to claim 1, characterized in that: Determining the flow of each link as the weight of the corresponding edge in the undirected graph includes: Normalize or standardize the traffic of each link; The normalized or standardized traffic of each link is determined as the weight of the corresponding edge in the undirected graph.

3. The method according to claim 1, characterized in that The preset parameters corresponding to each link include: Resource cost factor, risk factor and current defense cost.

4. The method according to claim 1, characterized in that: The predicting of the target additional defense resource amount corresponding to each link based on the traffic of each link, the preset parameters corresponding to each link, and the preset objective function includes: According to the following objective function, the newly added defense resource amount on the link (i, j) when the value of the objective function is the smallest is determined as the target newly added defense resource amount of the link (i, j): Among them, x ij is the amount of new defense resources on link (i, j), k ij is the resource cost coefficient on link (i, j), a ij is the traffic on link (i, j), r ij is the risk coefficient of the traffic on link (i, j), c ij is the current defense cost of link (i, j), C min-cut The link in is a key link, β is a preset weight value, and E is each link in the topological connection relationship.

5. The method according to claim 1, characterized in that The predicting of the target additional defense resource amount corresponding to each link based on the traffic of each link, the preset parameters corresponding to each link, and the preset objective function includes: According to the following objective function, the target additional defense resource amount of link (i, j) is determined: Among them, x ij is the amount of new defense resources on link (i, j), k ij is the resource cost coefficient on link (i, j), a ij is the traffic on link (i, j), r ij is the risk coefficient of the traffic on link (i, j), c ij is the current defense cost of link (i, j), C min-cut The link in is the key link, β is the preset weight value, E is each link in the topological connection relationship, γ is the risk coefficient of the traffic on the preset key link, λ1, λ2, μ1, μ2 are Lagrange multipliers, M total is the preset cost cap, X total The preset upper limit of resource allocation.

6. A defense resource determination device, characterized in that: The device comprises: A processing module, used to obtain an undirected graph corresponding to a topological connection relationship of a network of defense devices; and monitor the traffic of a link between each device in the topological connection relationship; A determination module is used to determine the flow of each link as the weight of the corresponding edge in the undirected graph; determine a minimum cut set based on the undirected graph recording the weight of each edge and a minimum cut algorithm; and determine the link corresponding to each edge in the minimum cut set as a key link; The prediction module is used to predict the target additional defense resource amount corresponding to each link based on the traffic of each link, the preset parameters corresponding to each link and the preset objective function.

7. The device according to claim 6, characterized in that The determination module is specifically used to normalize or standardize the flow of each link; and determine the flow of each link after normalization or standardization as the weight of the corresponding edge in the undirected graph.

8. The device according to claim 6, characterized in that The prediction module is specifically used to determine, according to the following objective function, the newly added defense resource amount on the link (i, j) when the value of the objective function is the minimum as the target newly added defense resource amount of the link (i, j): Among them, x ij is the amount of new defense resources on link (i, j), k ij is the resource cost coefficient on link (i, j), a ij is the traffic on link (i, j), r ij is the risk coefficient of the traffic on link (i, j), c ij is the current defense cost of link (i, j), C min-cut The link in is a key link, β is a preset weight value, and E is each link in the topological connection relationship.

9. An electronic device, characterized in that: include: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory, and execute the steps included in the method for determining defense resources according to any one of claims 1 to 5 according to the obtained program instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes the method for determining defense resources according to any one of claims 1 to 5.

Images