A defense resource determination method, apparatus, device, and medium

Abstract

Embodiments of the present application provide a defense resource determination method and device, equipment and medium, which are used to solve the problem of low accuracy of manual allocation of defense resources and inability to effectively improve the security of defense equipment in related technologies. In the embodiments of the present application, the electronic device maps the topological connection relationship of the network into an undirected graph, and takes the traffic of each link as the weight of the edge, which can intuitively and accurately reflect the actual traffic distribution of the network. The electronic device can quickly identify the key link in the network by using the minimum cut algorithm to determine the minimum cut set on the undirected graph. Based on the traffic of each link, the preset link parameter and the target function, the electronic device can scientifically predict the target amount of newly added defense resources required by each link. This prediction method not only considers the current network traffic condition, but also combines the characteristics and defense requirements of the link, thereby ensuring the rationality and effectiveness of resource allocation and improving the security of defense equipment.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a defense resource determination method and device, equipment and a medium. BACKGROUND

[0002] In recent years, the Internet of Things (IoT) has developed very rapidly, and with the continuous popularization of the fifth generation mobile communication technology, more and more IoT devices have entered millions of households. However, these IoT devices that can be seen everywhere in life are often limited by resources, size, energy consumption and other factors, and can only perform their basic functions, and it is difficult to guarantee their security. This makes the security of IoT devices a concern, and for hackers, they are extremely easy to be remotely implanted with malicious programs and then completely controlled. Unknowingly, each IoT device in the user's home is no longer under the control of the user himself. In addition to the destruction of these IoT devices themselves, a more serious threat is that hackers control these devices to form a botnet or zombie network, and launch a Distributed Denial of Service (DDoS) attack. DDoS attacks often quickly paralyze the network or target node in a short time through a large number of requests or flooding attacks.

[0003] Therefore, it is required that the staff can reasonably allocate defense resources, wherein the defense resources refer to disaster recovery nodes, backup links, adjustment of link bandwidth and the like. In related technologies, the defense resources are usually allocated by manual allocation, and the manual allocation of the defense resources is more subjective and has a low accuracy, and cannot accurately and effectively solve the security of the defense device. SUMMARY

[0004] Embodiments of the present application provide a defense resource determination method, device, equipment and medium, which are used to solve the problem of low accuracy of manual allocation of defense resources in related technologies and the problem of inability to effectively improve the security of the defense device.

[0005] In a first aspect, embodiments of the present application provide a defense resource determination method, and the method comprises:

[0006] obtaining an undirected graph corresponding to a topological connection relationship of a network of a defense device; monitoring the flow of a link between each device in the topological connection relationship;

[0007] determining the flow of each link as the weight of the corresponding edge in the undirected graph; determining a minimum cut set based on the undirected graph recording the weight of each edge and a minimum cut algorithm; determining the link corresponding to each edge in the minimum cut set as a critical link;

[0008] The target newly added defense resource amount corresponding to each link is predicted based on the traffic of each link, preset parameters corresponding to each link, and a preset target function.

[0009] In a second aspect, the embodiments of the present application further provide a defense resource determination apparatus, which comprises:

[0010] a processing module, configured to acquire an undirected graph corresponding to a topological connection relationship of a network of defense equipment, and monitor traffic of a link between each device in the topological connection relationship;

[0011] a determination module, configured to determine the traffic of each link as a weight of a corresponding edge in the undirected graph, determine a minimum cut set based on the undirected graph in which the weight of each edge is recorded and a minimum cut algorithm, and determine a link corresponding to each edge in the minimum cut set as a critical link;

[0012] a prediction module, configured to predict a target newly added defense resource amount corresponding to each link based on the traffic of each link, preset parameters corresponding to each link, and a preset target function.

[0013] In a third aspect, the embodiments of the present application further provide an electronic device, which comprises:

[0014] a memory, configured to store program instructions;

[0015] a processor, configured to invoke the program instructions stored in the memory, and perform steps included in the defense resource determination method according to the obtained program instructions.

[0016] In a fourth aspect, the embodiments of the present application further provide a computer readable storage medium, which stores a computer program, the computer program comprising program instructions, the program instructions causing a computer to execute the defense resource determination method when executed by the computer.

[0017] In the embodiment of the present application, the electronic device obtains an undirected graph corresponding to the topological connection relationship of the network of the defense device; monitors the traffic of the link between each device in the topological connection relationship; determines the traffic of each link as the weight of the corresponding edge in the undirected graph; determines the minimum cut set based on the undirected graph recording the weight of each edge and the minimum cut algorithm; determines the link corresponding to each edge in the minimum cut set as the key link; and predicts the target newly added defense resource amount corresponding to each link based on the traffic of each link, the preset parameter corresponding to each link, and the preset target function. In the embodiment of the present application, the electronic device can intuitively and accurately reflect the actual traffic distribution of the network by mapping the topological connection relationship of the network into an undirected graph and taking the traffic of each link as the weight of the edge. The electronic device can quickly identify the key link in the network by using the minimum cut algorithm to determine the minimum cut set on the undirected graph. Based on the traffic of each link, the preset link parameter, and the target function, the electronic device can scientifically predict the target newly added defense resource amount required by each link. This prediction method not only considers the current network traffic condition, but also combines the characteristics and defense requirements of the link, thereby ensuring the rationality and effectiveness of resource allocation and improving the security of the defense device. BRIEF DESCRIPTION OF DRAWINGS

[0018] In order to more clearly illustrate the technical embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0019] Figure 1 Process schematic diagram of a defense resource determination method provided for the embodiment of the present application;

[0020] Figure 2 Schematic diagram of an undirected graph provided for the embodiment of the present application;

[0021] Figure 3 Schematic diagram of a typical DDoS attack scenario provided for the embodiment of the present application;

[0022] Figure 4 Detailed process schematic diagram of determining defense resources provided for the embodiment of the present application;

[0023] Figure 5 Structure diagram of a defense resource determination device provided for the embodiment of the present application;

[0024] Figure 6 Structure diagram of an electronic device provided for the embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to make the purposes, technical solutions and advantages of the present application clearer, the following will be combined with the accompanying drawings to make a clear and complete description of the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art belong to the scope of protection of the present application.

[0026] Obviously, the accompanying drawings in the following description are only some examples or embodiments of the present application, and a person of ordinary skill in the art can apply the present application to other similar scenarios without creative effort based on the drawings. In addition, it can be understood that, although the efforts made in the development process can be complex and lengthy, some design, manufacture or production changes based on the technical content disclosed in the present application are only routine technical means for a person of ordinary skill in the art related to the disclosure of the present application, and should not be understood as insufficient disclosure of the present application.

[0027] In the present application, "embodiment" means that the specific features, structures or properties described in combination with the embodiment can be included in at least one embodiment of the present application. The phrase appears at various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment to other embodiments. A person of ordinary skill in the art explicitly and implicitly understands that the embodiments described in the present application can be combined with other embodiments without conflict.

[0028] The terms "connected", "connected", "coupled" and the like in the present application are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Multiple" in the present application means two or more. The association between the associated objects is described by "and / or", which means that there can be three relationships, for example, "A and / or B" can mean that A exists alone, A and B exist together, and B exists alone. The character " / " generally represents that the associated objects before and after are in an "or" relationship. The terms "first", "second", "third" and the like in the present application are only to distinguish similar objects, and do not represent a specific order for the objects.

[0029] In addition, the technical solutions of the various embodiments can be combined with each other, but must be based on the fact that a person of ordinary skill in the art can realize it, and when the combination of the technical solutions of the embodiments contradicts each other or cannot be realized, it should be considered that the combination of the technical solutions of the embodiments does not exist, nor is it within the scope of protection claimed by the present application.

[0030] To accurately and effectively determine defense resources and improve the security of defense equipment, an embodiment of the present application provides a defense resource determination method, device, equipment and medium.

[0031] The defense resource determination method comprises: an electronic device obtaining an undirected graph corresponding to a topological connection relationship of a network of a defense equipment; monitoring the traffic of links between each device in the topological connection relationship; determining the traffic of each link as the weight of the corresponding edge in the undirected graph; determining a minimum cut set based on the undirected graph recording the weight of each edge and a minimum cut algorithm; determining the link corresponding to each edge in the minimum cut set as a critical link; and predicting the target newly added defense resource amount corresponding to each link based on the traffic of each link, the preset parameter corresponding to each link and the preset target function.

[0032] Embodiment 1

[0033] Figure 1 A process diagram of a defense resource determination method provided by an embodiment of the present application is provided, and the process comprises the following steps:

[0034] S101: Obtain an undirected graph corresponding to a topological connection relationship of a network of a defense equipment; and monitor the traffic of links between each device in the topological connection relationship.

[0035] The defense resource determination method provided by an embodiment of the present application is applied to an electronic device, which can be a PC or a server or other intelligent device.

[0036] To accurately and effectively determine defense resources, the electronic device can obtain a topological connection relationship of a network of a defense equipment. After obtaining the topological connection relationship, the electronic device abstracts the topological connection relationship into an undirected graph. Specifically, the servers and devices in the network can be abstracted into nodes, and the links can be abstracted into edges to form an undirected graph. It should be noted that the undirected graph is selected instead of a directed graph for design. In the embodiment of the present application, the selection is mainly based on the consideration of cost effectiveness and system complexity. Specifically, if the specific data of the traffic direction needs to be collected, the IP address or routing details must be additionally collected, which will significantly increase the implementation cost and increase the complexity of the system architecture. From the perspective of relieving network pressure, without considering the specific flow direction of the traffic, only focusing on the link load condition can effectively achieve the target. Therefore, the undirected graph design has become an economical and practical choice.

[0037] The electronic device monitors the traffic of links between each device in the topological connection relationship.

[0038] S102: determine the traffic of each link as the weight of the corresponding edge in the undirected graph; determine the minimum cut set based on the undirected graph recording the weight of each edge and the minimum cut algorithm; determine the link corresponding to each edge in the minimum cut set as the critical link.

[0039] The electronic device can determine the traffic of each link as the weight of the corresponding edge in the undirected graph.

[0040] After determining the weight of each edge in the undirected graph, the electronic device can determine the minimum cut set by using the undirected graph containing the weight of each edge and the minimum cut algorithm. The minimum cut algorithm can be Stoer-Wagner algorithm, Karger's algorithm or Edmonds-Karp algorithm, etc. The minimum cut set refers to a set of edges that can cause the topology connection of the network to be broken after being removed, and the total weight of the set of edges is the smallest. Removing these edges can hinder the normal traffic from reaching the defense device. Since the weight of the minimum cut set is small, the link corresponding to each edge in the minimum cut set is determined as the critical link. The minimum cut set is the edge weight and the minimum cut. A cut of a graph or network represents a plane or line that divides the graph or network into two subsets containing the source point and the sink point, respectively. The set of edges intersected by the network is called the cut of the graph.

[0041] In one possible implementation, in the process of setting the weight based on the traffic, the weight of the edge corresponding to the link between the terminal and the firewall device and other devices can be temporarily determined.

[0042] Figure 2 A schematic diagram of an undirected graph provided by an embodiment of the present application.

[0043] From Figure 2 It can be seen that the undirected graph includes an attacker (Attacker), a plurality of firewalls, a plurality of routes (Route) and a host (Host), wherein, Figure 2 The Host in the above formula is the defense device described in the embodiment of the present application. From Figure 2It can be seen that the weight of the edge corresponding to the link connected by Route 1 and Route 4 is 10; the weight of the edge corresponding to the link connected by Route 2 and Route 4 is 7; the weight of the edge corresponding to the link connected by Route 2 and Route 5 is 8; the weight of the edge corresponding to the link connected by Route 3 and Route 5 is 5; the weight of the edge corresponding to the link connected by Route 4 and Route 6 is 10; the weight of the edge corresponding to the link connected by Route 4 and Route 7 is 10; the weight of the edge corresponding to the link connected by Route 5 and Route 7 is 15; the weight of the edge corresponding to the link connected by Route 5 and Route 8 is 10; the weight of the edge corresponding to the link connected by Route 6 and Host is 10; the weight of the edge corresponding to the link connected by Route 7 and Host is 10; the weight of the edge corresponding to the link connected by Route 58 and Host is 5.

[0044] After determining the minimum cut set, an indicator function can be generated, which is defined for each edge (i, j):

[0045]

[0046] where C min-cut is the minimum cut set. δ min(i,j) is the indicator function.

[0047] S103: Based on the traffic of each link, the preset parameter corresponding to each link, and the preset target function, the target amount of newly added defense resources corresponding to each link is predicted.

[0048] In the embodiments of the present application, the electronic device can predict the target amount of newly added defense resources corresponding to each link based on the traffic of each link, the preset parameter corresponding to each link, and the preset target function.

[0049] In a possible implementation, the electronic device can perform the following operations for each link in the topological connection relationship: first, calculate the first product of the traffic of each link and its risk coefficient, and at the same time calculate the second product of the to-be-added resource amount of the link and its resource cost coefficient; then, the ratio of the two products is obtained. Subsequently, the ratios of all non-critical links are added to obtain a global risk term, and the ratios of all critical links are added to obtain a critical link risk term. Finally, based on the sum of the global risk term and the critical link risk term, a target function is constructed. The optimization goal of the target function is to minimize it, and by solving the target function, when the minimum value is reached, the target amount of newly added defense resources required by each link can be determined.

[0050] Figure 3 A typical DDoS attack scenario provided by the embodiments of the present application is shown in the schematic diagram.

[0051] By Figure 3 It can be known that, in this network scenario, when a hacker sends DDoS attack traffic from the network boundary into the network to the target, the defender needs to block the attack traffic as soon as possible, and perform operations such as routing switching, starting a backup link, and the like on the link that has appeared congestion in the network, and executes a corresponding strategy to alleviate the influence of the DDoS attack.

[0052] Embodiments of the present application propose a method of dynamically confirming a key link based on a minimum cut, collecting traffic data of communication links between nodes in real time, monitoring changes in network topology, periodically calculating a minimum cut set existing in a current period in the network and confirming elements existing in the set, providing a data basis for calculation of a subsequent target function, and improving accuracy of resource allocation. In the existing Internet scenario, an optimal balance point between resource defense effect and input cost can be quickly found according to the network topology and traffic characteristic state, reasonable allocation of resources is completed, the influence of a DDoS attack on the network is reduced, service availability of users is ensured, and operation and maintenance costs are controlled as much as possible.

[0053] In actual scenarios, an attacker will also intentionally attack nodes that are relatively short of processing resources or links that are weak in bandwidth resources. These attacks include not only traditional User Datagram Protocol (UDP) attacks and Synchronize Sequence Numbers (SYN) attacks, but also relatively widespread reflection amplification attacks, slow attacks, and link flooding attacks in recent years. Even though there are many types of attacks, ultimately, the purpose is to achieve denial of service by exhausting resources or exhausting bandwidth. Therefore, it is required that the defender can reasonably allocate defense resources and control redundant costs in order to seek a better balance point between the two. In addition, it is also required to have a faster response speed or stronger real-time performance in order to quickly make decisions according to the size and damage degree of the attack. Based on this, embodiments of the present application use a minimum cut in graph theory to establish a model and a target function, and use an interior point method to obtain an optimal resource allocation. Embodiments of the present application combine actual operation costs and required resources to provide a design basis for defense and deployment of resources from a theoretical level. The interior point method is an algorithm for solving linear programming or nonlinear convex optimization problems. In the interior point method, there is a penalty function for describing a convex set. Unlike the simplex method, it searches for an optimal solution by traversing an internal feasible region.

[0054] In the embodiments of the present application, the electronic device can intuitively and accurately reflect the actual traffic distribution of the network by mapping the topological connection relationship of the network into an undirected graph and taking the traffic of each link as the weight of the edge, and can quickly identify the key link in the network by using the minimum cut algorithm to determine the minimum cut set on the undirected graph. Based on the traffic of each link, the preset link parameters and the target function, the electronic device can scientifically predict the required target amount of newly added defense resources for each link. This prediction method not only considers the current network traffic condition, but also combines the characteristics and defense requirements of the link, thereby ensuring the rationality and effectiveness of resource allocation and improving the security of the defense device.

[0055] Embodiment 2

[0056] In order to accurately and effectively determine the defense resources, in the embodiments of the present application, the traffic of each link is determined as the weight of the corresponding edge in the undirected graph, which includes:

[0057] normalizing or standardizing the traffic of each link;

[0058] determining the normalized or standardized traffic of each link as the weight of the corresponding edge in the undirected graph.

[0059] In the embodiments of the present application, the electronic device can normalize or standardize the traffic of each link. Specifically, the normalization or standardization operation on the traffic is to eliminate the comparison obstacles caused by the dimensional and order-of-magnitude differences between different links in the original data, so that the traffic data is comparable. Normalization usually scales the traffic number to a specific range, which can be 0 to 1, and standardization converts the traffic data into a value with standard normal distribution characteristics by subtracting the mean and dividing by the standard deviation.

[0060] After the normalization or standardization of all link traffic is completed, the processed traffic values are directly mapped to the corresponding edges in the undirected graph model as the weight of the edge. The undirected graph is a graphical representation method in which nodes represent entities in the network and edges represent connections or communication links between entities, and the weight of the edge reflects the traffic intensity or importance of the connection.

[0061] In order to accurately and effectively determine the defense resources, in the embodiments of the present application, the preset parameters corresponding to each link include:

[0062] resource cost coefficient, risk coefficient and current defense cost.

[0063] The parameters corresponding to each link in the embodiments of the present application include the resource cost coefficient, risk coefficient and current defense cost of each link. It should be noted that the key link no longer has its own link risk coefficient, but a unified risk coefficient is used to strengthen the protection of the key link.

[0064] Embodiment 3

[0065] In order to accurately and effectively determine the defense resources, on the basis of the above embodiments, in the embodiments of the present application, the target new defense resource amount corresponding to each link is predicted based on the traffic of each link, the preset parameters corresponding to each link and the preset target function, and includes:

[0066] According to the following target function, the new defense resource amount on the link (i, j) when the value of the target function is the smallest is the target new defense resource amount of the link (i, j):

[0067]

[0068] Wherein, x ij is the new defense resource amount on the link (i, j), k ij is the resource cost coefficient on the link (i, j), a ij is the traffic on the link (i, j), r ij is the risk coefficient of the traffic on the link (i, j), c ij is the current defense cost of the link (i, j), C min-cut The link in the above formula is a key link, β is a preset weight value, and E is each link in the topological connection relationship.

[0069] In order to accurately and effectively determine the defense resources, the electronic device can determine the target new defense resource amount of each link according to the constructed target function, and specifically, the target function is:

[0070]

[0071] Wherein, x ij is the new defense resource amount on the link (i, j), k ij is the resource cost coefficient on the link (i, j), a ij is the traffic on the link (i, j), r ij is the risk coefficient of the traffic on the link (i, j), c ij is the current defense cost of the link (i, j), C min-cut The link in the above formula is a key link, β is a preset weight value, and E is each link in the topological connection relationship.

[0072] The first item is summed, that is, To add the defense cost term, it represents the total cost of the newly allocated defense resources on all links (i, j). The second term is summed, i.e. The third term is summed, i.e. The third term is summed, i.e. ij The third term is summed, i.e. ij The third term is summed, i.e. ij The third term is summed, i.e. ij The third term is summed, i.e. ij The third term is summed, i.e. ij The third term is summed, i.e. min-cut The third term is summed, i.e. total The third term is summed, i.e. total The third term is summed, i.e.

[0073] Embodiment 4:

[0074] To accurately and effectively determine the defense resources, based on the above embodiments, in the embodiment of the present application, the target newly added defense resource amount corresponding to each link is predicted based on the traffic of each link, the preset parameters corresponding to each link, and the preset target function, comprising:

[0075] According to the following target function, the newly added defense resource amount on the link (i, j) when the value of the target function is the smallest is the target newly added defense resource amount of the link (i, j):

[0076]

[0077] Where x ij is the newly added defense resource amount on the link (i, j), k ij is the resource cost coefficient on the link (i, j), a ij is the traffic on the link (i, j), r ij is the risk coefficient of the traffic on the link (i, j), c ij is the current defense cost of the link (i, j), C min-cut is the link in the target function, β is the preset weight value, E is each link in the topological connection relationship, γ is the preset risk coefficient of the traffic on the critical link, λ1, λ2, μ1, μ2 are Lagrange multipliers, M total is the preset upper limit of the cost, X total is the preset upper limit of the resource allocation.

[0078] It is to be noted that the newly added defense cost term in the target function is a linear function, and therefore is convex. The global risk term and the critical link risk term are is convex, and the molecule part is also convex, so both of them are linear combinations of convex functions, which keep convexity. In summary, since the objective function is a weighted sum of three convex functions, the whole objective function is convex.

[0079] In order to accurately determine the defense resources, the electronic device needs to ensure that the newly added defense resources and the resource cost coefficients of each link are non-negative, which conforms to the objective fact. Secondly, the sum of the newly added defense resources of the link should not exceed the range of the allocable resources, and the cost of the newly added defense resources should also not exceed the range that the defense party can bear. The significance of these constraints makes the whole model closer to the real situation, which is convenient for increasing the practical value of the optimized resource allocation application embodiment.

[0080] Therefore, the constraint conditions determined by the electronic device are as follows:

[0081] x ij ≥0,k ij ≥0,

[0082]

[0083] wherein x ij is the newly added defense resource amount on the link (i,j), k ij is the resource cost coefficient on the link (i,j), the link in E is each link in the topological connection relationship, X total is the preset upper limit of the defense resource amount, and M total is the preset upper limit of the cost.

[0084] For example, if the upper limit of the newly allocable resource in the network is X total = 50, and the upper limit of the available cost is M total = 5000, the constraint condition is determined as:

[0085] x ij ≥0,k ij ≥0,

[0086]

[0087] After the objective function, the decision variable and the constraint condition are determined, the inner point method is used for solving in the application embodiment. First, the Lagrange multipliers λ1, λ2, μ1 and μ2 are introduced. Then, the constraint condition is integrated into the objective function, and the Lagrange function L is constructed, that is, the integrated objective function:

[0088]

[0089] wherein x ij is the newly added defense resource amount on the link (i,j), k ija is the resource cost coefficient on the link (i, j), a ij r is the flow on the link (i, j), r ij c is the risk coefficient of the flow on the link (i, j), c ij C is the current defense cost of the link (i, j), C min-cut the link in is a critical link, β is a preset weight value, E is each link in the topology connection relationship, γ is a preset risk coefficient of the flow on the critical link, λ1, λ2, μ1, μ2 are Lagrange multipliers, M total X is a preset cost upper limit, X total is a preset upper limit of the resource allocation.

[0090] Then, the partial derivatives of x ij and k ij are constructed, the values when the partial derivatives are 0 are solved, the complementary relaxation condition is calculated. And through a series of steps of selecting initial value, iterative updating, controlling step length, and convergence judgment, the optimal solution, that is, the value of the integrated objective function, is obtained. Since how to solve the Lagrange function is a prior art, it will not be described here. Finally, by solving the result, the amount of newly added defense resources for each link in the network under attack is determined, and the effect of controlling the cost is achieved.

[0091] That is, after the objective function, the decision variable, and the constraint condition are determined, the electronic device will construct the Lagrange function, and then solve the optimal allocation by using the interior point method according to the flow of each link and the preset parameters corresponding to each link. In the solving process, the iteration step length is also set, such as t = 1, and the iteration termination condition is set, such as the iteration number t_max = 500. According to the optimization solving result, the resource optimal allocation is determined, and the network resources are dispatched to resist DDoS attack.

[0092] The method for dynamically confirming the critical link based on the minimum cut by the electronic device. The flow data of the communication link between nodes is collected in real time, the network topology structure change is monitored, the minimum cut set existing in the current period of the network is calculated periodically, and the elements existing in the set are confirmed, so as to provide a data basis for the calculation of the subsequent objective function and improve the accuracy of the scheme; the method for integrating the objective function of the minimum cut is established. The objective function considering the defense cost, the risk, and the importance of the critical link is constructed, the comprehensive degree and the robustness of the model are improved; the method for determining the key variable and the constraint condition is determined. According to the network characteristics and the related restrictions of the construction investment, the value range of the decision variable is determined, the practical application value and the feasibility of the scheme are improved; the solving optimization mechanism of the interior point method is used. The abstracted mathematical function is optimized and solved from the mathematical theory level, the specific allocation of the resources and the cost is performed according to the solving result, and the integrity of the scheme is improved.

[0093] Embodiment 5:

[0094] Figure 4 A detailed process diagram illustrating the determination of defense resources is provided for an embodiment of this application;

[0095] Step 1:

[0096] The network topology is abstracted into an undirected graph, and the traffic status of each link in the network is monitored. The absolute value of traffic on each link needs to be periodically counted and normalized or standardized to obtain the edge weights of the undirected graph.

[0097] Step Two:

[0098] Based on the weight of each link, obtain the minimum cut set, so as to Figure 2 For example, let the source node be the attacker Attacker in the graph, and the sink node be the Host. By calculating different cut sets, the minimum cut sets are finally obtained as the edges from Router6 to Host and Router7 to Host.

[0099] Step 3:

[0100] An objective function is established based on minimum cut sets and convex optimization theory. The objective function is used to represent the balance between the defensive effect and the cost of newly allocated resources.

[0101] Step Four:

[0102] Constraints are determined based on the range of all decision variables that can be invoked in the network and the actual physical conditions, and the allocatable range is defined based on the defender's reserved resources and the maximum acceptable cost.

[0103] Step 5:

[0104] The problem is solved using the interior-point method, optimizing the allocation of newly added resources for each edge. Network resources are then scheduled to mitigate DDoS attacks.

[0105] The embodiments of the present application aim to provide a method for solving optimal resource scheduling and cost optimization scheme in a network based on minimum cut and interior point method, starting from confirming key links in the network by using minimum cut, combining graph theory and convex optimization theory to establish an objective function, and comprehensively considering defense cost, risk and key links, to provide a theoretical basis and specific technical scheme for resource allocation and disaster recovery and disaster mitigation equipment construction for the defense party. The embodiments of the present application are to cope with the problem of DDoS attack flooding in the existing Internet, and lack of optimal application embodiment design and theoretical basis in terms of defending DDoS attack and relieving network pressure. The embodiments of the present application confirm the key links in the network based on the minimum cut concept in graph theory, establish an objective function according to the allocation of defense resources, related information of attack traffic and the cost required for deploying related resources, confirm key variables and constraint conditions by using actual network conditions, and finally use the interior point method in convex optimization to quickly and accurately solve the resource allocation application embodiment with the lowest cost and optimal effect. Not only the defense resource allocation and cost control are comprehensively considered, but also the key links in the network are especially protected. The network manager is helped to more effectively allocate resources when facing DDoS attack, and the overall security and connectivity of the network are ensured.

[0106] Based on this, the embodiments of the present application propose a method for integrating the objective function of minimum cut, construct an objective function that comprehensively considers the importance of defense cost, risk and key links, improve the comprehensive degree and robustness of the model, propose a method for determining key variables and constraint conditions, determine the value range of decision variables according to network characteristics and construction investment related restrictions, improve the practical application value and feasibility of the application embodiments, and propose a solving optimization mechanism by using the interior point method, which optimizes and solves the abstracted mathematical function from the mathematical theory level, and according to the solving result, the specific allocation of resources and cost is performed, and the integrity of the application embodiments is improved.

[0107] Embodiment 6:

[0108] Based on the same inventive concept, the embodiments of the present application also provide a defense resource determination device, please refer to Figure 5 The device comprises:

[0109] The processing module 501 is configured to acquire an undirected graph corresponding to a topological connection relationship of a network of defense equipment, and monitor the traffic of links between each device in the topological connection relationship.

[0110] The determination module 502 is configured to determine the traffic of each link as the weight of the corresponding edge in the undirected graph, determine a minimum cut set based on the undirected graph recording the weight of each edge and the minimum cut algorithm, and determine the link corresponding to each edge in the minimum cut set as a key link.

[0111] The prediction module 503 is configured to predict a target amount of newly added defense resources corresponding to each link based on the traffic of each link, a preset parameter corresponding to each link, and a preset target function.

[0112] In a possible implementation, the determination module 501 is specifically configured to normalize or standardize the traffic of each link; and determine the traffic of each link after the normalization or standardization as a weight of a corresponding edge in the undirected graph.

[0113] In a possible implementation, the prediction module 503 is specifically configured to determine, according to the following target function, the target amount of newly added defense resources on the link (i, j) as the target amount of newly added defense resources of the link (i, j) when a value of the target function is smallest:

[0114]

[0115] wherein x ij represents the target amount of newly added defense resources on the link (i, j), k ij represents a resource cost coefficient on the link (i, j), a ij represents the traffic on the link (i, j), r ij represents a risk coefficient of the traffic on the link (i, j), c ij represents a current defense cost of the link (i, j), and C min-cut represents a link in the topology connection relationship, β represents a preset weight value, and E represents each link in the topology connection relationship.

[0116] In a possible implementation, the prediction module 503 is specifically configured to determine, according to the following target function, the target amount of newly added defense resources of the link (i, j):

[0117]

[0118] wherein x ij represents the target amount of newly added defense resources on the link (i, j), k ij represents a resource cost coefficient on the link (i, j), a ij represents the traffic on the link (i, j), r ij represents a risk coefficient of the traffic on the link (i, j), c ij represents a current defense cost of the link (i, j), and C min-cut represents a link in the topology connection relationship, β represents a preset weight value, E represents each link in the topology connection relationship, γ represents a preset risk coefficient of the traffic on the critical link, λ1, λ2, μ1, and μ2 represent Lagrange multipliers, M total represents a preset upper limit of the cost, and X total represents a preset upper limit of the resource allocation.

[0119] Embodiment 7:

[0120] Based on the same inventive concept, the embodiment of the present application provides an electronic device, which can realize the function of the foregoing defense resource determination. Please refer to Figure 6 The device includes a processor 601, a memory 603, and a communication bus 604, wherein the processor 601, the communication interface 602, and the memory 603 complete mutual communication through the communication bus 604.

[0121] The memory 603 stores a computer program, and when the program is executed by the processor 401, the processor 601 executes the following steps:

[0122] Obtain a topology connection relationship corresponding to an undirected graph of a network of a defense device; monitor the flow of a link between each device in the topology connection relationship;

[0123] Determine the flow of each link as the weight of the corresponding edge in the undirected graph; determine a minimum cut set based on the undirected graph recording the weight of each edge and a minimum cut algorithm; determine the link corresponding to each edge in the minimum cut set as a critical link;

[0124] Based on the flow of each link, a preset parameter corresponding to each link, and a preset target function, predict the target amount of newly added defense resources corresponding to each link.

[0125] In a possible implementation, the determination of the flow of each link as the weight of the corresponding edge in the undirected graph includes:

[0126] Normalizing or standardizing the flow of each link;

[0127] Determine the flow of each link after the normalizing or standardizing as the weight of the corresponding edge in the undirected graph.

[0128] In a possible implementation, the preset parameter corresponding to each link includes:

[0129] A resource cost coefficient, a risk coefficient, and a current defense cost.

[0130] In a possible implementation, the prediction of the target amount of newly added defense resources corresponding to each link based on the flow of each link, the preset parameter corresponding to each link, and the preset target function includes:

[0131] According to the following target function, determine the amount of newly added defense resources on the link (i, j) when the value of the target function is the minimum as the target amount of newly added defense resources of the link (i, j):

[0132]

[0133] wherein x ij is the newly added defense resource amount on the link (i, j), k ij is the resource cost coefficient on the link (i, j), a ij is the flow on the link (i, j), r ij is the risk coefficient of the flow on the link (i, j), c ij is the current defense cost of the link (i, j), C min-cut the link in the above formula is a critical link, β is a preset weight value, E is each link in the topology connection relationship.

[0134] In a possible implementation, the target newly added defense resource amount corresponding to each link is predicted based on the flow of each link, the preset parameter corresponding to each link, and the preset target function, and includes:

[0135] The target newly added defense resource amount of the link (i, j) is determined according to the following target function:

[0136]

[0137] wherein x ij is the newly added defense resource amount on the link (i, j), k ij is the resource cost coefficient on the link (i, j), a ij is the flow on the link (i, j), r ij is the risk coefficient of the flow on the link (i, j), c ij is the current defense cost of the link (i, j), C min-cut the link in the above formula is a critical link, β is a preset weight value, E is each link in the topology connection relationship, γ is a preset risk coefficient of the flow on the critical link, λ1, λ2, μ1, μ2 are Lagrange multipliers, M total is a preset upper limit of the cost, X total is a preset upper limit of the resource allocation amount.

[0138] The communication bus mentioned by the above server can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0139] The communication interface 602 is used for communication between the above electronic device and other devices.

[0140] The memory can include a random access memory (RAM) and can also include a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory can also be at least one storage device located remotely from the aforementioned processor.

[0141] The aforementioned processor can be a general-purpose processor, including a central processing unit, a network processor (NP), etc., and can also be a digital signal processing (DSP) processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic component, a discrete hardware component, etc.

[0142] Embodiment 8:

[0143] Based on the same inventive concept, the embodiment of the present application provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program executable by an electronic device, and when the program runs on the electronic device, the electronic device executes the following steps:

[0144] Obtain a topology connection relationship corresponding to an undirected graph of a network of a defense device; monitor the flow of a link between each device in the topology connection relationship;

[0145] Determine the flow of each link as the weight of the corresponding edge in the undirected graph; determine a minimum cut set based on the undirected graph recording the weight of each edge and a minimum cut algorithm; determine the link corresponding to each edge in the minimum cut set as a critical link;

[0146] Based on the flow of each link, a preset parameter corresponding to each link, and a preset target function, predict the target amount of newly added defense resources corresponding to each link.

[0147] In a possible implementation, the determination of the flow of each link as the weight of the corresponding edge in the undirected graph includes:

[0148] Normalizing or standardizing the flow of each link;

[0149] Determine the flow of each link after normalization or standardization as the weight of the corresponding edge in the undirected graph.

[0150] In a possible implementation, the preset parameter corresponding to each link includes:

[0151] The resource cost coefficient, the risk coefficient, and the current defense cost.

[0152] In a possible implementation, the target amount of newly added defense resources corresponding to each link is predicted based on the traffic of each link, preset parameters corresponding to each link, and a preset target function, and the target amount of newly added defense resources corresponding to each link includes:

[0153] The target amount of newly added defense resources on the link (i, j) at which the value of the target function is smallest is determined as the target amount of newly added defense resources of the link (i, j) according to the following target function:

[0154]

[0155] wherein x is the amount of newly added defense resources on the link (i, j), k is a resource cost coefficient on the link (i, j), a is the traffic on the link (i, j), r is a risk coefficient of the traffic on the link (i, j), c is the current defense cost of the link (i, j), and C is the link in the topology connection relationship. ij ij ij ij ij min-cut wherein the link in the topology connection relationship is a critical link, β is a preset weight value, E is each link in the topology connection relationship, and γ is a preset risk coefficient of the traffic on the critical link.

[0156] In a possible implementation, the target amount of newly added defense resources corresponding to each link is predicted based on the traffic of each link, preset parameters corresponding to each link, and a preset target function, and the target amount of newly added defense resources corresponding to each link includes:

[0157] The target amount of newly added defense resources of the link (i, j) is determined according to the following target function:

[0158]

[0159] wherein x is the amount of newly added defense resources on the link (i, j), k is a resource cost coefficient on the link (i, j), a is the traffic on the link (i, j), r is a risk coefficient of the traffic on the link (i, j), c is the current defense cost of the link (i, j), and C is the link in the topology connection relationship. ij ij ij ij ij min-cut wherein the link in the topology connection relationship is a critical link, β is a preset weight value, E is each link in the topology connection relationship, γ is a preset risk coefficient of the traffic on the critical link, λ1, λ2, μ1, and μ2 are Lagrange multipliers, M is a preset upper limit of the cost, X is a preset upper limit of the amount of resource allocation, and γ is a preset risk coefficient of the traffic on the critical link. total total

[0160] ​​​​​​​​​​​​Those skilled in the art will appreciate that embodiments of the present application can be devised for a variety of other systems which are currently developed or later developed. Therefore, the present application is intended to cover all such modifications and variations of this application that are within the scope of the appended claims and their equivalents. It is intended that each element of claim 1 and 2 is independent of one another. No element of claim 1 and 2, or any other claim, is implied to depend on any other element or limitation of claim 1 and 2 or any other claim except where expressly recited in that claim.

[0161] The present application is described in reference to the flowchart and / or block diagrams of the method, apparatus (system) and computer program product according to this application. It will be understood that each block of the flowchart and / or block diagrams, and combinations of blocks in the flowchart and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks.

[0162] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks.

[0163] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks.

[0164] Obviously, numerous modifications and variations of the present application are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. A method for determining defensive resources, characterized in that, The method comprises: obtaining a topology connection relationship corresponding to an undirected graph of a network of defense equipment; monitoring the flow of each link between the devices in the topology connection relationship; determining the flow of each link as the weight of the corresponding edge in the undirected graph; determining a minimum cut set based on the undirected graph recording the weight of each edge and the minimum cut algorithm; determining each link corresponding to each edge in the minimum cut set as a critical link; based on the flow of each link, the preset parameters corresponding to each link, and the preset objective function, predicting the target newly added defense resource amount corresponding to each link; wherein the prediction of the target newly added defense resource amount corresponding to each link based on the flow of each link, the preset parameters corresponding to each link, and the preset objective function comprises: determining the target newly added defense resource amount of link (i, j) according to the following objective function: wherein, is the amount of newly added defense resources on the link , is the resource cost coefficient on the link , is the traffic on the link , is the risk coefficient of the traffic on the link , is the current defense cost on the link , is the link in the topology connection relationship is a critical link, is a preset weight value, is each link in the topology connection relationship, is a preset risk coefficient of the traffic on the critical link, , , , is a Lagrange multiplier, is a preset upper limit of the cost, is a preset upper limit of the resource allocation amount.

2. The method of claim 1, wherein, the determination of the flow of each link as the weight of the corresponding edge in the undirected graph comprises: normalizing or standardizing the flow of each link; determining the flow of each link after normalization or standardization as the weight of the corresponding edge in the undirected graph.

3. The method of claim 1, wherein, The preset parameters corresponding to each link include: resource cost coefficient, risk coefficient and current defense cost.

4. The method of claim 1, wherein, The prediction of the target newly added defense resource amount corresponding to each link based on the flow of each link, the preset parameters corresponding to each link, and the preset objective function comprises: determining the newly added defense resource amount on link (i, j) when the value of the objective function is the minimum as the target newly added defense resource amount of link (i, j) according to the following objective function: wherein, is the amount of newly added defense resources on the link , is the resource cost coefficient on the link , is the traffic on the link , is the risk coefficient of the traffic on the link , is the current defense cost of the link , the link in the topology connection relationship is a critical link, is a preset weight value, is each link in the topology connection relationship.

5. A defense resource determination apparatus characterized by comprising: The device comprises: a processing module for obtaining a topology connection relationship corresponding to an undirected graph of a network of defense equipment; monitoring the flow of each link between the devices in the topology connection relationship; a determination module for determining the flow of each link as the weight of the corresponding edge in the undirected graph; determining a minimum cut set based on the undirected graph recording the weight of each edge and the minimum cut algorithm; determining each link corresponding to each edge in the minimum cut set as a critical link; a prediction module for predicting the target newly added defense resource amount corresponding to each link based on the flow of each link, the preset parameters corresponding to each link, and the preset objective function; wherein the prediction module is specifically configured to determine the target newly added defense resource amount of link (i, j) according to the following objective function: wherein, is the amount of newly added defense resources on the link , is the resource cost coefficient on the link , is the traffic on the link , is the risk coefficient of the traffic on the link , is the current defense cost on the link , the link in the topology connection relationship is a critical link, is a preset weight value, is each link in the topology connection relationship, is a preset risk coefficient of the traffic on the critical link, , , , is a Lagrange multiplier, is a preset upper limit of the cost, is a preset upper limit of the resource allocation amount.

6. The apparatus of claim 5, wherein, The determination module is specifically configured to normalize or standardize the flow of each link; and determine the flow of each link after normalization or standardization as the weight of the corresponding edge in the undirected graph.

7. The apparatus of claim 5, wherein, The prediction module is specifically configured to determine the newly added defense resource amount on link (i, j) when the value of the objective function is the minimum as the target newly added defense resource amount of link (i, j) according to the following objective function: wherein, is the amount of newly added defense resources on the link , is the resource cost coefficient on the link , is the traffic on the link , is the risk coefficient of the traffic on the link , is the current defense cost of the link , the link in the topology connection relationship is a critical link, is a preset weight value, is each link in the topology connection relationship.

8. An electronic device, comprising: comprises: a memory for storing program instructions; a processor for calling the program instructions stored in the memory and executing the steps included in the method for determining defense resources according to any one of claims 1-4.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, the computer program comprising program instructions which, when executed by a computer, cause the computer to perform the method of defense resource determination according to any one of claims 1-4.

Images