Executor dynamic scheduling method, computer equipment, readable storage medium and program product

Abstract

The invention relates to an executor dynamic scheduling method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: calculating a target return gain value of each pre-selected scheduling type, and selecting a target scheduling type from the pre-selected scheduling types according to the target return gain value; the target return gain value is obtained based on Bayesian probability; when it is monitored that the feature vector representing the network attack is updated, the Bayesian probability of each attack type is updated; updating the target return gain value according to the updated Bayesian probability; and according to the updated target return gain value, a new target scheduling type is obtained from the pre-selected scheduling types, and the target scheduling type is used for dynamically scheduling the execution body. According to the technical scheme, the return gain is calculated based on the Bayesian probability for dynamic scheduling, different network environments can be more accurately adapted, and the dynamics and security of the mimicry defense system are improved.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a method, apparatus, computer device, computer-readable storage medium, and computer program product for dynamic scheduling of an execution body. Background Art

[0002] In recent years, with the rapid development of information technology, the complexity and scale of network systems have continued to increase, and network security issues have become increasingly serious. Traditional defense strategies are usually based on known threats and attack patterns, and respond by setting fixed rules and strategies. However, with the continuous evolution of network attack technology, attackers can quickly develop and use new attack methods, making it difficult for traditional defense measures to effectively respond to unknown threats.

[0003] Currently, existing network defense systems mainly rely on static defense strategies, which are usually based on known threats and attack patterns, and use preset rules and fixed strategies to defend against possible attacks. However, with the continuous advancement and sophistication of network attack technologies, attackers can quickly develop and deploy new attack methods to bypass existing defense measures. Static defense strategies are unable to cope with these ever-changing and unknown threats and are easily targeted. Summary of the invention

[0004] Based on this, it is necessary to provide a method, device, computer equipment, computer-readable storage medium and computer program product for dynamic scheduling of execution bodies capable of dynamic defense in order to address the above technical problems.

[0005] In a first aspect, the present application provides a method for dynamic scheduling of an execution body, the method comprising:

[0006] Calculating a target reward gain value for each pre-selected scheduling type, and selecting a target scheduling type from the pre-selected scheduling types according to the target reward gain value; the target reward gain value is obtained based on Bayesian probability;

[0007] When the feature vector representing the network attack is updated, the Bayesian probability of each attack type is updated;

[0008] Updating the target reward gain value according to the updated Bayesian probability;

[0009] According to the updated target reward gain value, a new target scheduling type is obtained from the pre-selected scheduling types, wherein the target scheduling type is used for dynamically scheduling execution bodies.

[0010] In one embodiment, calculating the target reward gain value of each pre-selected scheduling type includes:

[0011] Based on the sample data and historical experience of each attack type, the prior probability of each attack type is obtained;

[0012] Calculate the security gain and defense cost of each of the pre-selected scheduling types under different attack types to obtain a security gain value and a defense cost value;

[0013] The Bayesian probability is calculated according to the prior probability and the new sample data, and the target reward gain value of each of the pre-selected scheduling types is calculated according to the Bayesian probability, the safety gain value and the defense cost value.

[0014] In one embodiment, the calculating the target reward gain value of each pre-selected scheduling type according to the Bayesian probability, the safety gain and the defense cost includes:

[0015] Subtract the security gain value from the defense cost value to obtain a reward function of each of the pre-selected scheduling types under different attack types;

[0016] According to the reward function and the Bayesian probability, the reward gain value of each of the pre-selected scheduling types under different attack types is calculated;

[0017] The reward gain values ​​of each of the pre-selected scheduling types under different attack types are added together to obtain a target reward gain value of each pre-selected scheduling type.

[0018] In one embodiment, the defense task corresponding to the pre-selected scheduling type is jointly executed by a plurality of execution bodies; after obtaining the new target scheduling type from the pre-selected scheduling type, the method further includes:

[0019] A decision result is obtained by making a decision based on the output result of each of the execution bodies, and the target scheduling type is updated according to the decision result.

[0020] In one embodiment, updating the target scheduling type according to the arbitration result includes:

[0021] When the decision result does not meet the preset decision condition, obtaining the network attack type;

[0022] According to the attack type, the target reward gain value is updated, and the target scheduling type is updated according to the updated target reward gain value; the preset judgment condition is that the output results of each of the executors are consistent, or the output results of each of the executors are inconsistent and the number of executors with inconsistent output results is less than a preset threshold.

[0023] In one of the embodiments, updating the target scheduling type according to the arbitration result further includes:

[0024] When the decision result satisfies the preset decision condition, each of the execution bodies continues to execute the defense task according to the target scheduling type.

[0025] In one embodiment, the obtaining the new target scheduling type from the pre-selected scheduling type further includes:

[0026] Count the number of adjustments to the target scheduling type;

[0027] If the adjustment number is greater than the preset number, searching for the safety gain value of each of the preselected scheduling types under the same attack type;

[0028] Based on the safety gain value, a new target scheduling type is obtained from the pre-selected scheduling types.

[0029] In a second aspect, the present application provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any of the above methods when executing the computer program.

[0030] In a third aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of any of the methods described above are implemented.

[0031] In a fourth aspect, the present application provides a computer program product, including a computer program, which implements the steps of any of the methods described above when executed by a processor.

[0032] The above-mentioned dynamic scheduling method, device, computer equipment, computer-readable storage medium and computer program product of the executable body can select the optimal target scheduling type based on the target reward gain value after calculating the target reward gain value of each pre-selected scheduling type through sample data. When a network threat feature vector is detected, the target reward gain value is updated by recalculating the Bayesian probability. This update ensures that the system can dynamically adjust the execution body scheduling strategy according to the real-time threat, thereby making the defense system more flexible and efficient, able to quickly adapt to changes in the attack environment, and select the optimal defense strategy to enhance the system's anti-attack capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0034] Figure 1 It is a flowchart of a method for dynamically scheduling an execution body in one embodiment;

[0035] Figure 2 A schematic diagram of a process for obtaining a new target scheduling class in one embodiment;

[0036] Figure 3 A schematic diagram of a flow chart of a method for dynamically scheduling an execution body in an embodiment;

[0037] Figure 4 is a structural block diagram of an execution body dynamic scheduling device in one embodiment;

[0038] Figure 5 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0040] In a static defense system, once the defense strategy and configuration are set, they usually remain unchanged for a long time. Such blind and unguided active defense measures often lead to excessive performance losses and reduce the cost-effectiveness of defense. The optimized defense strategy needs to be adjusted in a targeted manner according to the specific security status.

[0041] Therefore, this application proposes a dynamic scheduling method for an execution body to achieve dynamic defense. The core idea of ​​the dynamic defense strategy is to make it difficult for attackers to predict and master the defense mechanism of the system by constantly adjusting the defense state of the system, thereby improving the security of the system.

[0042] In the operation before the target system encounters a security threat, the scheduling state of the heterogeneous redundant system is often random or fixed. Such blind and unguided active defense measures often lead to excessive performance loss and reduce the cost-effectiveness of defense. The optimized defense strategy needs to be adjusted in a targeted manner according to the specific security status. There are many implementation schemes for the mimetic scheduling strategy, such as random time and random target scheduling, heterogeneity maximization scheduling, security priority scheduling algorithm, and feedback-based scheduling. Different scheduling strategies have different security benefits.

[0043] The Bayesian model describes the game process between participants under incomplete information conditions. Participants may be of different types, and different types of participants have different strategies and benefits. The essence of Bayesian theorem is that before the essential nature of a certain thing can be known with certainty, the probability of its essential attribute can be determined by combining the probability of occurrence related to a specific essence. The actual network threat is a complex process, so an executor dynamic scheduling method based on Bayesian probability is proposed in an embodiment of the present invention. Based on Bayesian probability, the security gain can be determined by combining the probability of occurrence related to the unknown threat before the attack of the unknown threat can be determined.

[0044] In one embodiment, Figure 1 As shown, a method for dynamic scheduling of an executable body is provided. This embodiment takes the method applied to a terminal as an example for explanation. It can be understood that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0045] Step S102, calculating the target reward gain value of each pre-selected scheduling type, and selecting the target scheduling type from the pre-selected scheduling types according to the target reward gain value; the target reward gain value is obtained based on Bayesian probability.

[0046] Optionally, before step S102, the step also includes obtaining sample data of the target system.

[0047] Collect and obtain sample data generated by the target system during its past operation. These data samples may include system operation records under different scheduling types, system performance indicators, network threat types and their corresponding defense effects, etc.

[0048] The target scheduling type refers to a scheduling type selected from all pre-selected scheduling types according to the target reward gain values ​​corresponding to each pre-selected scheduling type, which is in line with the current target system environment. For example, assuming that the defense capability needs to be improved now, the scheduling type with the strongest defense capability is selected.

[0049] The target return gain is obtained based on the security gain and defense cost, and after considering the probability. Different pre-selected scheduling types correspond to different target return gain values.

[0050] Optionally, a target scheduling type may be selected from various pre-selected scheduling types according to the target reward gain value and the first preset rule.

[0051] Among them, the first preset rule is pre-set, and the indicator of the target scheduling type is selected in advance from the pre-selected scheduling types.

[0052] Optionally, sample data is used to calculate target return gain values ​​for different scheduling types. The target return gain value reflects the balance between security gain and performance cost of each scheduling type in dealing with network threats.

[0053] Furthermore, from the perspective of improving system security, the scheduling parameters contained in the scheduling state of a certain defense may be unnecessary, that is, the execution of the scheduling parameters has no effect on the security of the system, but the execution of the scheduling parameters will lead to a significant decrease in operating performance. When there are unknown factors in the entire system, defending against the variables with the highest probability of occurrence, namely network threats, will achieve a better balance between performance loss and security gain.

[0054] Therefore, in this embodiment, the Bayesian probability is calculated based on the sample data, and the target reward gain value is calculated based on the Bayesian probability.

[0055] Optionally, by comparing the calculated target reward gain value with preset rules, the system selects the optimal target scheduling type from multiple scheduling types to deal with current or possible future threats.

[0056] Optionally, the security gain, defense cost and Bayesian probability of each pre-selected scheduling type under different attack types can be calculated based on sample data, and the target reward gain value can be calculated based on the security gain, defense cost and Bayesian probability, and the target scheduling type can be selected from the pre-selected scheduling types based on the first preset rule and the target reward gain value.

[0057] Exemplarily, the first preset rule may be that the return gain is maximized, and correspondingly, the scheduling type with the maximum return gain is selected as the target scheduling type.

[0058] Step S104: when it is detected that the feature vector representing the network attack is updated, the Bayesian probability of each attack type is updated.

[0059] When new network threats are detected, they are represented by feature vectors and the new threat information is added to the sample data so that the target return gain value can reflect the latest threat situation in a timely manner.

[0060] When no new network threats are detected, but the feature vector is updated, the probability of new network threats occurring will change, thereby changing the target return gain value and reflecting the latest network environment situation more timely.

[0061] Optionally, the external environment is monitored in real time to capture feature vectors of network threats. Exemplarily, the network threat feature vectors may be time periods, frequencies, or certain signs of network threats. The captured new threat feature vectors are incorporated into the sample data, and the Bayesian probability is updated using the new sample data.

[0062] Step S106, updating the target reward gain value according to the updated Bayesian probability.

[0063] After updating the Bayesian probability, the target reward gain value of each pre-selected scheduling type needs to be updated. The new Bayesian probability reflects the current adaptability of the system to different attack scenarios. Therefore, by updating the target reward gain value through the Bayesian probability, a target reward gain value that can reflect the current environment can be obtained.

[0064] Step S108, according to the updated target reward gain value, a new target scheduling type is obtained from the pre-selected scheduling types, wherein the target scheduling type is used for dynamically scheduling the execution body.

[0065] In this embodiment, the system selects a new target scheduling type again through the new target reward gain value. This is because the network environment may have changed, and the original target scheduling type is no longer the optimal solution. Through dynamic adjustment, the system can always adopt the optimal defense strategy to ensure that the system's defense capability and efficiency are maximized in the current network threat scenario.

[0066] Optionally, a new target scheduling type may be obtained from the pre-selected scheduling types through a second preset rule and the updated target reward gain value data.

[0067] One thing that needs to be explained is that the defense strategy corresponding to the scheduling type in this application is jointly executed by multiple executors, which means that each scheduling type specifies which executors will work together to implement the strategy. Since the scheduling type itself includes the selection and configuration of the executor, when the feature vector representing the network attack is updated, the system can dynamically adjust the executors involved in the defense according to the updated target scheduling type. This dynamic scheduling mechanism enables the system to flexibly adapt to different security requirements and ensure that the system maintains a high level of security in all situations.

[0068] In the above scheduling type method, after calculating the target reward gain value of each pre-selected scheduling type through sample data, the optimal target scheduling type can be selected based on these gain values. When the network threat feature vector is detected to be updated, the Bayesian probability is calculated by updating, and then the target reward gain value is updated. This update ensures that the system can dynamically adjust the scheduling strategy according to the real-time threat, making the defense system more flexible and efficient, able to quickly adapt to changes in the attack environment, and select the optimal defense strategy to enhance the system's anti-attack capabilities.

[0069] Since different defense actions will inevitably incur certain defense costs, it is a very important rule to address the performance and security conflicts in active defense. The target system must dynamically adopt scheduling strategies based on acceptable defense costs to achieve security benefits. Taking dynamic scheduling measures can achieve greater defense gains and reduce unnecessary defense costs.

[0070] Therefore, further, in one of the embodiments, the above-mentioned calculation of the target reward gain value of each pre-selected scheduling type includes: obtaining the prior probability of each attack type based on the sample data and historical experience of each attack type; respectively calculating the safety gain and defense cost of each pre-selected scheduling type under different attack types to obtain the safety gain value and the defense cost value; calculating the Bayesian probability based on the prior probability and the new sample data, and calculating the target reward gain value of each pre-selected scheduling type based on the Bayesian probability, the safety gain value and the defense cost value.

[0071] Among them, the defense cost refers to the resource consumption, performance loss, etc. required to adopt the pre-selected scheduling type to defend against specific attacks.

[0072] Among them, security gain refers to the security benefit obtained by the target system in defending against specific attacks after adopting the pre-selected scheduling type, that is, the effect of the target system successfully resisting the attack and the improved security.

[0073] Among them, historical experience refers to the information about network attacks and defense effects accumulated by the target system during its past operation. Historical experience may include historical attack event records, attack frequencies and patterns, and defense effects, etc.

[0074] Optionally, the security gain and defense cost of each pre-selected scheduling type under different attacks are calculated respectively to obtain the security gain value and defense cost value corresponding to each pre-selected scheduling type. Because the defense cost value and security gain value generated by using the same scheduling type for defense under different attacks are different, each scheduling type will correspond to a defense cost value and a security gain value.

[0075] Optionally, the mimic defense system is composed of multiple executors. During the scheduling process of the control executor under mimic defense, a security gain value corresponding to the scheduling type is established. Sample data is analyzed to calculate the security gain value that can be achieved by each pre-selected scheduling type when defending against different attack types, and the defense cost brought by the system operation under this scheduling type in the same environment is evaluated compared to the case without mimic redundant defense, and then the defense cost value is obtained.

[0076] Optionally, statistical analysis is performed on the collected sample data and historical experience to calculate the prior probability of each pre-selected scheduling type, that is, the frequency of these scheduling types appearing in historical data, and the Bayesian probability is calculated using the statistically obtained prior probability.

[0077] For example, in the normal operation of the system, the mimic defense control system is not aware of the network threats or security scenarios that the system will encounter during operation. Random hardware failures or uncertain software errors, as well as security threats and attacks such as vulnerabilities, backdoors, viruses, and Trojans, any unknown threat or security scenario can be regarded as a network threat θ, and its prior probability p(θ) is known and obtained by experts in related fields based on historical data, defense system environment and experience. M=(μ1,μ2,...,μ k ) is the eigenvector of θ, with a total of k component elements. Each component element describes the network threat θ from its own perspective. Assuming that a sample of M is obtained, then using the Bayesian formula, the probability distribution of the network threat θ that is closer to the actual situation can be obtained. Then the Bayesian formula can be used to obtain the Bayesian probability. μ i represents the i-th component element among the k component elements. The Bayesian formula is shown in formula (1).

[0078]

[0079] In the above embodiment, the security gain under different attack types is calculated based on the sample data, so that the defense strategy can optimize various attack types based on real data. Secondly, by comparing the sample data with the situation without defense, the defense cost can be accurately calculated. Finally, the return gain is calculated by combining Bayesian probability, security gain and defense cost, and the defense strategy can be optimized based on comprehensive consideration of security gain and defense cost. This method of calculating the return gain can ensure that the selected scheduling type can not only effectively defend against attacks, but also achieve the best security benefits at the lowest cost.

[0080] Furthermore, the above calculation of the return gain based on the Bayesian probability, the safety gain value and the defense cost value includes: subtracting the safety gain value and the defense cost value to obtain the return function of each pre-selected scheduling type under different attack types; calculating the return gain value of each pre-selected scheduling type under different attack types based on the return function and the Bayesian probability; adding the return gain values ​​of each pre-selected scheduling type under different attack types to obtain the target return gain value corresponding to each pre-selected scheduling type.

[0081] Optionally, define C as the defense cost brought by the execution of a certain scheduling type, define B as the security gain generated by the defense system by calling a certain scheduling type. Define R as the reward gain function of the entire system during the defense operation process, then the relationship between the above three can be expressed as R = BC.

[0082] Optionally, after introducing Bayesian probability, assuming that there are t network threats in the system, calculate each pre-selected scheduling type S n The security gain and defense cost generated under different network attack types are obtained, and the corresponding security gain and defense cost are obtained. Then, according to the Bayesian probability, it can be obtained that any pre-selected scheduling type S n The corresponding return gain, B n represents the safety gain of the nth scheduling type in the set of pre-selected scheduling types, C n represents the defense cost of the nth scheduling type in the set of pre-selected scheduling types, S n Represents the nth scheduling type in the pre-selected scheduling type set. After that, the reward gains of different attack types under the same pre-selected scheduling type are added together to obtain the reward gain R corresponding to each pre-selected scheduling type. n θ i It represents the ith network threat among t network threats. The calculation formula is shown in Formula 2.

[0083]

[0084] In one of the embodiments, the above-mentioned updating of the target reward gain value according to the new sample data includes: updating the Bayesian probability according to the new sample data; and updating the target reward gain value according to the updated Bayesian probability, the security gain, and the defense cost.

[0085] For example, when a feature vector is updated, the network threat feature vector is used as new sample data, that is, a new sample M. The latest Bayesian probability is calculated based on the sample M to update the target reward gain value, and then the scheduling strategy is reselected. The specific process of calculating the target reward gain value can be referred to the records in the above embodiment, and will not be repeated here.

[0086] In the above embodiment, the security gain value is firstly subtracted from the defense cost value, and then the reward gain value of each pre-selected scheduling type is calculated based on the difference and Bayesian probability, which can effectively identify which scheduling strategies can provide the greatest net benefit under different attack types. Finally, by adding the reward gain values ​​of each pre-selected scheduling type, the system can obtain a comprehensive target reward gain value. This process can help decision makers identify which scheduling types perform best overall.

[0087] In one embodiment, the defense task corresponding to the pre-selected scheduling type is jointly executed by several execution bodies; after obtaining the new target scheduling type from the pre-selected scheduling type, it also includes: making a decision based on the output results of each execution body to obtain a decision result, and updating the target scheduling type according to the decision result.

[0088] After the system selects a target scheduling type and executes it, it will monitor the defensive effect of the scheduling type and evaluate its actual performance through the adjudication results.

[0089] Optionally, the output results of the target system's executors under the current scheduling type are collected in real time to determine the decision result. The scheduling type determines how the system selects and allocates executors to perform corresponding defense tasks under specific circumstances, and the executors are responsible for specifically performing these defense tasks. Different scheduling types may allocate different executors to perform defense tasks corresponding to the type.

[0090] The decision result is obtained based on the output results of each execution body. Optionally, assuming that there are three execution bodies for executing the target scheduling, when the output results of the data processed by the three execution bodies are consistent, it is determined as the first decision result.

[0091] Optionally, when the output result of the data processed by an executable body is abnormal, but still meets the majority consensus condition, that is, the number of executable bodies with inconsistent output results is less than a preset threshold, the decision result is determined to be the second decision result. Similarly, assuming that there are three executable bodies used to execute target scheduling, the preset threshold is 2, and when the output results of two executable bodies are consistent, the output result of one executable body is inconsistent. At this time, there is one executable body with inconsistent output results, so the decision result is determined to be the second decision result.

[0092] Optionally, when the output result of the data processed by an executable body is abnormal and does not meet the majority decision consensus condition, that is, when the output results of the executable bodies are inconsistent and the number of executable bodies with inconsistent output results is greater than or equal to a preset threshold, the decision result is determined to be the third decision result. In combination with the example in the above embodiment, when the decision results of the data processed by the three executable bodies are different from each other, the decision result is determined to be the third decision result.

[0093] Therefore, in order to accurately describe the target system to adjust the target scheduling type, the target scheduling type is adjusted in combination with the arbitration type in this embodiment.

[0094] Furthermore, in one of the embodiments, when the arbitration result does not meet the preset arbitration condition, the network attack type is obtained; according to the attack type, the target reward gain value is updated, and the target scheduling type is updated according to the updated target reward gain value; the preset arbitration condition is that the output results of each execution body are consistent, or the output results of each execution body are inconsistent and the number of execution bodies with inconsistent output results is less than a preset threshold.

[0095] Optionally, if the decision result is the third decision result, that is, when the decision result does not meet the preset decision condition, the defense strategy is adjusted, and the attacker type and attack effect are further analyzed, and the data is updated to the sample data, and then the Bayesian probability of network threat occurrence is updated for use in the subsequent selection of scheduling strategies. After obtaining the attacker type, since this type of attack has occurred, its corresponding Bayesian probability is 1, and the reward function is recalculated to obtain the updated reward gain, and the scheduling type with the largest gain is selected, and the corresponding execution body is scheduled to the system for operation defense.

[0096] Furthermore, in one embodiment, when the arbitration result satisfies the preset arbitration condition, each execution body continues to execute the target scheduling type.

[0097] Optionally, if the decision result is the first decision result or the second decision result, that is, when the decision result meets the preset decision condition, the existing execution body scheduling state will be maintained, that is, the target scheduling type will not be updated. At the same time, the network status continues to be monitored. Optionally, if a certain threat sign occurs, after this sign occurs, the probability of this network threat occurring will increase significantly, and the threat occurrence probability will be recalculated according to the Bayesian formula to obtain a new target reward gain value, and the scheduling type will be reselected to schedule the corresponding execution body to the running set. When no signs occur, the existing execution body scheduling state is maintained.

[0098] Optionally, if the decision result is the second decision result, after maintaining the existing executor scheduling state, the threat that causes the executor abnormality is updated to the network threat set, the Bayesian probability is recalculated, and the target reward gain value is updated.

[0099] Optionally, when the data processed by two executors are consistent again, the scheduling type with the largest current value is selected according to the updated reward gain, and the corresponding executor is scheduled to the running set, and the unselected executor is scheduled to the executor candidate set.

[0100] In the above embodiment, when the decision result of the target system under the target scheduling result is monitored, the system is dynamically adjusted according to the decision result. If the decision result is the first or second result, the system will continue with the current scheduling result and believe that the defense measures are effective enough. If the decision result is the third result, that is, the system detects a network attack, the system will re-update the Bayesian probability to reflect the latest threat information. Then, the target reward gain value is recalculated based on the updated Bayesian probability to optimize the defense strategy. This ensures that the system adapts to the attack situation in real time, improves the defense effect and resource utilization efficiency through continuous updating and adjustment, and maintains the security and stability of the system.

[0101] Optionally, after obtaining the new target scheduling type from the pre-selected scheduling types, the above also includes: counting the number of adjustments of the target scheduling type; if the number of adjustments is greater than a preset number, searching for the safety gain of each pre-selected scheduling type under the same attack type; and obtaining the new target scheduling type from the pre-selected scheduling types based on the safety gain.

[0102] The preset number of times is a pre-set indicator used to determine whether the scheduling strategy needs to be adjusted.

[0103] Optionally, according to a third preset method and a safety gain, a new target scheduling type is obtained from pre-selected scheduling types.

[0104] Exemplarily, if the conditions required by the mimic defense system are not met after the preset number of scheduling, the defense policy is adjusted, and the scheduling strategy is selected with the security gain as the only condition. The security gain value of the pre-selected scheduling type is retrieved, the security gain value under the same attack type is retrieved, the maximum security gain value is obtained, the scheduling type corresponding to this value is set as the optimal mimic scheduling strategy, and the execution body is dynamically scheduled, and the affected execution body is cleaned and restored at the same time, so as to achieve the state before the security attack, and continue to collect the mimic judgment results. In this embodiment, the third preset method is to select the maximum value of the security gain.

[0105] In the above embodiment, the number of adjustments of the target scheduling type is counted. If it is found that the number of adjustments exceeds the preset threshold, the system will perform additional optimization steps. This includes an in-depth analysis of the security gain of each pre-selected scheduling type under the same attack type. The system selects the optimal target scheduling type from multiple pre-selected scheduling types by selecting the scheduling type with the largest security gain. This method ensures that in the case of frequent adjustments, the system can optimize based on the most effective defense strategy, improve the overall defense efficiency, and reduce the interference caused by unnecessary adjustments.

[0106] In an exemplary embodiment, in combination Figure 2 As shown, Figure 2The figure is a flow chart of obtaining a new target scheduling class in one embodiment.

[0107] Before the system is run, the prior probability of unknown threats or security is obtained from experience based on the previous sample data of the system, and the Bayesian probability of network threats is calculated by substituting it into the Bayesian formula, and then the target return gain value is calculated based on the return function. The scheduling type with the largest target return gain value is selected as the target scheduling type, which is the current optimal executor scheduling strategy.

[0108] During the operation of the system, when a feature vector update is detected, a new sample will be obtained, and the latest Bayesian probability will be calculated based on the sample to update the target reward gain value, and then the scheduling strategy will be reselected.

[0109] After setting the optimal executor scheduling strategy, the mimic arbitrator will judge the output of this scheduling strategy and obtain the judgment result.

[0110] The control system analyzes the decision results and distinguishes them into two situations: one is abnormal, that is, the system is subject to network security threats, and the other is normal, that is, the system is not subject to security threats. For normal decision results, the defense system maintains the existing optimal execution body scheduling strategy and continues to run.

[0111] For abnormal judgment results of security threats, further analysis is performed to obtain the type of attacker and the effect of the attack, and the data is updated to the network threat sample space, and then the Bayesian probability of the network threat is updated for use in the subsequent selection of scheduling strategies. After obtaining the attacker type, since this type of attack has already occurred, its corresponding Bayesian probability is 1, and the reward function is recalculated to obtain the updated target reward gain value, and the scheduling type with the largest total gain value is selected, and the corresponding execution body is scheduled to run in the system.

[0112] When the system is threatened and attacked, if it can still meet the operating conditions of the heterogeneous redundant system, the current scheduling strategy will be maintained and the abnormal execution body will be cleaned and restored.

[0113] If the conditions required by the mimic defense system are still not met after the preset number of scheduling, adjust the defense policy and select the scheduling strategy with security gain as the only condition. Retrieve the security gain of the pre-selected scheduling type, retrieve the security gain under the same attack type, obtain the maximum value of the security gain, set the scheduling strategy corresponding to this value as the optimal executor scheduling strategy, and schedule the executor. At the same time, perform cleaning and recovery on the affected heterogeneous executors to achieve the state before the security attack, and continue to collect mimic judgment results.

[0114] In the above embodiment, the optimal scheduling strategy changes according to the Bayesian probability, and the Bayesian probability result changes with the actual situation of the network environment. When the system is running normally, no security is found at this time. In the face of unknown security threats, the prior probability and sample information of unknown threats or security are integrated based on the Bayesian model to obtain the maximized reward function, thereby obtaining the optimal mimicry scheduling strategy, and the scheduling strategy is applied to the corresponding required heterogeneous execution body for mimicry defense. Before the network threat occurs, when a certain feature vector is updated, the Bayesian probability will be updated, and then the reward gain will be recalculated, and the optimal scheduling strategy will be selected according to the reward gain. When the system is threatened, the result feedback of the mimicry ruling is analyzed at this time to obtain a description of the attacker type, and the actual reward function of different scheduling types under different attack types is selected to maximize the reward gain, and then determine the optimal scheduling type. The change of the optimal scheduling type can bring the best reward gain and make the defense system more adaptable to the environment. The environment faced by each device will be different. Different optimal scheduling types are selected according to the environment to achieve maximum security gain and performance balance.

[0115] In an exemplary embodiment, in combination Figure 3 As shown, Figure 3 The figure is a flowchart of a method for dynamically scheduling an execution body in an embodiment.

[0116] The mimetic defense system has a total of 4 heterogeneous executors, with a redundancy of 3, a 3-module executor operation set, and 3 required scheduling executors. There are 4 corresponding pre-selected scheduling types, namely S1, S2, S3, and S4. Their security gains are B1, B2, B3, and B4, and their defense costs are C1, C2, C3, and C4. So far, there are 4 types of network threats in the network threat set in the operating environment, namely θ1, θ2, θ3, and θ4. Assume that based on historical information, the prior probability distribution of network threats is p1, p2, p3, and p4. After setting the conditional probability, the Bayesian formula can be used to obtain the Bayesian probability of each network threat as P1, P2, P3, and P4.

[0117] According to the reward function R = P*(BC), the reward gain values ​​corresponding to the scheduling type are calculated: R(S1|θ1) = P1*(B1-C1), R(S2|θ2) = P2*(B2-C2), R(S3|θ3) = P3*(B3-C3), and R(S4|θ4) = P4*(B4-C4). The reward gain values ​​calculated for each scheduling type under all network threats are added together. The gain values ​​R(S1), R(S2), R(S3) and R(S4) constitute the value of the reward gain X, and its sequence number corresponds to the scheduling type. After the calculation is completed, the scheduling type corresponding to the maximum value is selected in the sequence.

[0118] R(S1)=R(S1|θ1)+R(S1|θ2)+R(S1|θ3)+R(S1|θ4)

[0119] R(S2)=R(S2|θ1)+R(S2|θ2)+R(S2|θ3)+R(S2|θ4)

[0120] R(S3)=R(S3|θ1)+R(S3|θ2)+R(S3|θ3)+R(S3|θ4)

[0121] R(S4)=R(S4|θ1)+R(S4|θ2)+R(S4|θ3)+R(S4|θ4)

[0122] The system needs to schedule 3 executors in total. After obtaining the executor number in the scheduling type corresponding to the maximum value, the corresponding executor is scheduled from the executor candidate set to the executor running set, and the running result is obtained. Under the condition of majority decision consensus, if more than two executors process the same data, the consistent data processing results will be output.

[0123] When the processing results of the three executors are consistent, the existing defense policy is maintained and the selected scheduling type is kept. Monitor the network status. If an element in the feature vector of a network threat is updated, such as when a sign of an event occurs, the conditional probability will be updated after this element is updated. That is, when the sign of the event occurs, the probability of the occurrence of this network threat will be updated. The probability of the network threat will be recalculated according to the Bayesian formula to obtain a new target return gain value. The scheduling type with the largest target return gain value is reselected, and the corresponding executor in the scheduling type is scheduled to the running set. When no element in the feature vector is updated, the existing executor scheduling status is maintained.

[0124] When the processing result of an executor is abnormal, but the majority consensus condition is still met, that is, the processing data results of the two executors are consistent. The system outputs the same data results after the judgment, cleans and restores the executor that caused the abnormality, maintains the existing executor scheduling status, updates the threat that caused the executor abnormality to the network threat set, recalculates the Bayesian probability, and updates the reward gain value. When the processing data results of the two executors are consistent again, the scheduling type with the largest current value is selected according to the updated value list, and the corresponding executor is scheduled to the running set, and the unselected executor is scheduled to the executor candidate set.

[0125] When the processing result of an executor is abnormal and does not meet the majority consensus condition, that is, the processing data results of the three executors are different from each other. Adjust the defense strategy, select the scheduling executor according to the security gain, select the scheduling type with the largest security gain, and schedule the corresponding executor to the running set. Clean and restore the unselected executors, and then schedule them to the alternative set. Re-run the executor and make a decision on the running results again.

[0126] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0127] Based on the same inventive concept, the embodiment of the present application also provides a device for implementing the above-mentioned method for dynamically scheduling an executable body. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above-mentioned method, so the specific limitations in the embodiments of one or more Bayesian probability-based executable body dynamic scheduling devices provided below can refer to the above-mentioned limitations on the executable body dynamic scheduling method, and will not be repeated here.

[0128] In an exemplary embodiment, Figure 4 As shown, a device for executing a dynamic scheduling method is provided, including: an allocation module 410, a probability update module 420, a gain update module 430 and a type determination module 440, wherein:

[0129] The allocation module 410 is used to calculate the target reward gain value of each pre-selected scheduling type, and select the target scheduling type from the pre-selected scheduling types according to the target reward gain value; the target reward gain value is obtained based on Bayesian probability.

[0130] The probability updating module 420 is used to update the Bayesian probability of each attack type when the feature vector representing the network attack is updated.

[0131] The gain updating module 430 is used to update the target reward gain value according to the updated Bayesian probability.

[0132] The type determination module 440 is used to obtain a new target scheduling type from the pre-selected scheduling types according to the updated target reward gain value, wherein the target scheduling type is used for dynamically scheduling the execution body.

[0133] In one embodiment, the allocation module further includes:

[0134] The first calculation unit is used to obtain the prior probability of each attack type according to the sample data and historical experience of each attack type.

[0135] The second calculation unit is used to respectively calculate the security gain and defense cost of each pre-selected scheduling type under different attack types to obtain a security gain value and a defense cost value.

[0136] The third calculation unit is used to calculate the Bayesian probability according to the prior probability and the new sample data, and calculate the target return gain value of each pre-selected scheduling type according to the Bayesian probability, the safety gain value and the defense cost value.

[0137] In one embodiment, the third calculation unit includes:

[0138] The difference subunit is used to make a difference between the security gain value and the defense cost value to obtain the reward function of each pre-selected scheduling type under different attack types.

[0139] The product subunit is used to calculate the reward gain value of each pre-selected scheduling type under different attack types according to the reward function and Bayesian probability.

[0140] The total gain calculation subunit is used to add the reward gain values ​​of each pre-selected scheduling type under different attack types to obtain the target reward gain value of each pre-selected scheduling type.

[0141] In one embodiment, the above device further comprises:

[0142] The decision module is used to make a decision based on the output results of each execution body to obtain a decision result, and update the target scheduling type according to the decision result. Among them, the defense task corresponding to the pre-selected scheduling type is jointly executed by several execution bodies.

[0143] In one embodiment, the above-mentioned adjudication module further includes:

[0144] The attack acquisition unit is used to acquire the network attack type when the decision result does not meet the preset decision condition.

[0145] The first scheduling type updating unit is used to update the target reward gain value according to the attack type, and to update the target scheduling type according to the updated target reward gain value; the preset judgment condition is that the output results of each execution body are consistent, or the output results of each execution body are inconsistent and the number of execution bodies with inconsistent output results is less than a preset threshold.

[0146] In one embodiment, the above-mentioned adjudication module further includes:

[0147] The second scheduling type updating unit is used for each execution body to continue to execute the defense task according to the target scheduling type when the decision result meets the preset decision condition.

[0148] In one embodiment, the above device further comprises:

[0149] The statistics module is used to count the number of adjustments of the target scheduling type.

[0150] The search module is used to search for the safety gain value of each pre-selected scheduling type under the same attack type if the number of adjustments is greater than a preset number.

[0151] The type updating module is used to obtain a new target scheduling type from pre-selected scheduling types based on the safety gain value.

[0152] Each module in the above-mentioned Bayesian probability-based dynamic scheduling device for an executable body can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each of the above modules.

[0153] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 5As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store historical sample data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a dynamic scheduling method for an execution body is implemented.

[0154] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0155] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in any one of the above embodiments when executing the computer program.

[0156] In one embodiment, when the computer program is executed by a processor, the following steps in any one of the above embodiments are also implemented.

[0157] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in any one of the above embodiments when executed by a processor.

[0158] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0159] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0160] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for dynamic scheduling of an execution body, characterized in that: The method comprises: Calculating a target reward gain value for each pre-selected scheduling type, and selecting a target scheduling type from the pre-selected scheduling types according to the target reward gain value; the target reward gain value is obtained based on Bayesian probability; When the feature vector representing the network attack is updated, the Bayesian probability of each attack type is updated; Updating the target reward gain value according to the updated Bayesian probability; According to the updated target reward gain value, a new target scheduling type is obtained from the pre-selected scheduling types, wherein the target scheduling type is used for dynamically scheduling execution bodies.

2. The method for dynamic scheduling of an executable body according to claim 1, characterized in that: The calculating of the target reward gain value of each pre-selected scheduling type includes: Based on the sample data and historical experience of each attack type, the prior probability of each attack type is obtained; Calculate the security gain and defense cost of each of the pre-selected scheduling types under different attack types to obtain a security gain value and a defense cost value; The Bayesian probability is calculated according to the prior probability and the sample data, and the target reward gain value of each of the pre-selected scheduling types is calculated according to the Bayesian probability, the safety gain value and the defense cost value.

3. The method for dynamic scheduling of an executable body according to claim 2, characterized in that: The calculating the target reward gain value of each pre-selected scheduling type according to the Bayesian probability, the safety gain and the defense cost includes: Subtract the security gain value from the defense cost value to obtain a reward function of each of the pre-selected scheduling types under different attack types; According to the reward function and the Bayesian probability, the reward gain value of each of the pre-selected scheduling types under different attack types is calculated; The reward gain values ​​of each of the pre-selected scheduling types under different attack types are added together to obtain a target reward gain value of each pre-selected scheduling type.

4. The method for dynamic scheduling of an executable body according to claim 1, characterized in that: The defense task corresponding to the pre-selected scheduling type is jointly executed by a plurality of execution bodies; after obtaining the new target scheduling type from the pre-selected scheduling type, the method further includes: A decision result is obtained by making a decision based on the output result of each of the execution bodies, and the target scheduling type is updated according to the decision result.

5. The method for dynamic scheduling of an executable body according to claim 4, characterized in that: The updating of the target scheduling type according to the arbitration result includes: When the decision result does not meet the preset decision condition, obtaining the network attack type; According to the attack type, the target reward gain value is updated, and the target scheduling type is updated according to the updated target reward gain value; the preset judgment condition is that the output results of each of the executors are consistent, or the output results of each of the executors are inconsistent and the number of executors with inconsistent output results is less than a preset threshold.

6. The method for dynamic scheduling of an executable body according to claim 5, characterized in that: The updating of the target scheduling type according to the arbitration result further includes: When the decision result satisfies the preset decision condition, each of the execution bodies continues to execute the defense task according to the target scheduling type.

7. The method for dynamic scheduling of an executable body according to claim 2, characterized in that: After obtaining the new target scheduling type from the pre-selected scheduling type, the method further includes: Count the number of adjustments to the target scheduling type; If the adjustment number is greater than the preset number, searching for the safety gain value of each of the preselected scheduling types under the same attack type; Based on the safety gain value, a new target scheduling type is obtained from the pre-selected scheduling types.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images