Method for performing body dynamic scheduling, computer device, readable storage medium and program product

Abstract

The application relates to an execution body dynamic scheduling method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: calculating target return gain values of each preselected scheduling type, and selecting a target scheduling type from the preselected scheduling types according to the target return gain values; the target return gain values are obtained based on Bayesian probability; when a feature vector update representing a network attack is monitored, updating the Bayesian probability of each attack type; updating the target return gain values according to the updated Bayesian probability; and obtaining a new target scheduling type from the preselected scheduling types according to the updated target return gain values, wherein the target scheduling type is used for dynamically scheduling an execution body. The above technical solution can more accurately adapt to different network environments and increase the dynamic nature and security of a quasi-state defense system by calculating return gain based on Bayesian probability and performing dynamic scheduling.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a method, apparatus, computer device, computer-readable storage medium, and computer program product for dynamic scheduling of an execution body. Background Art

[0002] In recent years, with the rapid development of information technology, the complexity and scale of network systems have continued to increase, and network security issues have become increasingly severe. Traditional defense strategies are typically based on known threats and attack patterns, using fixed rules and policies to address them. However, with the continuous evolution of network attack techniques, attackers are able to quickly develop and use new attack methods, making traditional defenses ineffective against unknown threats.

[0003] Currently, existing network defense systems primarily rely on static defense strategies. These strategies are typically based on known threats and attack patterns, using preset rules and fixed strategies to defend against potential attacks. However, with the continuous advancement and sophistication of network attack techniques, attackers are able to rapidly develop and deploy new attack methods to circumvent existing defenses. Static defense strategies are unable to cope with these ever-changing and unknown threats, making them easy targets. Summary of the Invention

[0004] Based on this, it is necessary to provide a method, device, computer equipment, computer-readable storage medium and computer program product for dynamic scheduling of execution bodies that can perform dynamic defense in response to the above technical problems.

[0005] In a first aspect, the present application provides a method for dynamic scheduling of an executable, the method comprising:

[0006] Calculating a target reward gain value for each preselected scheduling type, and selecting a target scheduling type from the preselected scheduling types based on the target reward gain value; wherein the target reward gain value is obtained based on Bayesian probability;

[0007] When the feature vector representing the network attack is updated, the Bayesian probability of each attack type is updated;

[0008] Updating the target reward gain value according to the updated Bayesian probability;

[0009] According to the updated target reward gain value, a new target scheduling type is obtained from the pre-selected scheduling types, wherein the target scheduling type is used for dynamically scheduling execution bodies.

[0010] In one embodiment, calculating the target reward gain value for each preselected scheduling type includes:

[0011] Based on the sample data and historical experience of each attack type, the prior probability of each attack type is obtained;

[0012] Calculate the security gain and defense cost of each of the preselected scheduling types under different attack types to obtain a security gain value and a defense cost value;

[0013] The Bayesian probability is calculated according to the prior probability and the new sample data, and the target reward gain value of each of the preselected scheduling types is calculated according to the Bayesian probability, the safety gain value, and the defense cost value.

[0014] In one embodiment, the calculating the target reward gain value for each preselected scheduling type based on the Bayesian probability, the safety gain, and the defense cost includes:

[0015] Subtracting the security gain value from the defense cost value to obtain a reward function for each of the preselected scheduling types under different attack types;

[0016] Calculating reward gain values ​​of the preselected scheduling types under different attack types according to the reward function and the Bayesian probability;

[0017] The reward gain values ​​of each of the preselected scheduling types under different attack types are added together to obtain a target reward gain value of each preselected scheduling type.

[0018] In one embodiment, the defense task corresponding to the preselected scheduling type is jointly executed by a plurality of executors; after obtaining the new target scheduling type from the preselected scheduling type, the method further includes:

[0019] A decision result is obtained by making a decision based on the output result of each execution body, and the target scheduling type is updated according to the decision result.

[0020] In one embodiment, updating the target scheduling type according to the arbitration result includes:

[0021] When the decision result does not meet the preset decision condition, obtaining the network attack type;

[0022] According to the attack type, the target reward gain value is updated, and the target scheduling type is updated according to the updated target reward gain value; the preset judgment condition is that the output results of each of the executors are consistent, or the output results of each of the executors are inconsistent and the number of the executors with inconsistent output results is less than a preset threshold.

[0023] In one embodiment, updating the target scheduling type according to the arbitration result further includes:

[0024] When the decision result satisfies the preset decision condition, each of the execution bodies continues to execute the defense task according to the target scheduling type.

[0025] In one embodiment, the obtaining the new target scheduling type from the preselected scheduling type further includes:

[0026] Count the number of adjustments to the target scheduling type;

[0027] If the number of adjustments is greater than a preset number, searching for the security gain value of each of the preselected scheduling types under the same attack type;

[0028] Based on the safety gain value, the new target scheduling type is obtained from the pre-selected scheduling types.

[0029] In a second aspect, the present application provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any of the above methods when executing the computer program.

[0030] In a third aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of any of the above-described methods when the computer program is executed by a processor.

[0031] In a fourth aspect, the present application provides a computer program product, comprising a computer program, which implements the steps of any of the above methods when executed by a processor.

[0032] The aforementioned method, apparatus, computer device, computer-readable storage medium, and computer program product for dynamic scheduling of executors calculate target reward-gain values ​​for each preselected scheduling type using sample data. Based on these target reward-gain values, the optimal target scheduling type can be selected. When a network threat signature vector is detected, the target reward-gain value is updated by recalculating the Bayesian probability. This update ensures that the system can dynamically adjust the executor scheduling strategy based on real-time threats, making the defense system more flexible and efficient, enabling it to quickly adapt to changes in the attack environment and select the optimal defense strategy, thereby enhancing the system's anti-attack capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments of the present application or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying any creative work.

[0034] Figure 1 1 is a flow chart of a method for dynamically scheduling an execution body according to an embodiment;

[0035] Figure 2 A schematic diagram of a process for obtaining a new target scheduling class in one embodiment;

[0036] Figure 3 A schematic diagram of a flow chart of a method for dynamically scheduling an execution body in one embodiment;

[0037] Figure 4 is a structural block diagram of an executive body dynamic scheduling device in one embodiment;

[0038] Figure 5 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0040] In a static defense system, once the defense strategy and configuration are set, they usually remain unchanged for a long time. Such blind, unguided active defense measures often lead to excessive performance loss and reduce the cost-effectiveness of defense. Optimized defense strategies need to be adjusted in a targeted manner based on the specific security status.

[0041] Therefore, this application proposes a dynamic scheduling method for executing objects to achieve dynamic defense. The core idea of ​​the dynamic defense strategy is to continuously adjust the system's defense status, making it difficult for attackers to predict and master the system's defense mechanism, thereby improving system security.

[0042] Before a target system encounters a security threat, the scheduling state of a heterogeneous redundant system is often random or fixed. Such blind, unguided active defense measures often lead to excessive performance losses and reduce the cost-effectiveness of defense. Optimized defense strategies require targeted adjustments based on the specific security state. There are various implementation options for mimetic scheduling strategies, such as random time and random target scheduling, scheduling that maximizes heterogeneity, a security-first scheduling algorithm, and feedback-based scheduling. Different scheduling strategies offer different security benefits.

[0043] The Bayesian model describes the game process between participants under conditions of incomplete information. Participants may be of different types, each with different strategies and payoffs. The essence of Bayes' theorem is that before the essential properties of a particular entity can be known with certainty, the probability of its essential attributes can be determined by combining the probability of occurrence associated with that particular entity. Actual cyber threats are complex processes, so an embodiment of the present invention proposes a dynamic scheduling method for executors based on Bayesian probability. Based on Bayesian probability, this method can determine security gains by combining the probability of occurrence associated with unknown threats before the attack of the unknown threat can be determined.

[0044] In one embodiment, Figure 1 As shown, a method for dynamic scheduling of executables is provided. This embodiment uses the method applied to a terminal as an example for illustration. It is understandable that the method can also be applied to a server, or to a system including a terminal and a server, and implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0045] Step S102 , calculating the target reward gain value of each pre-selected scheduling type, and selecting a target scheduling type from the pre-selected scheduling types according to the target reward gain value; the target reward gain value is obtained based on Bayesian probability.

[0046] Optionally, before step S102 , the step further includes obtaining sample data of the target system.

[0047] Collect and obtain sample data generated by the target system during its past operation. These data samples may include system operation records under different scheduling types, system performance indicators, network threat types and their corresponding defense effects, etc.

[0048] The target scheduling type refers to a scheduling type selected from all pre-selected scheduling types based on the target reward gain values ​​corresponding to each pre-selected scheduling type, and is consistent with the current target system environment. For example, if the current defense capability needs to be improved, the scheduling type with the strongest defense capability is selected.

[0049] The target return gain is calculated based on the security gain and defense cost, taking probability into account. Different pre-selected scheduling types correspond to different target return gain values.

[0050] Optionally, a target scheduling type may be selected from various pre-selected scheduling types according to the target reward gain value and the first preset rule.

[0051] The first preset rule is pre-set, and an indicator of a target scheduling type is selected in advance from pre-selected scheduling types.

[0052] Optionally, sample data is used to calculate target return-gain values ​​for different scheduling types. The target return-gain values ​​reflect the balance between the security gain and performance cost of each scheduling type in responding to network threats.

[0053] Furthermore, from the perspective of improving system security, the scheduling parameters included in a particular defense schedule may be unnecessary. This means that whether or not the scheduling parameters are executed has no impact on system security, while their execution can significantly degrade operational performance. When the entire system contains unknown factors, defending against the most likely variables—network threats—can achieve a better balance between performance loss and security gain.

[0054] Therefore, in this embodiment, the Bayesian probability is calculated based on the sample data, and the target reward gain value is calculated based on the Bayesian probability.

[0055] Optionally, by comparing the calculated target reward gain value with preset rules, the system selects the optimal target scheduling type from multiple scheduling types to deal with current or possible future threats.

[0056] Optionally, the security gain, defense cost and Bayesian probability of each pre-selected scheduling type under different attack types can be calculated based on sample data, and the target return gain value can be calculated based on the security gain, defense cost and Bayesian probability, and the target scheduling type can be selected from the pre-selected scheduling types based on the first preset rule and the target return gain value.

[0057] Exemplarily, the first preset rule may be that the return gain is maximized, and correspondingly, the scheduling type with the maximum return gain is selected as the target scheduling type.

[0058] Step S104: When it is detected that the feature vector representing the network attack is updated, the Bayesian probability of each attack type is updated.

[0059] When new network threats are detected, they are represented by feature vectors and the new threat information is added to the sample data so that the target return gain value can reflect the latest threat situation in a timely manner.

[0060] When no new network threats are detected but the feature vector is updated, the probability of the new network threat occurring will change, thereby changing the target return gain value and reflecting the latest network environment situation more promptly.

[0061] Optionally, the external environment is monitored in real time to capture feature vectors of network threats. For example, the feature vectors may be the time period, frequency, or signs of network threats. The captured new threat feature vectors are incorporated into the sample data, and the Bayesian probability is updated using the new sample data.

[0062] Step S106: Update the target reward gain value according to the updated Bayesian probability.

[0063] After updating the Bayesian probability, the target reward gain values ​​for each pre-selected scheduling type need to be updated. The new Bayesian probability reflects the system's current adaptability to different attack scenarios. Therefore, by updating the target reward gain value with the Bayesian probability, we can obtain a target reward gain value that reflects the current environment.

[0064] Step S108: Obtain a new target scheduling type from the pre-selected scheduling types according to the updated target reward gain value, wherein the target scheduling type is used for dynamically scheduling the execution body.

[0065] In this embodiment, the system selects a new target scheduling type based on the new target reward gain value. This is because the network environment may have changed, and the original target scheduling type may no longer be the optimal solution. Through dynamic adjustment, the system can always adopt the optimal defense strategy, ensuring that the system's defense capabilities and efficiency are maximized under the current network threat scenario.

[0066] Optionally, a new target scheduling type may be obtained from the pre-selected scheduling types through a second preset rule and the updated target reward gain value data.

[0067] It's important to note that in this application, the defense strategy corresponding to a scheduling type is jointly executed by multiple executors. This means that each scheduling type specifies which executors will work together to implement the strategy. Because the scheduling type itself includes the selection and configuration of executors, when the feature vector representing a cyber attack is updated, the system can dynamically adjust the executors involved in the defense based on the updated target scheduling type. This dynamic scheduling mechanism enables the system to flexibly adapt to different security requirements, ensuring that the system maintains a high level of security in all situations.

[0068] In the aforementioned scheduling method, after calculating the target reward gain values ​​for each preselected scheduling type using sample data, the optimal target scheduling type is selected based on these gain values. When an update to the network threat signature vector is detected, the target reward gain value is updated by updating the Bayesian probability calculation. This update ensures that the system can dynamically adjust the scheduling strategy based on real-time threats, making the defense system more flexible and efficient, enabling it to quickly adapt to changes in the attack environment and select the optimal defense strategy, thereby enhancing the system's anti-attack capabilities.

[0069] Because different defensive actions inevitably incur certain defense costs, addressing the performance-security tradeoff in active defense is a crucial principle. The target system must dynamically implement scheduling strategies to achieve security gains while maintaining an acceptable defense cost. Dynamic scheduling can achieve significant defense gains while reducing unnecessary defense costs.

[0070] Therefore, further, in one embodiment, the above-mentioned calculation of the target reward gain value of each preselected scheduling type includes: obtaining the prior probability of each attack type based on the sample data and historical experience of each attack type; respectively calculating the security gain and defense cost of each preselected scheduling type under different attack types to obtain the security gain value and the defense cost value; calculating the Bayesian probability based on the prior probability and the new sample data, and calculating the target reward gain value of each preselected scheduling type based on the Bayesian probability, the security gain value and the defense cost value.

[0071] Among them, the defense cost refers to the resource consumption, performance loss, etc. required when adopting the pre-selected scheduling type to defend against specific attacks.

[0072] Among them, security gain refers to the security benefit obtained by the target system when defending against specific attacks after adopting the pre-selected scheduling type, that is, the effect of the target system successfully resisting the attack and the improved security.

[0073] Among them, historical experience refers to the information about network attacks and defense effects accumulated by the target system during its past operation. Historical experience can include historical attack event records, attack frequency and patterns, and defense effects.

[0074] Optionally, the security gain and defense cost of each preselected scheduling type under different attacks are calculated separately to obtain the corresponding security gain and defense cost values ​​for each preselected scheduling type. Because the defense cost and security gain values ​​generated by using the same scheduling type for different attacks are different, each scheduling type is associated with a defense cost and a security gain value.

[0075] Optionally, the mimicry defense system consists of multiple executors. During the scheduling of the control executors under mimicry defense, a security gain value corresponding to the scheduling type is established. Sample data is analyzed to calculate the security gain that each preselected scheduling type can achieve when defending against different attack types. The defense cost of operating the system under this scheduling type in the same environment is evaluated compared to operating without mimicry redundancy defense, thereby deriving the defense cost.

[0076] Optionally, statistical analysis is performed on the collected sample data and historical experience to calculate the prior probability of each pre-selected scheduling type, that is, the frequency of these scheduling types appearing in historical data, and the Bayesian probability is calculated using the statistically obtained prior probability.

[0077] For example, during normal system operation, the mimic defense control system is not aware of the network threats or security scenarios that the system will encounter during operation. Random hardware failures or uncertain software errors, as well as security threats and attacks such as vulnerabilities, backdoors, viruses, and Trojans, any unknown threat or security scenario can be regarded as a network threat θ, and its prior probability p(θ) is known and obtained by experts in related fields based on historical data, defense system environment, and experience. M=(μ1,μ2,...,μ k ) is the eigenvector of θ, with a total of k components. Each component describes the network threat θ from its own perspective. Assuming a sample of M, using the Bayesian formula, we can obtain a probability distribution of the network threat θ that is closer to the actual situation than the prior probability. Using the Bayesian formula, we can obtain the Bayesian probability. i represents the i-th component element among the k component elements. The Bayesian formula is shown in formula (1).

[0078]

[0079] In the above embodiment, the security gain under different attack types is calculated based on sample data, allowing the defense strategy to be optimized for various attack types based on real data. Secondly, by comparing the sample data with the situation without defense, the defense cost can be accurately calculated. Finally, by combining Bayesian probability, security gain, and defense cost to calculate the return gain, the defense strategy can be optimized based on a comprehensive consideration of security gain and defense cost. This return gain calculation method ensures that the selected scheduling type can both effectively defend against attacks and achieve the best security benefit at the lowest cost.

[0080] Furthermore, the above calculation of the reward gain based on the Bayesian probability, the safety gain value and the defense cost value includes: subtracting the safety gain value and the defense cost value to obtain the reward function of each pre-selected scheduling type under different attack types; calculating the reward gain value of each pre-selected scheduling type under different attack types based on the reward function and the Bayesian probability; adding the reward gain values ​​of each pre-selected scheduling type under different attack types to obtain the target reward gain value corresponding to each pre-selected scheduling type.

[0081] Optionally, define C as the defense cost incurred during the execution of a certain scheduling type, and define B as the security gain generated by the defense system by invoking a certain scheduling type. Define R as the reward-gain function of the entire system during the defense operation. The relationship between the above three can be expressed as R = BC.

[0082] Optionally, after introducing Bayesian probability, assuming there are t network threats in the system, calculate each pre-selected scheduling type S n The security gain and defense cost generated under different network attack types are obtained, and the corresponding security gain and defense cost are obtained. Then, according to the Bayesian probability, any pre-selected scheduling type S n The corresponding return gain, B n represents the safety gain of the nth scheduling type in the set of preselected scheduling types, C n represents the defense cost of the nth scheduling type in the set of preselected scheduling types, S n Represents the nth scheduling type in the pre-selected scheduling type set. Afterwards, the reward gains of different attack types under the same pre-selected scheduling type are added together to obtain the reward gain R corresponding to each pre-selected scheduling type. n θ i represents the i-th network threat among t network threats. The calculation formula is shown in Formula 2.

[0083]

[0084] In one embodiment, the updating of the target reward gain value according to the new sample data includes: updating the Bayesian probability according to the new sample data; and updating the target reward gain value according to the updated Bayesian probability, the security gain, and the defense cost.

[0085] For example, when a feature vector update is detected, the network threat feature vector is used as new sample data, that is, a new sample M. The latest Bayesian probability is calculated based on sample M, and the target reward gain value is updated, and the scheduling strategy is reselected. The specific process of calculating the target reward gain value can be referred to the description of the above embodiment and will not be repeated here.

[0086] In the above example, the security gain is first subtracted from the defense cost. Based on this difference and Bayesian probability, the reward-gain value for each preselected scheduling type is calculated. This effectively identifies which scheduling strategies provide the greatest net benefit under different attack types. Finally, by summing the reward-gain values ​​for each preselected scheduling type, the system obtains a comprehensive target reward-gain value. This process helps decision makers identify which scheduling types perform best overall.

[0087] In one embodiment, the defense task corresponding to the preselected scheduling type is jointly executed by several executors; after obtaining the new target scheduling type from the preselected scheduling type, it also includes: making a judgment based on the output results of each executor to obtain a judgment result, and updating the target scheduling type according to the judgment result.

[0088] After the system selects a target scheduling type and executes it, it monitors the defensive effect of the scheduling type and evaluates its actual performance through the adjudication results.

[0089] Optionally, the system collects the output of the target system's executors under the current scheduling type in real time to determine the adjudication outcome. The scheduling type determines how the system selects and assigns executors to perform the corresponding defense tasks under specific circumstances, and the executors are responsible for executing these defense tasks. Different scheduling types may assign different executors to perform the defense tasks corresponding to that type.

[0090] The decision result is obtained based on the output results of each execution body. Optionally, assuming that there are three execution bodies for executing the target scheduling, when the output results of the data processed by the three execution bodies are consistent, it is determined as the first decision result.

[0091] Alternatively, if the output result of an executor processing data is abnormal but still satisfies the majority consensus condition, that is, the number of executors with inconsistent output results is less than a preset threshold, the second decision is determined. Similarly, assuming there are three executors executing the target schedule and the preset threshold is 2, when the output results of two executors are consistent, the output result of one executor is inconsistent. In this case, there is only one executor with inconsistent output results, so the second decision is determined.

[0092] Optionally, when the output result of the data processed by an executable is abnormal and does not meet the majority consensus condition, that is, when the output results of the executables are inconsistent and the number of executables with inconsistent output results is greater than or equal to a preset threshold, the arbitration result is determined to be the third arbitration result. In conjunction with the example in the above embodiment, when the arbitration results of the data processed by three executables differ from each other, the arbitration result is determined to be the third arbitration result.

[0093] Therefore, in order to accurately describe the target system and adjust the target scheduling type, the target scheduling type is adjusted in combination with the arbitration type in this embodiment.

[0094] Furthermore, in one embodiment, when the arbitration result does not meet the preset arbitration condition, the network attack type is obtained; according to the attack type, the target reward gain value is updated, and the target scheduling type is updated according to the updated target reward gain value; the preset arbitration condition is that the output results of each execution body are consistent, or the output results of each execution body are inconsistent and the number of execution bodies with inconsistent output results is less than a preset threshold.

[0095] Optionally, if the verdict is the third verdict, that is, if the verdict does not meet the preset verdict conditions, the defense strategy is adjusted. Further analysis is performed to determine the attacker type and attack effect, and the data is updated to the sample data. The Bayesian probability of the network threat occurring is then updated for use in subsequent scheduling strategy selection. After determining the attacker type, given that this type of attack has already occurred, its corresponding Bayesian probability is 1. The reward function is recalculated to obtain the updated reward gain. The scheduling type with the largest gain is selected, and the corresponding executor is scheduled into the system for defense execution.

[0096] Furthermore, in one embodiment, when the arbitration result satisfies the preset arbitration condition, each execution body continues to execute the target scheduling type.

[0097] Optionally, if the decision result is the first or second decision result, that is, when the decision result meets the preset decision conditions, the existing executor scheduling state will be maintained, that is, the target scheduling type will not be updated. At the same time, network status monitoring will continue. Optionally, if a threat sign occurs, after which the probability of the network threat occurring will increase significantly, the threat probability will be recalculated according to the Bayesian formula to obtain a new target reward gain value, the scheduling type will be reselected, and the corresponding executor will be scheduled to the running set. If no sign occurs, the existing executor scheduling state will be maintained.

[0098] Optionally, if the decision result is the second decision result, after maintaining the existing executor scheduling state, the threat that causes the executor abnormality is updated to the network threat set, the Bayesian probability is recalculated, and the target reward gain value is updated.

[0099] Optionally, when the data processing results of two executors are consistent again, the scheduling type with the largest current value is selected according to the updated reward gain, and the corresponding executor is scheduled to the running set, and the unselected executor is scheduled to the executor candidate set.

[0100] In the above embodiment, when the target system's decision result under the target scheduling outcome is monitored, the system dynamically adjusts based on the decision result. If the decision result is the first or second outcome, the system will continue with the current scheduling outcome, deeming the defense measures sufficiently effective. If the decision result is the third outcome, meaning the system has detected a network attack, the system will re-update the Bayesian probability to reflect the latest threat information. Then, based on the updated Bayesian probability, the target reward gain value will be recalculated to optimize the defense strategy. This ensures that the system adapts to the attack situation in real time. Through continuous updates and adjustments, it improves defense effectiveness and resource utilization efficiency, maintaining system security and stability.

[0101] Optionally, after obtaining the new target scheduling type from the pre-selected scheduling types, the above also includes: counting the number of adjustments of the target scheduling type; if the number of adjustments is greater than the preset number, searching for the security gain of each pre-selected scheduling type under the same attack type; and obtaining the new target scheduling type from the pre-selected scheduling types based on the security gain.

[0102] The preset number of times is a pre-set indicator used to determine whether the scheduling strategy needs to be adjusted.

[0103] Optionally, according to a third preset method and a safety gain, a new target scheduling type is obtained from preselected scheduling types.

[0104] For example, if the conditions required by the mimicry defense system are not met after a preset number of scheduling attempts, the defense policy is adjusted, and the scheduling strategy is selected based solely on security gain. The security gain values ​​for the preselected scheduling type are retrieved, and the security gain values ​​for the same attack type are retrieved. The maximum security gain value is obtained, and the scheduling type corresponding to this value is set as the optimal mimicry scheduling strategy. The executors are dynamically scheduled, and affected executors are cleaned and restored to their original state before the security attack. Mimicry adjudication results are then collected. In this embodiment, the third preset method is to select the maximum security gain.

[0105] In the above embodiment, the number of adjustments to the target scheduling type is counted. If the number of adjustments exceeds a preset threshold, the system will perform additional optimization steps. This involves an in-depth analysis of the security gain of each pre-selected scheduling type under the same attack type. The system selects the scheduling type with the greatest security gain, thereby filtering out the optimal target scheduling type from the multiple pre-selected scheduling types. This approach ensures that even with frequent adjustments, the system can optimize based on the most effective defense strategy, improving overall defense efficiency and reducing the interference caused by unnecessary adjustments.

[0106] In one exemplary embodiment, in combination Figure 2 As shown, Figure 2The figure is a flowchart of obtaining a new target scheduling class in one embodiment.

[0107] Before the system runs, the prior probability of unknown threats or security is obtained from experience based on previous sample data. This is then substituted into the Bayesian formula to calculate the Bayesian probability of a network threat occurring. The target reward gain value is then calculated based on the reward function. The scheduling type with the largest target reward gain value is selected as the target scheduling type, which is the currently optimal executor scheduling strategy.

[0108] During the operation of the system, when a feature vector update is detected, a new sample will be obtained. The latest Bayesian probability will be calculated based on the sample, and the target reward gain value will be updated, and then the scheduling strategy will be reselected.

[0109] After setting the optimal executor scheduling strategy, the mimetic arbitrator will judge the output of this scheduling strategy and obtain the judgment result.

[0110] The control system analyzes the decision results and categorizes them into two scenarios: abnormal, indicating a cybersecurity threat, and normal, indicating no threat. For normal decisions, the defense system maintains the existing optimal executor scheduling strategy and continues to operate.

[0111] For abnormal security threat verdicts, further analysis is performed to determine the attacker type and attack effect. This data is then updated to the network threat sample space, which in turn updates the Bayesian probability of the network threat occurring for subsequent scheduling strategy selection. After determining the attacker type, given that this type of attack has already occurred, its corresponding Bayesian probability is 1. The reward function is recalculated to obtain the updated target reward gain value. The scheduling type with the highest total gain value is selected, and the corresponding executor is scheduled into the system for execution.

[0112] When the system is attacked by a threat, if it can still meet the operating conditions of the heterogeneous redundant system, the current scheduling strategy will be maintained and the abnormal execution body will be cleaned and restored.

[0113] If the conditions required by the mimicry defense system are still not met after the preset number of scheduling attempts, the defense policy is adjusted, and the scheduling strategy is selected based solely on security gain. The security gain of the preselected scheduling type is retrieved, and the security gain under the same attack type is retrieved to obtain the maximum security gain. The scheduling strategy corresponding to this value is set as the optimal executor scheduling strategy, and the executor is scheduled. Meanwhile, actions such as cleaning and recovery are performed on the affected heterogeneous executors to achieve the state before the security attack, and the mimicry adjudication results are continued to be collected.

[0114] In the above embodiment, the optimal scheduling strategy varies based on Bayesian probability, and the Bayesian probability results vary with the actual network environment. During normal system operation, when no security is detected, facing unknown security threats, the Bayesian model integrates the prior probabilities of unknown threats or security with sample information to obtain a maximized reward function, thereby obtaining the optimal mimetic scheduling strategy. This scheduling strategy is then applied to the corresponding heterogeneous executors to perform mimetic defense. Before a network threat occurs, when a feature vector is updated, the Bayesian probability is updated, and the reward gain is recalculated. The optimal scheduling strategy is selected based on the reward gain. When the system is threatened, the mimetic adjudication feedback is analyzed to obtain a description of the attacker type. Based on the actual reward functions of different scheduling types under different attack types, the optimal scheduling type is selected to maximize the reward gain and determine the optimal scheduling type. Changing the optimal scheduling type can achieve the best reward gain, making the defense system more adaptable to the environment. Each device faces a different environment, and different optimal scheduling types are selected based on the environment to achieve the maximum security gain and performance balance.

[0115] In one exemplary embodiment, in combination Figure 3 As shown, Figure 3 FIG. 1 is a flow chart of a method for dynamically scheduling an execution body in an embodiment.

[0116] The mimetic defense system has four heterogeneous executors with a redundancy of 3. The executor run set is 3-module, requiring three scheduled executors. The corresponding preselected scheduling types are S1, S2, S3, and S4. Their security gains are B1, B2, B3, and B4, respectively, and their defense costs are C1, C2, C3, and C4, respectively. Currently, the set of cyber threats in the operational environment includes four types: θ1, θ2, θ3, and θ4. Assume that based on historical information, the prior probability distribution of these cyber threats is p1, p2, p3, and p4. After setting the conditional probabilities, the Bayesian formula can be used to calculate the Bayesian probabilities of each cyber threat: P1, P2, P3, and P4.

[0117] Based on the reward function R = P*(BC), the reward gain values ​​corresponding to each scheduling type are calculated: R(S1|θ1) = P1*(B1-C1), R(S2|θ2) = P2*(B2-C2), R(S3|θ3) = P3*(B3-C3), and R(S4|θ4) = P4*(B4-C4). The reward gain values ​​calculated for each scheduling type under all network threats are summed. The gain values ​​R(S1), R(S2), R(S3), and R(S4) constitute the reward gain X, and their sequence number corresponds to the scheduling type. After the calculation is complete, the scheduling type corresponding to the maximum value in the sequence is selected.

[0118] R(S1)=R(S1|θ1)+R(S1|θ2)+R(S1|θ3)+R(S1|θ4)

[0119] R(S2)=R(S2|θ1)+R(S2|θ2)+R(S2|θ3)+R(S2|θ4)

[0120] R(S3)=R(S3|θ1)+R(S3|θ2)+R(S3|θ3)+R(S3|θ4)

[0121] R(S4)=R(S4|θ1)+R(S4|θ2)+R(S4|θ3)+R(S4|θ4)

[0122] The system needs to schedule three executors. After obtaining the executor number corresponding to the scheduling type with the maximum value, the corresponding executor is selected from the candidate set of executors and assigned to the running set of executors. The running result is then obtained. Under the condition of majority consensus, if the data processing results of two or more executors are consistent, the consistent data processing results are output.

[0123] When the three executors produce consistent data processing results, the existing defense policy and the selected scheduling type are maintained. The network status is monitored. If an element in the feature vector of a network threat is updated, such as when a certain event sign occurs, the conditional probability is updated. This means that if the event sign occurs, the probability of the network threat occurring is also updated. The probability of the network threat is recalculated using the Bayesian formula to obtain a new target return gain. The scheduling type with the highest target return gain is then reselected, and the corresponding executor in that scheduling type is scheduled to the run set. If no elements in the feature vector are updated, the existing executor scheduling status is maintained.

[0124] When one executor's processing result is abnormal but still meets the majority consensus condition, meaning the two executors' processing data results are consistent, the system outputs the same data result after arbitration, cleans and recovers the executor that caused the abnormality, maintains the existing executor scheduling status, updates the threat that caused the executor abnormality to the network threat set, recalculates the Bayesian probability, and updates the reward gain value. If the two executors' processing data results are consistent again, the scheduling type with the largest current value is selected based on the updated value list, and the corresponding executor is scheduled to the running set. The unselected executors are scheduled to the executor alternative set.

[0125] If an executor's processing result is abnormal and does not meet the majority consensus requirement, that is, the data processing results of the three executors differ from each other, the defense strategy is adjusted, and the executor is selected and scheduled based on the security gain. The scheduling type with the highest security gain is selected and the corresponding executor is scheduled to the running set. The unselected executors are cleaned and restored and then scheduled to the backup set. The executors are re-run and the results are judged again.

[0126] It should be understood that, although the steps in the flowcharts of the above embodiments are shown in sequence as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be performed in other orders. Moreover, at least a portion of the steps in the flowcharts of the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily performed at the same time, but can be performed at different times. The execution order of these steps or stages is not necessarily to be performed in sequence, but can be performed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0127] Based on the same inventive concept, embodiments of the present application also provide a device for implementing the aforementioned method for dynamic scheduling of executables. The solution provided by this device is similar to the solution described in the aforementioned method. Therefore, the specific limitations of the one or more embodiments of the Bayesian probability-based dynamic scheduling device provided below can be found in the aforementioned limitations of the method for dynamic scheduling of executables, and will not be further elaborated here.

[0128] In an exemplary embodiment, Figure 4 As shown, a device for executing a dynamic scheduling method is provided, including: an allocation module 410, a probability update module 420, a gain update module 430 and a type determination module 440, wherein:

[0129] The allocation module 410 is configured to calculate a target reward gain value for each preselected scheduling type and select a target scheduling type from the preselected scheduling types based on the target reward gain value; the target reward gain value is obtained based on Bayesian probability.

[0130] The probability updating module 420 is configured to update the Bayesian probability of each attack type when an update of a feature vector representing a network attack is detected.

[0131] The gain updating module 430 is configured to update the target reward gain value according to the updated Bayesian probability.

[0132] The type determination module 440 is configured to obtain a new target scheduling type from the pre-selected scheduling types according to the updated target reward gain value, wherein the target scheduling type is used for dynamically scheduling the execution body.

[0133] In one embodiment, the allocation module further includes:

[0134] The first calculation unit is used to obtain the prior probability of each attack type based on sample data and historical experience of each attack type.

[0135] The second calculation unit is used to respectively calculate the security gain and defense cost of each pre-selected scheduling type under different attack types to obtain a security gain value and a defense cost value.

[0136] The third calculation unit is used to calculate the Bayesian probability according to the prior probability and the new sample data, and calculate the target return gain value of each pre-selected scheduling type according to the Bayesian probability, the safety gain value and the defense cost value.

[0137] In one embodiment, the third calculation unit includes:

[0138] The difference subunit is used to differ the security gain value and the defense cost value to obtain the reward function of each pre-selected scheduling type under different attack types.

[0139] The product subunit is used to calculate the reward gain value of each pre-selected scheduling type under different attack types based on the reward function and Bayesian probability.

[0140] The total gain calculation subunit is used to add the reward gain values ​​of each pre-selected scheduling type under different attack types to obtain the target reward gain value of each pre-selected scheduling type.

[0141] In one embodiment, the apparatus further comprises:

[0142] The arbitration module is used to conduct arbitration based on the output results of each execution body to obtain an arbitration result, and update the target scheduling type according to the arbitration result. Among them, the defense task corresponding to the pre-selected scheduling type is jointly executed by multiple execution bodies.

[0143] In one embodiment, the arbitration module further includes:

[0144] The attack acquisition unit is used to acquire the network attack type when the judgment result does not meet the preset judgment condition.

[0145] The first scheduling type updating unit is used to update the target reward gain value according to the attack type, and to update the target scheduling type according to the updated target reward gain value; the preset judgment condition is that the output results of each execution body are consistent, or the output results of each execution body are inconsistent and the number of execution bodies with inconsistent output results is less than a preset threshold.

[0146] In one embodiment, the arbitration module further includes:

[0147] The second scheduling type updating unit is used to enable each execution body to continue to execute the defense task according to the target scheduling type when the judgment result meets the preset judgment condition.

[0148] In one embodiment, the apparatus further comprises:

[0149] The statistics module is used to count the number of adjustments to the target scheduling type.

[0150] The search module is used to search for the security gain value of each pre-selected scheduling type under the same attack type if the number of adjustments is greater than a preset number.

[0151] The type updating module is used to obtain a new target scheduling type from pre-selected scheduling types based on the safety gain value.

[0152] Each module in the above-mentioned Bayesian probability-based dynamic scheduling device for executing entities can be implemented in whole or in part through software, hardware, or a combination thereof. Each of the above modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0153] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 5As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, abbreviated as I / O) and a communication interface. The processor, memory and input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store historical sample data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a dynamic scheduling method for an execution body is implemented.

[0154] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0155] In an exemplary embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps of any one of the above embodiments when executing the computer program.

[0156] In one embodiment, when the computer program is executed by a processor, the computer program further implements the following steps in any one of the above embodiments.

[0157] In one embodiment, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the steps in any one of the above embodiments are implemented.

[0158] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile memory and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processor involved in the various embodiments provided herein may be, but are not limited to, a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, an artificial intelligence (AI) processor, and the like.

[0159] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0160] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A method for dynamic scheduling of an execution body, characterized in that: The method comprises: Calculating a target reward-gain value for each preselected scheduling type, and selecting a target scheduling type from the preselected scheduling types based on the target reward-gain value; the target reward-gain value is obtained based on the security gain and defense cost combined with Bayesian probability; the Bayesian probability is calculated based on prior probabilities obtained from sample data and historical experience; When the feature vector representing the network attack is updated, the Bayesian probability of each attack type is updated; Updating the target reward gain value according to the updated Bayesian probability; According to the updated target reward gain value, a new target scheduling type is obtained from the pre-selected scheduling types, wherein the target scheduling type is used for dynamically scheduling execution bodies.

2. The method for dynamic scheduling of an executable according to claim 1, characterized in that: Calculating the target reward gain value for each preselected scheduling type includes: Obtaining a priori probabilities of respective attack types based on the sample data and historical experience of respective attack types; Calculating the security gain and the defense cost of each of the preselected scheduling types under different attack types to obtain a security gain value and a defense cost value; The Bayesian probability is calculated according to the prior probability and the sample data, and the target reward gain value of each of the preselected scheduling types is calculated according to the Bayesian probability, the safety gain value, and the defense cost value.

3. The method for dynamic scheduling of an executable according to claim 2, characterized in that: The calculating the target reward gain value of each preselected scheduling type according to the Bayesian probability, the safety gain, and the defense cost includes: Subtracting the security gain value from the defense cost value to obtain a reward function for each of the preselected scheduling types under different attack types; Calculating reward gain values ​​of the preselected scheduling types under different attack types according to the reward function and the Bayesian probability; The reward gain values ​​of each of the preselected scheduling types under different attack types are added together to obtain a target reward gain value of each preselected scheduling type.

4. The method for dynamic scheduling of an executable according to claim 1, characterized in that: The defense task corresponding to the preselected scheduling type is jointly executed by a plurality of execution bodies; after obtaining the new target scheduling type from the preselected scheduling type, the method further includes: A decision result is obtained by making a decision based on the output result of each execution body, and the target scheduling type is updated according to the decision result.

5. The method for dynamic scheduling of an executable according to claim 4, characterized in that: The updating of the target scheduling type according to the arbitration result includes: When the decision result does not meet the preset decision condition, obtaining the network attack type; According to the attack type, the target reward gain value is updated, and the target scheduling type is updated according to the updated target reward gain value; the preset judgment condition is that the output results of each of the executors are consistent, or the output results of each of the executors are inconsistent and the number of the executors with inconsistent output results is less than a preset threshold.

6. The method for dynamic scheduling of an executable according to claim 5, characterized in that: The updating of the target scheduling type according to the arbitration result further includes: When the decision result satisfies the preset decision condition, each of the execution bodies continues to execute the defense task according to the target scheduling type.

7. The method for dynamic scheduling of an executable according to claim 2, characterized in that: After obtaining the new target scheduling type from the preselected scheduling type, the method further includes: Count the number of adjustments to the target scheduling type; If the number of adjustments is greater than a preset number, searching for the security gain value of each of the preselected scheduling types under the same attack type; Based on the safety gain value, the new target scheduling type is obtained from the pre-selected scheduling types.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images