Power grid cloud platform safety and efficiency compatible flow traction model and application thereof

Abstract

The invention discloses a power grid cloud platform safety and efficiency compatible flow traction model and an application thereof, and aims to combine safety and platform efficiency to construct a power flow traction model in a complex environment of multi-cloud coexistence combined operation in power grid cloud platform construction. And the traffic is pulled to a traditional virtual security resource, a Huawei cloud virtual security resource, an Ali cloud virtual security resource or other cloud virtual security resources in combination with a plurality of traffic pulling paths, so that effective utilization and security protection of each cloud virtual security resource are realized. According to the method, a basic drainage model is constructed, and particularly, a hierarchical drainage matrix optimization algorithm is further constructed for practical application, so that multiple optimization can be performed for different targets.

Description

Technical Field

[0001] The present invention relates to digital and information-based smart grid technology, and in particular to a traffic traction model compatible with the security and efficiency of a power grid cloud platform and its application. Background Art

[0002] In terms of cloud platform infrastructure construction, State Grid Corporation has established Huawei Cloud and Alibaba Cloud basic platforms covering 27 provinces, and has basically been able to provide high-performance cloud computing. However, in the process of simultaneously carrying out the construction of cloud platform network security protection capabilities, there are three urgent needs. First, strengthen the construction of self-research capabilities for cloud security protection and build a self-controllable technical system for State Grid cloud security. State Grid Cloud carries key power grid businesses that are related to the national economy and people's livelihood. The safe operation of the cloud platform is the primary prerequisite for the security of power grid business. We must focus on improving the construction of State Grid Cloud network security protection capabilities, ensure the security of basic platforms, businesses and data, and continuously empower new infrastructure and digital transformation. Compared with traditional network security protection, cloud security protection capabilities need to be continuously improved in depth and breadth, which puts higher requirements on the coordination between security components. It is necessary to rely on the capability integration of multiple security technical defense measures, build a unified security technical defense measure capability integration architecture, and uniformly deploy the protection capabilities of multiple security technical defense measures on and off the cloud. At the same time, with the elastic and scalable capabilities of the cloud, it can respond to attack scenarios of different types and scales, realize the full process of network security management and control capabilities of prediction, detection, response, and tracing, and create a larger and more systematic State Grid cloud security adaptive ecosystem. The third is to strengthen the cloud security situation awareness capability and build a linkage defense system under the confrontation mode. With the continuous advancement of the construction of the State Grid cloud platform, data middle platform, and Internet of Things management platform, a large number of business forms, massive data, and heterogeneous terminals have been connected, making the network security boundary tend to be blurred. The cloud platform and the business it carries have gradually become the main targets of attack threats. How to improve the cloud platform's own situation awareness and linkage defense capabilities in the confrontation mode is an important topic in cloud security protection research.

[0003] Especially in recent years, with the construction of the cloud platform of State Grid Corporation of China's new power system company and the continuous migration of business systems to the cloud, the security protection needs of cloud platforms and cloud businesses have continued to increase. The cloud platforms of various units of the company have differences in security protection technical architecture, security component selection and deployment, etc., resulting in inconsistent cloud security protection capabilities among multiple parties, the inability of traditional security protection design architecture to adapt to cloud platforms, and difficulty in achieving coordinated management and control of security protection components, resulting in the lack of key protection capabilities, failure of some protection capabilities, incomplete coverage of protection capabilities, and duplication and redundancy with traditional technical defense systems. There is an urgent need to carry out research on the joint scheduling of security protection resources on and off the cloud to form an adaptive cloud security protection system that meets the coexistence of multi-cloud applications, flexible component deployment, and centralized protection management.

[0004] At present, the development of the cloud platform system by the inventor's project team mainly faces the following challenges in terms of security and efficiency: Inconsistent security protection capabilities of multiple clouds: In a complex environment where multiple clouds coexist and operate in combination, there are differences in security protection components, making it difficult to achieve unified security management and control. The traditional security protection design architecture cannot adapt to the cloud platform: Traditional security protection capabilities and cloud security protection capabilities have not been coordinated and uniformly managed. The technical barriers between security protection components make it impossible to automatically orchestrate security protection capabilities for specific scenarios, and it is difficult to dynamically perceive the global network security situation. It is difficult to achieve coordinated management and control of security protection components: The interface standards of security protection components on and off the cloud are different, traffic cannot be uniformly controlled, and unified orchestration is difficult, making it difficult for security protection components to achieve coordinated management and control.

[0005] To this end, the project team decoupled the capabilities of traditional security protection equipment based on the research points of joint protection on and off the cloud. At the same time, the capabilities of the security components of Alibaba Cloud and Huawei Cloud were unified to establish an adaptive management and control system for security protection on and off the cloud. The current security protection measures are based on hardware or virtualization stacking, and an adaptive cloud security protection system is formed to meet the coexistence of multi-cloud applications, flexible component deployment, and centralized protection management. Through multi-target and multi-path data diversion of security technical defense resources, unified management and control of power grid cloud platform data flows is achieved, improving adaptive security protection capabilities and cloud security operation business support capabilities. This is an important foundation for current technology development and also the top priority of the development sub-item undertaken by the technical team of this invention. Summary of the invention

[0006] The technical problem to be solved by the present invention is to provide a traffic traction model and its application that are compatible with the security and efficiency of a power grid cloud platform, which can achieve unified control of the data flow of the power grid cloud platform through multi-target and multi-path data diversion of security technical defense resources.

[0007] In order to solve the above technical problems, the technical solutions adopted by the present invention are as follows.

[0008] The traffic traction model that is compatible with the security and efficiency of the power grid cloud platform combines security and platform efficiency to build a computing power flow traction model in the complex environment where multiple clouds coexist and operate in combination during the construction of the power grid cloud platform. Combined with multiple traffic traction paths, the traffic is pulled to traditional virtual security resources, Huawei Cloud virtual security resources, Alibaba Cloud virtual security resources, or other cloud virtual security resources, to achieve effective utilization and security protection of various cloud virtual security resources.

[0009] As a preferred technical solution of the present invention, the multiple traffic traction paths include but are not limited to: SDN diversion, API diversion, proxy diversion, micro-proxy diversion and other optional traffic traction paths.

[0010] As a preferred technical solution of the present invention, the initialization settings of different drainage paths in the power grid cloud platform traffic traction model correspond to the basic traffic traction model framework.

[0011] As a preferred technical solution of the present invention, the basic traffic traction model framework specifically includes: the SDN diversion utilizes the centralized control and flexible programmable characteristics of the software-defined network, and accurately guides specific traffic to the target virtual security resource by issuing flow table rules through the controller; when network traffic from a pre-set area or with pre-set characteristics is detected, the SDN controller adjusts the flow table to divert it to the pre-set virtual security resources of Huawei Cloud or Alibaba Cloud for processing; the proxy diversion deploys a proxy server in the network to analyze and screen the traffic and guide the qualified traffic to the corresponding virtual security resource according to the preset data rules; for the traffic that requires deep detection, it is diverted to the pre-set traditional virtual security resource with advanced detection function through the proxy; the API Traffic diversion uses application programming interfaces to achieve interaction with different security systems and virtual security resources; dynamic allocation and guidance of traffic is achieved by calling APIs; when the security monitoring system detects abnormal traffic, it diverts it to pre-set virtual security resources with specific protection capabilities through API instructions; the micro-agent diversion uses lightweight micro-agents to perform preliminary screening and guidance of traffic at the terminal or network edge, and guides it to the corresponding virtual security resources by judging the nature and needs of the traffic.

[0012] The power grid cloud platform traffic traction method represents the various characteristics of the data traffic of the power grid cloud platform with a vector based on the traffic traction model. This vector can be named as the traffic feature vector. The traffic feature vector contains the source IP address, destination IP address, protocol type, traffic size and other data information of different dimensions. Furthermore, for each specific diversion path, a data module is constructed to make decisions based on traffic characteristics. Among them, SDN diversion, API diversion, proxy diversion, micro-diversion and other subsequent diversion paths are all determined by the corresponding data modules based on traffic characteristics to decide whether to adopt this diversion method. Then, the decisions on the diversion methods are combined to form a diversion matrix containing weight parameter data for each diversion method. This diversion matrix directly numerically represents the target diversion direction. Furthermore, the iterative optimization of the diversion matrix (or equivalently returning to the adjustment and optimization of the relevant data modules) corresponds to the iterative optimization of traffic traction.

[0013] As a preferred technical solution of the present invention, the traffic feature vector, in addition to the source IP address, destination IP address, protocol type, and traffic size, also includes: a. time distribution characteristics of the traffic: traffic peak and mean values ​​in different time periods; b. flow direction characteristics of the traffic: the ratio of inflow and outflow; c. application type characteristics of the traffic: video streaming, file transfer streaming, web browsing, and other data stream types.

[0014] As a preferred technical solution of the present invention, for each diversion scheme, the specific construction of its diversion function is not only based on the traffic characteristics, but also optionally incorporates the load conditions of various virtual security resources in the current network, the priority of the security policy, and the historical diversion effect data factors as needed; the SDN diversion function dynamically adjusts the diversion strategy according to the network link congestion monitored by the SDN controller; the API diversion function decides whether to use the API method for diversion according to the priority rules set in the security policy data.

[0015] As a preferred technical solution of the present invention, in terms of data, the diversion matrix is ​​constructed as a weighted representation architecture under multiple factors, and the matching degree of traffic characteristics is assigned a weight w1, the load condition of virtual security resources is assigned a weight w2, and the priority of security policies is assigned a weight w3. The final diversion matrix is ​​obtained through weighted calculation; the iterative optimization of the diversion matrix corresponds to the iterative optimization of traffic traction.

[0016] As a preferred technical solution of the present invention, for the optimization of the drainage matrix, an optimization method that can simultaneously consider multiple objectives is constructed to achieve the optimization of the drainage matrix and determine the final drainage method to achieve the optimization of the drainage matrix.

[0017] As a preferred technical solution of the present invention, for the optimization of the drainage matrix, on the basis of the initially constructed optimization algorithm, other optimization algorithms for different objectives are secondary constructed to perform multiple optimizations, so as to realize the adjustable and / or customized solution output of the traffic traction of the power grid cloud platform.

[0018] The beneficial effect of adopting the above technical solution is that: the present invention not only constructs a basic drainage model, but also further constructs a hierarchical drainage matrix optimization algorithm for practical applications, which can perform multiple optimizations for different goals and realize the adjustable and customized solution output of traffic traction on the power grid cloud platform; the DIESO algorithm and MCGODS algorithm are both the first creations of the technical team and have high application value.

[0019] Our traffic diversion model is fully compatible with the current development trend, that is, Alibaba Cloud, Huawei Cloud and other security components are uniformly managed in the power grid cloud platform, and an adaptive management and control system for security protection on and off the cloud is established to form an adaptive cloud security protection system that meets the coexistence of multi-cloud applications, flexible component deployment, and centralized protection management. Based on this data status, we have achieved unified management and control of data flows on the power grid cloud platform through multi-target and multi-path data diversion of various security technical defense resources, effectively improving the adaptive security protection capabilities and the support capabilities of cloud security operation services.

[0020] The technical development based on the present invention can effectively enhance the data security of the power grid cloud platform. The key is that we are aiming at self-developed protection capabilities, building an autonomous and controllable technical system for power grid enterprises, and independently and effectively ensuring the security of the basic platform, business and data of the power grid cloud, reducing dependence on external technologies, and enhancing the power grid's ability to resist and independently recover from network attacks. DETAILED DESCRIPTION

[0021] The following examples describe the present invention in detail. In the description of the following examples, specific details such as specific system structures, technologies, etc. are proposed for illustration rather than limitation, so as to provide a thorough understanding of the present application embodiments. However, it should be clear to those skilled in the art that the present application can also be implemented in other embodiments without these specific details. In other cases, the detailed description of well-known systems, devices, circuits and methods is omitted to prevent unnecessary details from hindering the description of the present application.

[0022] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0023] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0024] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0025] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0026] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0027] Example 1: Drainage Model At present, in the power grid cloud platform architecture, in the complex environment where multiple clouds coexist and operate in combination, there are differences in security protection components, making it difficult to achieve unified security management and control. In addition, the traditional security protection design architecture cannot adapt to the cloud platform, and the traditional security protection capabilities and cloud security protection capabilities have not achieved coordination and unified management and control. The technical barriers between security protection components have led to the inability to automatically orchestrate security protection capabilities for scenarios, and it is difficult to dynamically perceive the global network security situation. To this end, the project team decoupled the capabilities of traditional security protection equipment based on the key points of joint protection research on the cloud and off-cloud. At the same time, the capabilities of the security components of Alibaba Cloud and Huawei Cloud were unified, and an adaptive management and control system for security protection on and off-cloud was established. The current security protection measures are based on hardware or virtualization stacking protection methods, forming an adaptive cloud security protection system that meets the coexistence of multi-cloud applications, flexible component deployment, and centralized protection management and control. The unified management and control of the data flow of the power grid cloud platform is achieved through multi-target and multi-path data diversion of security technical defense resources. The dominant technical route is to combine multiple traffic traction solutions such as SDN diversion, API diversion, proxy diversion and micro-agent diversion to divert data traffic under the power grid cloud architecture to traditional virtual security resources, Huawei Cloud, Alibaba Cloud and other virtual security resources to achieve effective utilization and security protection of various virtual security resources.

[0028] Based on the above basic route architecture, the centralized control and flexible programmability of SDN are used to issue flow table rules through the controller to accurately guide specific traffic to the target virtual security resources. When network traffic from a specific area or with specific characteristics is detected, the SDN controller quickly adjusts the flow table and directs it to the virtual security resources of Huawei Cloud or Alibaba Cloud for processing. With the help of API, interaction with different security systems and virtual security resources is realized. By calling API, dynamic allocation and guidance of traffic is realized. When the security monitoring system finds abnormal traffic, it is directed to the virtual security resources with specific protection capabilities through API instructions. For traffic that requires deep detection, it is directed to traditional virtual security resources with advanced detection functions through agents (deploy proxy servers in the network to analyze and filter traffic, and guide qualified traffic to the corresponding virtual security resources according to preset policies). At the same time, set up lightweight micro-agents to perform preliminary screening and guidance of traffic at the terminal or network edge to quickly determine the nature and needs of traffic and guide it to the most appropriate virtual security resources (which can further improve response speed and resource utilization efficiency).

[0029] Example 2: Drainage method Based on the above infrastructure, considering the digital scenario of the application side, the various characteristics of the data flow of the power grid cloud platform can be represented by a vector, which can be named the flow feature vector; our idea is that the flow traction model can be inferred through the combination of multiple flow traction and virtual security resources, so here we can make intelligent choices according to the flow migration vector. The flow feature vector not only contains common basic information such as source IP address, destination IP address, protocol type, flow size, but also includes the time distribution characteristics of the flow (such as flow peak and mean in different time periods), flow direction characteristics (such as the ratio of inflow and outflow), and application type characteristics of the flow (such as video streaming, file transfer or web browsing). For each specific diversion path, a data module (diversion function) is constructed to make decisions based on traffic characteristics. SDN diversion, API diversion, proxy diversion, micro-diversion and other subsequently added diversion paths are all decided by the corresponding data modules based on traffic characteristics to decide whether to adopt this diversion method. When constructing the diversion function for specific decision-making, not only decisions are made based on traffic characteristics, but also factors such as the load of each virtual security resource in the current network, the priority of security policies, and historical diversion effects are considered; for the SDN diversion function, the diversion strategy will be dynamically adjusted according to the network link congestion monitored by the SDN controller; the API diversion function will decide whether to use the API method for diversion first according to the priority rules set in the security policy management system. The decisions on the diversion methods are combined to form a diversion matrix that contains the weight parameter data for each diversion method (the construction of the diversion decision matrix will comprehensively consider the weights of various factors, assigning weight w1 to the matching degree of traffic characteristics, weight w2 to the load of virtual security resources, and weight w3 to the priority of security policies, and the final diversion decision matrix is ​​obtained through weighted calculation); this diversion matrix directly numerically represents the target diversion direction. At the same time, the iterative optimization of the diversion matrix (or the equivalent return to the adjustment and optimization of related data modules) corresponds to the iterative optimization of traffic traction.

[0030] Example 3, drainage application scenario - A In this scenario, the final drainage method (basic feasible solution) is determined by comprehensively considering resource utilization efficiency, security protection effect and other aspects.

[0031] Specifically, it corresponds to a 3+2 model: three traffic diversion modes + two data targets.

[0032] There are three traffic diversion methods: SDN diversion (method A), API diversion (method B) and proxy diversion (method C).

[0033] At the same time, two data targets are defined: resource utilization efficiency (expressed as a percentage) and security protection effectiveness (expressed as a score of 1 - 10).

[0034] The following data was collected: Method A: The resource utilization efficiency is 80% and the safety protection effect score is 7 points.

[0035] Method B: The resource utilization efficiency is 70% and the safety protection effect score is 8 points.

[0036] Method C: The resource utilization efficiency is 75% and the safety protection effect score is 7.5 points.

[0037] Algorithm idea: For method A, if there is another drainage method that can achieve a resource utilization efficiency of no less than 80% and a security protection effect score higher than 7 points, then method A is not the optimal solution.

[0038] For method B, if there is another drainage method that can achieve a resource utilization efficiency of no less than 70% and a security protection effect score higher than 8 points, then method B is not the optimal solution.

[0039] For method C, if there is another drainage method that can achieve a resource utilization efficiency of no less than 75% and a security protection effect score higher than 7.5 points, then method C is not the optimal solution.

[0040] Assume that after comparison, it is found that method A and method B are relatively optimal. Then, next, you can choose between these two optimal solutions based on your own preferences for resource utilization efficiency and security protection effect.

[0041] If you value security protection more, choose method B; if you value resource utilization efficiency more, choose method A.

[0042] Following this line of thought, the secondary algorithm can be constructed as follows: If the decision maker believes that the importance of security protection effect is twice that of resource utilization efficiency, then the weight of security protection effect can be set to 2 and the weight of resource utilization efficiency can be set to 1; at this time, the comprehensive score of each solution is calculated: The total score of method A = 1 * 80% + 2 * 7 = 22 The total score of method B = 1 * 70% + 2 * 8 = 23 At this time, according to the comprehensive score, method B is selected as the final drainage method.

[0043] Example 4, drainage application scenario - B In this scenario, we combine various traffic diversion solutions such as SDN diversion, API diversion, proxy diversion, and micro-proxy diversion to divert traffic to traditional virtual security resources, Huawei Cloud, Alibaba Cloud and other virtual security resources, to achieve effective utilization and security protection of various virtual security resources.

[0044] At this point, there are four ways to divert traffic: SDN diversion (method A), API diversion (method B), proxy diversion (method C) and micro-proxy diversion (method D); we consider diverting traffic to three virtual security resources: traditional virtual security resources (resource 1), Huawei Cloud (resource 2), and Alibaba Cloud (resource 3); define three goals: resource utilization efficiency (expressed as a percentage), security protection effect (expressed as a score of 110) and diversion cost (expressed as a specific amount).

[0045] The data collected are as follows: Method A diverts traffic to resource 1: the resource utilization efficiency is 75%, the security protection effect score is 7 points, and the diversion cost is 500 yuan; Method A diverts traffic to resource 2: the resource utilization efficiency is 80%, the security protection effect score is 8 points, and the diversion cost is 600 yuan; Method A diverts traffic to resource 3: the resource utilization efficiency is 78%, the security protection effect score is 7.5 points, and the diversion cost is 550 yuan; Method B diverts traffic to resource 1: the resource utilization efficiency is 70%, the security protection effect score is 6 points, and the diversion cost is 450 yuan; Method B diverts traffic to resource 2: the resource utilization efficiency is 78%, the security protection effect score is 7 points, and the diversion cost is 500 yuan; Method B diverts traffic to resource 3: the resource utilization efficiency is 75%, the security protection effect score is 6.5 points, and the diversion cost is 480 yuan; Method C diverts traffic to resource 1: the resource utilization efficiency is 68%, the security protection effect score is 6 points, and the diversion cost is 400 yuan; Method C diverts traffic to resource 2: the resource utilization efficiency is 72%, the security protection effect score is 7 points, and the diversion cost is 450 yuan; Method C diverts traffic to resource 3: the resource utilization efficiency is 70%, the security protection effect score is 6.5 points, and the diversion cost is 420 yuan; Method D diverts traffic to resource 1: the resource utilization efficiency is 72%, the security protection effect score is 6.5 points, and the diversion cost is 420 yuan; Method D diverts traffic to resource 2: the resource utilization efficiency is 76%, the security protection effect score is 7 points, and the diversion cost is 480 yuan; Method D diverts traffic to resource 3: the resource utilization efficiency is 74%, the security protection effect score is 6.8 points, and the diversion cost is 450 yuan; First, determine which combinations constitute the relatively optimal solution; the combination of method A directing traffic to resource 2 is the relatively optimal solution if there is no other combination of directing traffic and resources that can achieve a resource utilization efficiency of not less than 80%, a security protection effect score of not less than 8 points, and a directing cost of not more than 600 yuan while performing better on at least one goal; after comparison and screening, it is assumed that method A directing traffic to resource 2, method B directing traffic to resource 3, and method D directing traffic to resource 2 are the relatively optimal solutions.

[0046] Next, determine the final choice based on preference; if the decision is that the importance of resource utilization efficiency is 0.4, the importance of security protection effect is 0.4, and the importance of drainage cost is 0.2; calculate the comprehensive score of each optimal solution: The comprehensive score of method A to resource 2 = 0.4*80% + 0.4*8 + 0.2*600 = 32 + 3.2 + 120 = 155.2 The comprehensive score of method B to resource 3 = 0.4*75%+0.4*6.5+0.2*480=30+2.6+96=128.6 The comprehensive score of method D to resource 2 = 0.4*76%+0.4*7+0.2*480=30.4+2.8+96=129.2 According to the comprehensive score, method A is selected to divert traffic to resource 2 as the final diversion method.

[0047] Example 5, drainage application scenario - C The technical team of this application has developed a new algorithm (DIESO algorithm) to confirm the importance of resource utilization efficiency, the importance of security protection effect, and the importance of drainage cost. The three parameters of the self-optimization algorithm are coordinated with the entire drainage matrix data system constructed above (many relevant parameters of the associated data model). Specifically, a dynamic importance evaluation and self-optimization algorithm, referred to as the DIESO algorithm, was constructed (we named the English name of the algorithm Dynamic Importance Evaluation and Self-optimization Algorithm).

[0048] Regarding the DIESO algorithm, the historical drainage data is first initialized, including resource utilization efficiency, security protection effect and drainage cost data of different drainage methods on different virtual security resources, as well as relevant information on business needs and environmental changes. The algorithm steps include: assigning initial importance weights to resource utilization efficiency, security protection effect and drainage cost, which can be set to 0.3, 0.3, and 0.4 respectively; on the basis of continuous collection of drainage data and statistical analysis, calculating the impact of changes in resource utilization efficiency, security protection effect and drainage cost on business goals (business stability, cost control, user satisfaction, etc.) in different time periods, and adjusting the importance weight according to the following rules based on the data analysis results: if the business is seriously hindered or the cost increases significantly due to low resource utilization efficiency in a certain period of time, increase its weight; if the poor security protection effect leads to security accidents or data leakage, increase the weight of the security protection effect; if the drainage cost is too high and seriously affects the project budget, reduce its weight; among them, the adjustment range can be determined according to the degree of impact (linear or nonlinear adjustment functions can be used). At the same time, the self-optimization balance is also considered: on the one hand, it ensures that the sum of the adjusted weights is always 1 to maintain the rationality and comparability of the weights; and further introduces a balancing mechanism by setting upper and lower limits of the weights to avoid a certain weight being too large or too small.

[0049] Example 6, drainage application scenario - D Furthermore, we have independently developed the following "magnetic field algorithm", MCGODS algorithm. The algorithm idea is: for the three elements of resource utilization efficiency, safety protection effect, and drainage cost, a certain magnetic charge is assigned to each of them. The three different elements have different types of magnetic charges, and the number of magnetic charges is also adjustable; at the same time, a magnetic field is constructed in the entire data environment. This magnetic field will produce different forces for different types of magnetic charges. Then, through the adjustment of the magnetic field and its force on different magnetic charges, these elements carrying magnetic charges can have a specific flow tendency in the data space. Then, we only need to set a "data pocket" at a specific location in the data space according to the current needs of power grid cloud security and traffic traction, and the data solution that finally flows into the above-mentioned "data pocket" will be the optimal data solution; and in different environments, the position of the data pocket can be adjusted as needed.

[0050] Specifically, the following algorithm was obtained: Magnetic Charge Guided Optimal Data Solution Algorithm (MCGODS algorithm for short). The algorithm steps include: Element magnetic charge setting: positive magnetic charge is assigned to the importance of resource utilization efficiency, and the initial value of the magnetic charge is set to Q1, which can be adjusted within a certain range; negative magnetic charge is assigned to the importance of safety protection effect, and the initial value of the magnetic charge is set to Q2, which can be adjusted within a certain range; neutral magnetic charge is assigned to the importance of drainage cost, and the initial value of the magnetic charge is set to Q3, which can be adjusted within a certain range; Magnetic field construction: Initialize and construct a three-dimensional data space, and construct a magnetic field in this space; the magnetic field strength B is a function related to the spatial position, that is, B(x, y, z); for positive magnetic charge, the magnetic field produces an attractive force; for negative magnetic charge, the magnetic field produces a repulsive force; for neutral magnetic charge, the magnetic field produces a weak but adjustable force; Magnetic charge movement and data flow: Based on the effect of the magnetic field and the type of magnetic charge, the elements represented by the magnetic charge move and flow in the data space; the direction and speed of movement are affected by the strength of the magnetic field, the amount of magnetic charge, and the type of magnetic charge; Data pocket setting and optimal solution determination: According to the current grid cloud security and traffic traction requirements, determine the location of the data pocket in the data space (x p ,y p ,z p ); and, as demand changes, the location of the data pocket can be adjusted as needed; after a period of magnetic charge movement and data flow, the data solution represented by the magnetic charge combination that finally flows into the data pocket is determined as the optimal data solution (or as a candidate optimal solution).

[0051] We believe (objectively and factually) that the MCGODS algorithm has broad application value. In specific applications, we have conducted generalized data analysis and simulation verification based on the specific requirements of power grid cloud security and traffic traction and their impact on the location of data pockets.

[0052] Generally speaking, the specific needs of power grid cloud security and traffic traction will significantly affect the location of data pockets in the following ways: if the current demand focuses on resource utilization efficiency, the location of the data pocket may be closer to the area of ​​the magnetic charge movement trajectory representing resource utilization efficiency; if you want to maximize resource utilization efficiency while ensuring a certain security protection effect and acceptable drainage cost, the data pocket can be considered to be set at a location where the resource utilization efficiency magnetic charge is easy to reach and relatively concentrated; if the focus is on improving the security protection effect, the data pocket can be considered to be placed in an active area closer to the security protection effect magnetic charge; in the face of high-risk cyber attack threats, the data pocket is more inclined to collect locations where magnetic charge combinations that give security protection effects a higher importance; and when drainage cost becomes a key limiting factor, the data pocket location will be close to the area where the drainage cost magnetic charge movement is relatively stable and low; when the budget is tight, the data pocket will be more inclined to capture locations that emphasize drainage cost control.

[0053] There is another common possibility, that is, if the demand is to find a balance among the three, the location of the data pocket can be considered to be in a relatively central position, which can simultaneously accommodate a reasonable combination of different magnetic charges; in the stable operation stage of the power grid cloud business, it is hoped that resources will not be excessively wasted while ensuring a certain level of safety and controlling costs at the same time. At this time, the data pocket will be located in a moderate position that can comprehensively attract these three magnetic charges.

[0054] In addition, the application can also perform secondary modeling of data pockets, that is, build a database to collect the optimal locations of data pockets and the corresponding element flows under different environments and fix them into a specific model for direct later use (or as a reference for data analysis, etc.).

[0055] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0056] In various embodiments, the hardware implementation of the technology can directly adopt existing intelligent devices, including but not limited to industrial computers, PCs, smart phones, handheld stand-alone computers, floor-standing stand-alone computers, etc. Its input device preferably adopts a screen keyboard, its data storage and calculation module adopts existing memory, calculator, controller, its internal communication module adopts existing communication ports and protocols, and its remote communication adopts existing GPRS network, World Wide Internet, etc.

[0057] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0058] In the embodiments provided by the present invention, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms. The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0059] Each functional unit in each embodiment of the present invention may be integrated into a processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of a software functional unit. If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and may also instruct the relevant hardware to complete it through a computer program. The computer program may be stored in a computer-readable storage medium, and the computer program may be executed by the processor to implement the steps of the above-mentioned method embodiments. Among them, the computer program includes computer program code, and the computer program code may be in the form of source code, object code, executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media does not include electrical carrier signals and telecommunications signals.

[0060] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A traffic traction model that is compatible with the security and efficiency of the power grid cloud platform. In the complex environment of coexistence and combined operation of multiple clouds in the construction of the power grid cloud platform, a traction model for computing power flow is constructed by combining security and platform efficiency. It is characterized by: Combine multiple traffic traction paths to steer traffic to traditional virtual security resources, Huawei Cloud virtual security resources, Alibaba Cloud virtual security resources, or other cloud virtual security resources, to achieve effective utilization and security protection of various cloud virtual security resources.

2. The traffic traction model compatible with the security and efficiency of the power grid cloud platform according to claim 1 is characterized by: The multiple traffic traction paths include but are not limited to: SDN diversion, API diversion, proxy diversion, micro-proxy diversion and other optional traffic traction paths.

3. The traffic traction model compatible with the security and efficiency of the power grid cloud platform according to claim 1 is characterized by: The initialization settings of different diversion paths in the traffic traction model of the power grid cloud platform correspond to the basic traffic traction model framework.

4. The traffic traction model compatible with the security and efficiency of the power grid cloud platform according to claim 3 is characterized by: The basic traffic traction model framework specifically includes: the SDN diversion utilizes the centralized control and flexible programmable characteristics of the software-defined network, and accurately guides specific traffic to the target virtual security resource by issuing flow table rules through the controller; when detecting network traffic from a pre-set area or with pre-set characteristics, the SDN controller adjusts the flow table to divert it to the pre-set virtual security resources of Huawei Cloud or Alibaba Cloud for processing; the proxy diversion deploys a proxy server in the network to analyze and screen the traffic and guide the qualified traffic to the corresponding virtual security resource according to the preset data rules; for the traffic that requires deep detection, it is diverted to the pre-set traditional virtual security resource with advanced detection function through the proxy; the API diversion uses the application programming interface to realize the interaction with different security systems and virtual security resources; the dynamic allocation and guidance of traffic is realized by calling the API; when the security monitoring system finds abnormal traffic, it is diverted to the pre-set virtual security resource with specific protection capabilities through API instructions; the micro-agent diversion uses a lightweight micro-agent to perform preliminary screening and guidance of traffic at the terminal or network edge and guide it to the corresponding virtual security resource by judging the nature and needs of the traffic.

5. A method for traction of traffic on a power grid cloud platform, characterized in that: Based on the traffic traction model in claims 1-4, various characteristics of the data traffic of the power grid cloud platform are represented by a vector, which can be named a traffic feature vector; the traffic feature vector contains source IP address, destination IP address, protocol type, traffic size and other data information of different dimensions. Furthermore, for each specific drainage path, a data module for making decisions based on traffic characteristics is constructed respectively, wherein SDN drainage, API drainage, proxy drainage and micro drainage and other subsequently added drainage paths are all determined by the corresponding data modules based on traffic characteristics to decide whether to adopt this drainage method, and then the decisions on the drainage methods are combined to form a drainage matrix containing weight parameter data for each drainage method. This drainage matrix directly numerically represents the target drainage direction. At the same time, the iterative optimization of the drainage matrix (or the equivalent return to the adjustment and optimization of the relevant data modules) corresponds to the iterative optimization of traffic traction.

6. The method for pulling traffic from a power grid cloud platform according to claim 5, characterized in that: In addition to the source IP address, destination IP address, protocol type, and traffic size, the traffic feature vector also includes: a. time distribution characteristics of traffic: traffic peak and mean values ​​in different time periods; b. direction characteristics of traffic: the ratio of inflow and outflow; c. application type characteristics of traffic: video streaming, file transfer streaming, web browsing, and other data stream types.

7. The method for pulling traffic from a power grid cloud platform according to claim 5, characterized in that: For each diversion scheme, the specific construction of its diversion function is not only based on the traffic characteristics, but also optionally incorporates the load conditions of each virtual security resource in the current network, the priority of the security policy, and the historical diversion effect data factors as needed; the SDN diversion function dynamically adjusts the diversion strategy according to the network link congestion monitored by the SDN controller; the API diversion function decides whether to use the API method for diversion based on the priority rules set in the security policy data.

8. The method for pulling traffic from a power grid cloud platform according to claim 5, characterized in that: At the initial data level, the diversion matrix is ​​constructed as a weight representation architecture under multiple factors. The matching degree of traffic characteristics is assigned weight w1, the load of virtual security resources is assigned weight w2, and the priority of security policies is assigned weight w3. The final diversion matrix is ​​obtained through weighted calculation. The iterative optimization of the diversion matrix corresponds to the iterative optimization of traffic traction.

9. The method for pulling traffic from a power grid cloud platform according to claim 8, characterized in that: For the optimization of the drainage matrix, an optimization method is constructed that can simultaneously consider multiple objectives to achieve the optimization of the drainage matrix and determine the final drainage method to achieve the optimization of the drainage matrix.

10. The method for pulling traffic from a power grid cloud platform according to claim 9, characterized in that: For the optimization of the traffic diversion matrix, based on the initially constructed optimization algorithm, other optimization algorithms for different objectives are constructed for multiple optimizations to achieve adjustable and / or customized solution output for traffic traction on the power grid cloud platform.