Security service chain mapping method, electronic equipment and storage medium

Abstract

The invention provides a security service chain mapping method, electronic equipment and a storage medium. The method comprises the following steps: determining security equipment sets meeting requirements based on equipment resource requirements of security function nodes in a security service chain; based on a link resource demand between two adjacent security function nodes, determining a physical link set meeting requirements between a single security device in a corresponding security device set and a single security device in an adjacent security device set; numbering the security devices in each security device set and the physical links in each physical link set; generating a plurality of security service mapping paths to form an initial population, wherein the security service mapping paths comprise a plurality of triads which are arranged in sequence and are formed by head equipment numbers, tail equipment numbers and inter-equipment link numbers; and determining a fitness function by integrating the total equipment number, the average equipment load degree and the average path load degree of the security service mapping path, and performing security service mapping path optimization on initial population iteration based on a genetic algorithm.

Description

Technical Field

[0001] The present invention relates to the field of security service chains, and in particular to a security service chain mapping method, electronic equipment and storage medium. Background Art

[0002] With the development of network technology, network equipment covers more and more fields, network environment is becoming more and more complex, various network attack methods are becoming more and more advanced, and a single security function can no longer cope with complex and hidden network attacks. Existing network systems usually need to jointly deploy multiple security devices such as firewalls, intrusion detection systems, intrusion prevention systems, security audit systems, etc. Different network traffic characteristics lead to different corresponding security protection requirements, which in turn leads to different security service chains, that is, sequences composed of multiple security function nodes.

[0003] The traditional rigid network security defense architecture cannot flexibly arrange security devices on demand and cannot meet the different security service chain requirements. Through the combination of software-defined networking (SDN) and network function virtualization (NFV), network traffic can be redirected, and network traffic can be quickly and flexibly pulled through the required security device sequence for security protection to meet the diverse security service chain requirements. The implementation of the security service chain can be roughly divided into two steps: chain formation and mapping. The chain formation process of the security service chain is to orchestrate the logical sequence relationship between the required multiple security function nodes to form a security function node sequence; the mapping process refers to mapping the virtual security function node sequence to a physical link of the underlying physical network. The physical security devices in the physical link can meet the corresponding security function type and computing resource requirements, and the physical link should meet the bandwidth resource requirements.

[0004] The prior art usually maps the functional nodes and links of the security service chain separately, first selects the optimal physical security device according to the device resource requirements of each serial number security function node in the security service chain, and then selects the optimal physical link between the aforementioned selected physical security devices according to the link resource requirements between each security function node in the security service chain. However, in an actual physical network, the performance of the optimal physical link L1 between the optimal security device A and the optimal security device B may be far worse than the optimal physical link L2 between the suboptimal security device C and the suboptimal security device D. The prior art maps the functional nodes and links of the security service chain separately, without considering the comprehensive performance of the security device and the link, which will result in the mapped security service chain solution not being the optimal solution. There are also technical solutions in the prior art for mapping functional nodes and links at the same time, but the security service chain is usually divided into multiple sections for sequential mapping, first mapping the first section of the service subchain to the security device with the best comprehensive performance and the link solution between the devices, and then mapping the next section of the service subchain according to the determined first section mapping solution, which actually still does not consider the comprehensive performance of the overall mapping solution. Summary of the invention

[0005] The purpose of the present invention is to solve the above-mentioned problems in the prior art, and to provide a security service chain mapping method, an electronic device and a storage medium.

[0006] In a first aspect, the present invention provides a security service chain mapping method, the method comprising: A security service chain mapping method, characterized by comprising: S1, based on the equipment resource requirements of each security function node in the security service chain, determine the set of security devices Di that meet the requirements in the physical security defense structure, i∈(1,2,…,m), where m represents the number of security function nodes in the security service chain; S2, taking the two security device sets corresponding to every two adjacent security function nodes in the security service chain as a security device set group, and based on the link resource requirements between the two adjacent security function nodes, determining the physical link set Lix,jy that meets the requirements between a single security device in one security device set and a single security device in another security device set in the corresponding security device set group, j∈(1,2,…,m) and j=i+1, x∈(1,2,…,ni), ni represents the number of security devices in the security device set Di, y∈(1,2,…,nj), nj represents the number of security devices in the security device set Dj; S3, numbering the security devices in each security device set and numbering the physical links in each physical link set; S4, generate several security service mapping paths to form an initial population, the security service mapping paths include several triplets consisting of a first device number, a last device number, and an inter-device link number arranged in sequence; the security service mapping paths meet the following constraints: the first device number of the i-th triplet belongs to the number set corresponding to the security device set Di, the last device number of the i-th triplet belongs to the number set corresponding to the security device set Dj, and the inter-device link number of the i-th triplet belongs to the number set corresponding to the physical link set Lix,jy; the first device number of a single triplet is the same as the last device number of its previous adjacent triplet, and the last device number of a single triplet is the same as the first device number of its subsequent adjacent triplet; S5, comprehensively considers the total number of devices, average device load, and average path load of the security service mapping path to determine the fitness function, and iterates the initial population based on the genetic algorithm to optimize the fitness of the security service mapping path to determine the final security service mapping path; the security service mapping path in the genetic algorithm changes when it meets the constraints.

[0007] Preferably, the total number of devices is the sum of the number of security devices on the security service mapping path and the number of transit devices on the links between each security device; the average device load is the average of the ratios of occupied resources to total resources of all devices on the security service mapping path; the average path load is the average of the ratios of occupied bandwidth to total bandwidth of all links on the security service mapping path.

[0008] Preferably, the numbering of the security devices in the single security device set in S3 includes: calculating the weight of each security device in the single security device set, and numbering them in ascending order of weight; the weight of each security device in the single security device set is ,in , , is the weight set on demand, Indicates the ratio of the resources occupied by the security device to the total resources, represents the average number of transit devices on all links between the safety device x in the safety device set Di and all safety devices in the safety device set Di-1, represents the average number of transit devices on all links between the safety device x in the safety device set Di and all safety devices in the safety device set Di+1, represents the average bandwidth occupancy rate of all links between the security device x in the security device set Di and all security devices in the security device set Di-1, It represents the average bandwidth occupancy rate of all links between the security device x in the security device set Di and all the security devices in the security device set Di+1; in S4, an initial population is generated based on several numbers in the previous order.

[0009] Preferably, the numbering of the physical links in a single physical link set in S4 includes: calculating the weight of each physical link in the single physical link set, and numbering them in descending order according to the weight; the weight of the single physical link is the average of the ratios of the occupied bandwidth of all sub-links therein to the total bandwidth; and generating an initial population based on several numbers in the front order in S4.

[0010] In a second aspect, the present invention provides an electronic device, including a memory, a computer program stored thereon, and a processor, wherein the processor implements the above-mentioned security service chain mapping method when executing the computer program.

[0011] In a third aspect, the present invention provides a storage medium storing computer executable instructions, which, when loaded and executed by a processor, implement the above-mentioned security service chain mapping method.

[0012] In summary, the present invention has the following beneficial effects: a security service mapping path is represented by a plurality of triplets consisting of a first device number, a last device number, and an inter-device link number arranged in sequence, thereby expanding the optimization space of the genetic algorithm. The fitness function is determined by comprehensively considering the total number of devices, the average device load, and the average path load of the security service mapping path, and the comprehensive performance of the devices and paths of the security service mapping path is considered, which is conducive to finding a security service mapping path with better comprehensive performance.

[0013] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0015] Figure 1 This is a schematic diagram of the process of an embodiment of the present application. DETAILED DESCRIPTION

[0016] In order to enable those skilled in the art to better understand the technical solution of the present disclosure, and to fully understand and implement how the present disclosure applies technical means to solve technical problems and achieve the corresponding technical effects, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only embodiments of a part of the present disclosure, not all of the embodiments. The embodiments of the present disclosure and the various features in the embodiments can be combined with each other without conflict, and the technical solutions formed are all within the scope of protection of the present disclosure. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work should fall within the scope of protection of the present disclosure.

[0017] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, device, product or equipment that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0018] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer device such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0019] The present application embodiment provides a security service chain mapping method, such as Figure 1 As shown, including S1, based on the device resource requirements of each security function node in the security service chain, correspondingly determining the set of security devices Di that meet the requirements in the physical security defense structure, i∈(1,2,…,m), m represents the number of security function nodes in the security service chain. The device resource requirements may include the security function type requirements and computing resource requirements and / or storage resource requirements for the physical security devices in the underlying physical security defense network.

[0020] like Figure 1As shown, the method of the present application also includes S2, taking the two security device sets corresponding to every two adjacent security function nodes in the security service chain as a security device set group, and determining the physical link set Lix,jy that meets the requirements between a single security device in one security device set and a single security device in another security device set in the corresponding security device set group based on the link resource requirements between the two adjacent security function nodes, j∈(1,2,……,m) and j=i+1, x∈(1,2,……,ni), ni represents the number of security devices in the security device set Di, y∈(1,2,……,nj), nj represents the number of security devices in the security device set Dj. The link resource requirements may include one or more of the bandwidth requirements, packet loss rate requirements, and delay requirements for the physical links in the underlying physical security defense network.

[0021] like Figure 1 As shown, the method of the present application further includes S3, numbering the security devices in each security device set and numbering the physical links in each physical link set.

[0022] In some embodiments of the present application, the security devices in the security device set are randomly numbered based on the number of security devices in the security device set, and the physical links in the physical link set are randomly numbered based on the number of physical links in the physical link set.

[0023] In some embodiments of the present application, in order to facilitate the generation of the preferred initial population in the subsequent step S4 and improve the algorithm optimization efficiency, the numbering of the security devices in the single security device set in S3 includes: calculating the weight of each security device in the single security device set, and numbering them in ascending order of weight; the weight of a single security device in the single security device set is ,in , , is the weight set on demand, represents the ratio of the resources occupied by the security device x in the security device set Di to the total resources, represents the average number of transit devices on all links between the safety device x in the safety device set Di and all safety devices in the safety device set Di-1, represents the average number of transit devices on all links between the safety device x in the safety device set Di and all safety devices in the safety device set Di+1, represents the average bandwidth occupancy rate of all links between the security device x in the security device set Di and all security devices in the security device set Di-1, It represents the average bandwidth occupancy rate of all links between the security device x in the security device set Di and all security devices in the security device set Di+1.

[0024] In some embodiments of the present application, in order to facilitate the generation of a preferred initial population in the subsequent step S4 and improve the algorithm optimization efficiency, the numbering of the physical links in a single physical link set in S3 includes: calculating the weight of each physical link in the single physical link set, and numbering them in descending order according to the weight; the weight of the single physical link is the average of the ratios of the occupied bandwidth of all sub-links therein to the total bandwidth.

[0025] like Figure 1 As shown, the method of the present application also includes S4, generating a number of security service mapping paths to constitute an initial population, the security service mapping paths include a number of triplets arranged in sequence consisting of a first device number, a last device number, and a link number between devices; the security service mapping path satisfies the following constraints: the first device number of the i-th triplet belongs to the number set corresponding to the security device set Di, the last device number of the i-th triplet belongs to the number set corresponding to the security device set Dj, and the link number between devices of the i-th triplet belongs to the number set corresponding to the physical link set Lix,jy; the first device number of a single triplet is the same as the tail device number of its previous adjacent triplet, and the tail device number of a single triplet is the same as the first device number of its subsequent adjacent triplet.

[0026] In some embodiments of the present application, the preferred initial population is generated based on several numbers that are ranked first in S4 to improve the optimization efficiency of the algorithm.

[0027] like Figure 1 As shown, the method of the present application also includes S5, determining the fitness function by comprehensively considering the total number of devices, average device load, and average path load of the security service mapping path, optimizing the fitness of the security service mapping path for the initial population iteration based on the genetic algorithm, and determining the final security service mapping path; the security service mapping path in the genetic algorithm changes when it meets the constraints. The total number of devices is the sum of the number of security devices on the security service mapping path and the number of transit devices on the links between the security devices; the average device load is the average of the ratio of the occupied resources of all devices on the security service mapping path to the total resources; the average path load is the average of the ratio of the occupied bandwidth of all links on the security service mapping path to the total bandwidth.

[0028] The embodiment of the present application uses a number of triplets consisting of the first device number, the last device number, and the link number between devices arranged in sequence to represent the security service mapping path, thereby expanding the optimization space of the genetic algorithm. The fitness function is determined by comprehensively considering the total number of devices, the average device load, and the average path load of the security service mapping path, taking into account the comprehensive performance of the devices and paths of the security service mapping path, which is conducive to finding a security service mapping path with better comprehensive performance.

[0029] In some embodiments of the present application, optimizing the fitness of the security service mapping path for the initial population iteration based on the genetic algorithm includes: Calculate the fitness of each security service mapping path in the population; Selecting several security service mapping paths as parent paths through selection operations such as roulette selection, tournament selection, and sort selection; Perform crossover operation and / or mutation operation on the parent path to generate several new security service mapping paths as the new generation population; Determine whether the termination conditions of the iteration are met, such as reaching the preset number of iterations or the fitness of the population no longer changes significantly; if the termination conditions are met, the algorithm ends and selects the security service mapping path with the best fitness in the mapping population; otherwise, return to the first step to continue iteration.

[0030] In some embodiments of the present application, performing a crossover operation on the parent path includes: randomly selecting two parent paths, and if there is an intersection, that is, there are triplets with the same order in the two parent paths with the same first device number, then crossover is performed, that is, the triplet and the subsequent triplet in the two parent paths are replaced with each other to generate two new paths; if there is no intersection, the two parent paths shown are used as two new paths.

[0031] In some embodiments of the present application, performing a mutation operation on the parent path includes: for each parent path, selecting to change the inter-device link number of one or more triplets with a set mutation probability, or selecting to change the first device number or the last device number of one or more triplets and correspondingly changing the first device number or the last device number of the adjacent triplets based on the changed triplets and constraints.

[0032] In some embodiments of the present application, in order to take into account both the stability and diversity of the population, prevent frequent mutations of the population from causing frequent mutations of fitness that affect the optimization efficiency, and prevent the algorithm from prematurely converging to a local optimal solution, when performing a mutation operation to change the inter-device link number, the first device number or the last device number of the parent path, in the corresponding physical link set / safety device set, the physical link number / safety device number that is ranked first is selected with a higher probability to replace the inter-device link number / first device number or last device number in the parent path to be changed, and the physical link number / safety device number that is ranked last is selected with a lower probability to replace the inter-device link number / first device number or last device number in the parent path to be changed.

[0033] The embodiment of the present application also provides an electronic device, including a memory and a processor, and the memory and the processor can be connected via a bus or other means. The memory can be used to store software programs, computer programs and modules, such as the program / module corresponding to the above-mentioned security service chain mapping method; the processor implements the above-mentioned security service chain mapping method by executing the computer program and module in the memory.

[0034] Among them, the processor can be composed of integrated circuits in some embodiments, for example, it can be composed of a single packaged integrated circuit, or it can be composed of multiple integrated circuits packaged with the same function or different functions, including one or more central processing units (CPU), microprocessors, digital processing chips, graphics processors and a combination of various control chips.

[0035] The memory includes at least one type of readable storage medium, and the readable storage medium includes flash memory, mobile hard disk, multimedia card, card-type memory (such as SD or DX memory, etc.), magnetic memory, disk, optical disk, etc.

[0036] An embodiment of the present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are loaded and executed by a processor, the above-mentioned security service chain mapping method is implemented.

[0037] The processor may include, but is not limited to, one or more processors or microprocessors, etc. Each processor may be an application specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), a programmable logic device (PLD), a field programmable gate array (FPGA), a controller, a microcontroller, a microprocessor or other electronic components, and is used to execute the steps of the above-mentioned embodiment method.

[0038] Computer-readable storage media can be implemented by any type of volatile or non-volatile storage device or a combination thereof. Computer-readable storage media may include, but are not limited to, for example, random access memory (RAM), read-only memory (ROM), flash memory, EPROM memory, EEPROM memory, registers, computer storage media (such as hard disks, floppy disks, solid-state drives, removable disks, Blu-ray disks, etc.).

[0039] In the embodiments provided in the present disclosure, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the above-mentioned module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based device that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0040] Although the embodiments disclosed in the present disclosure are as above, the above contents are only embodiments adopted for facilitating the understanding of the present disclosure and are not intended to limit the present disclosure. Any technician in the technical field to which the present disclosure belongs can make any modifications and changes in the form and details of the implementation without departing from the spirit and scope disclosed in the present disclosure, but the scope of patent protection of the present disclosure shall still be subject to the scope defined in the attached claims.

Claims

1. A security service chain mapping method, characterized in that: include: S1, based on the equipment resource requirements of each security function node in the security service chain, determine the set of security devices D that meet the requirements in the physical security defense structure i , i∈(1,2,…,m), m represents the number of security function nodes in the security service chain; S2, taking the two security device sets corresponding to every two adjacent security function nodes in the security service chain as a security device set group, and based on the link resource requirements between the two adjacent security functions, determining the physical link set L that meets the requirements between a single security device in one security device set and a single security device in another security device set in the corresponding security device set group ix,jy , j∈(1,2,……,m) and j=i+1, x∈(1,2,……,n i ), n i Denotes the security device set D i The number of safety devices in y∈(1,2,……,n j ), n j Denotes the security device set D j The number of safety devices in the S3, numbering the security devices in each security device set and numbering the physical links in each physical link set; S4, generate several security service mapping paths to form an initial population, the security service mapping paths include several triplets consisting of a first device number, a last device number, and an inter-device link number arranged in sequence; the security service mapping paths satisfy the following constraints: the first device number of the i-th triplet belongs to the security device set D i The corresponding number set, the tail device number of the i-th triplet belongs to the security device set D j The corresponding number set, the inter-device link number of the i-th triplet belongs to the physical link set L ix,jy The corresponding number set; the first device number of a single triplet is the same as the last device number of its preceding adjacent triplet, and the last device number of a single triplet is the same as the first device number of its succeeding adjacent triplet; S5, comprehensively considers the total number of devices, average device load, and average path load of the security service mapping path to determine the fitness function, and iterates the initial population based on the genetic algorithm to optimize the fitness of the security service mapping path to determine the final security service mapping path; the security service mapping path in the genetic algorithm changes when it meets the constraints.

2. A security service chain mapping method according to claim 1, characterized in that: The total number of devices is the sum of the number of security devices on the security service mapping path and the number of transit devices on the links between each security device; the average device load is the average of the ratio of occupied resources to total resources of all devices on the security service mapping path; the average path load is the average of the ratio of occupied bandwidth to total bandwidth of all links on the security service mapping path.

3. A security service chain mapping method according to claim 1, characterized in that: The numbering of the security devices in the single security device set in S3 includes: calculating the weight of each security device in the single security device set, and numbering them in ascending order of weight; the weight of each security device in the single security device set is ,in , , The weight is set on demand. Indicates the ratio of the resources occupied by the security device to the total resources, Denotes the security device set D i Security device x and security device set D i-1 The average number of transit devices on all links between all security devices in Denotes the security device set D i Security device x and security device set D i+1 The average number of transit devices on all links between all security devices in Denotes the security device set D i Security device x and security device set D i-1 The average bandwidth utilization of all links between all security devices in Denotes the security device set D i Security device x and security device set D i+1 The average bandwidth occupancy rate of all links between all security devices in the ; in S4, an initial population is generated based on several numbers in the previous sorting.

4. A security service chain mapping method according to claim 1, characterized in that: The numbering of the physical links in the single physical link set in S4 includes: calculating the weight of each physical link in the single physical link set, and numbering them in descending order according to the weight; the weight of the single physical link is the average of the ratio of the occupied bandwidth of all sub-links therein to the total bandwidth; and generating an initial population based on several numbers in the first order in S4.

5. An electronic device comprising a memory and a computer program and a processor stored thereon, characterized in that: When the processor executes the computer program, the security service chain mapping method as described in any one of claims 1 to 4 is implemented.

6. A storage medium, characterized in that The storage medium stores computer executable instructions, and when the computer executable instructions are loaded and executed by the processor, a security service chain mapping method as described in any one of claims 1-4 is implemented.

Images