SaaS firewall energy consumption optimization method and system

Abstract

The invention provides an SaaS firewall energy consumption optimization method and device. The device mainly comprises a safety equipment resource pool, a flow prediction system and a protection task scheduling system. Wherein the security equipment resource pool bears the protection task issued by the user. The traffic prediction system collects historical traffic data of a protected target, screens out a protected target with rescheduling value, and predicts a traffic peak value of the protected target in a future time period. And the protection task scheduling system re-schedules the protection task to a proper safety device according to the predicted value of the future traffic of the protection target in combination with the actual distribution of the protection task in the safety device resource pool for the purpose of minimizing the number of the used safety devices, and finally shuts down the idle safety device. According to the method, the resource utilization rate of safety equipment can be remarkably increased, meanwhile, energy consumption is reduced, and finally economic and environment-friendly double benefits are generated.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a traffic prediction method for a SaaS firewall, and a task scheduling method for reducing energy consumption. Background Art

[0002] With the in-depth development of the cloud computing industry, SaaS (Software as service) services have been welcomed by the market for their excellent usability. Traditional network security products are usually frequently configured and upgraded, and have high maintenance costs. SaaS can significantly improve the usability of network security products. SaaS firewall (cloud firewall) is a cloud service that mainly protects network assets on the public cloud. SaaS firewalls usually provide services in the form of security resource pools. By pooling the security capabilities of physical or virtual firewall clusters and cooperating with software-defined networking (SDN) technology, the traffic entering the user-specified protection target is pulled one by one to the firewall devices in the security resource pool for filtering and protection.

[0003] The peak value of protected traffic is a key performance indicator of traditional firewall devices. For SaaS firewalls, the peak value of protected traffic is not only the main basis for billing, but also the main basis for task scheduling. When users purchase SaaS firewall services, they choose services with different traffic peaks based on their business conditions; when users send protection requests, the SaaS firewall system schedules according to the traffic peak selected by the user and the current available traffic of each security device in the security device resource pool, and selects the appropriate security device to undertake the protection task.

[0004] To ensure the service level agreement (SLA), the SaaS firewall system will deduct the peak traffic of the task selected by the user from the current available traffic of the selected security device when scheduling tasks. This process is called resource preemption. When the preempted traffic resources on a firewall device are close to its available traffic limit, the subsequent protection tasks can only be assigned to other security devices. However, in many cases, the actual traffic peak of the protection task is much lower than the traffic peak selected by the user, resulting in a waste of the preempted traffic resources of the security device.

[0005] Reasonable resource pre-occupancy and the use of scientific scheduling methods to concentrate protection tasks on as few security devices as possible can effectively reduce the number of security devices in operation. Doing so can reduce equipment loss and operation and maintenance costs on the one hand, and energy consumption on the other hand, which has both economic and environmental benefits, and is therefore a very important issue. Summary of the invention

[0006] The present application provides a method for optimizing energy consumption of a SaaS firewall system. The method periodically adjusts the distribution of protection tasks carried by the SaaS firewall system on security devices. When adjusting, the future traffic peak of the protection task is first predicted, and the predicted traffic peak value is used as the basis for task scheduling. By rescheduling, the number of powered-on security devices in the SaaS firewall system is reduced, thereby reducing the energy consumption of the system.

[0007] like Figure 1 As shown, the SaaS firewall system includes: a security device resource pool, a prediction system, and a scheduling system.

[0008] like Figure 1 As shown, the scheduling system performs capacity management and power management on the security devices in the security device resource pool.

[0009] like Figure 1 As shown, when a new task is issued, the traffic peak value specified by the user is called the traffic peak value specified value of the task. The scheduling system is based on the premise of meeting the traffic peak value specified value and aims to minimize the total number of security devices used by the entire SaaS system. It selects a security device from the security device resource pool and issues the current protection task to the security device (this process is the same as the traditional firewall issuing tasks, which will not be described in detail). The traffic entering the protection target is directed to the security device, and the traffic is then injected back to the protection target after protection processing.

[0010] like Figure 1 As shown, when there are some protection tasks in the system, for each existing protection task, the prediction system continuously records the traffic peak value of the protection task per unit time, and the formed time series is called the historical traffic peak sequence of the task.

[0011] like Figure 2 As shown, the prediction system identifies tasks that have significant periodic trends in historical traffic peak sequences, which are called Type A tasks.

[0012] like Figure 3 As shown, the prediction system identifies tasks in which the maximum value in the historical traffic peak sequence is significantly lower than the user-specified traffic peak, which is called a Type B task.

[0013] like Figure 4 As shown, for type A tasks, the prediction system predicts the traffic peak value of the task in each unit time in the future period based on the historical traffic peak sequence of the task.

[0014] The scheduling system periodically reschedules the protection tasks existing in the system, with the goal of deploying the protection tasks on as few security devices as possible while meeting actual protection needs.

[0015] For type A tasks, the dispatch scheduling system performs simulated rescheduling by replacing the task's peak flow rate prediction value with the task's peak flow rate specified value.

[0016] For type B tasks, the scheduling system replaces the task's traffic peak specified value with the maximum value in the task's historical traffic peak sequence to perform simulated rescheduling.

[0017] If a protection task is both type B and type A, simulated rescheduling will be performed as type A task.

[0018] After the simulated rescheduling is completed, if the minimum number of powered-on safety devices required by the system becomes smaller, the scheduling system will migrate the relevant tasks to the corresponding safety devices according to the deployment plan formed by the simulated rescheduling, and shut down the idle safety devices that do not undertake any protection tasks caused by this rescheduling.

[0019] First, the security device resource pool should include at least two firewall devices (physical or virtualized deployment). Each protection task specified by the user is undertaken by a security device in the security resource pool, and the protection task and the firewall device are in a many-to-one relationship. The security policy of the protection task is stored in the scheduling system, and the security device obtains the security policy of the protection task by accessing the scheduling system. The SaaS firewall system supports the migration of a protection task between different security devices within seconds through SDN diversion technology.

[0020] On the second aspect, the method and system provide a method for determining whether there is a significant periodic trend in the historical traffic peak sequence of the protection task, and this method can be used to identify type A tasks.

[0021] On the third aspect, the method and system provide a method for determining whether the specified flow peak value of the protection task is significantly greater than the actual flow peak value, and this method can be used to identify type B tasks.

[0022] In a fourth aspect, the method and system provide a prediction method based on mathematical statistics principles, which is used to estimate the peak flow rate of type A protection tasks per unit time in the future.

[0023] Fifthly, when there are Type A tasks or Type B tasks in the system, the method and system provide a method for rescheduling protection tasks. Under the premise of ensuring SLA, the method distributes the protection tasks to the smallest possible number of security devices, ultimately achieving energy saving. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A schematic diagram of the configuration method and task scheduling mechanism of the application firewall service provided for this application;

[0025] Figure 2 A flow chart of the method for determining type A protection tasks provided for this application;

[0026] Figure 3 Flowchart of the method for determining type B protection tasks provided for this application;

[0027] Figure 4 Flowchart of the prediction method for future flow peak of Type A protection task provided for this application;

[0028] Figure 5 Flowchart of the protection tasks handled by the application firewall service provided for this application. DETAILED DESCRIPTION

[0029] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments of the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0030] Statistics show that there are a large number of protection tasks, and the traffic entering their protection targets has a cyclical trend of 7 days. This type of protection task also presents two types of traffic characteristics. One is work-type, where the traffic starts to gradually increase in the morning of weekdays, basically continues after reaching the peak, and gradually decreases in the afternoon. The traffic drops to the lowest level of the day at night, and the traffic is always at a low level on non-working days (weekends); the other is entertainment-type, where the traffic gradually increases in the evening of weekdays, continues for several hours after reaching the peak, and gradually decreases from the early morning. The traffic drops to the lowest level of the day in the morning, and the traffic is always at a high level on non-working days (weekends). There is a significant correlation between the traffic characteristics of work-type and entertainment-type protection targets and the modern work system. Since the traffic entering the protection target is composed of a large number of user visits, the behavioral changes of a single user will not affect the overall traffic characteristics. Therefore, the stability of the work system ensures the stability of the traffic characteristics of these two types of protection targets.

[0031] In this embodiment, when recording the historical traffic peak values ​​of a task, the prediction system takes 5 minutes as one unit of time, and records a total of 12*24 traffic peak values ​​for each task every day.

[0032] In this embodiment, the peak traffic sequence of the protection task in the past three weeks is X t , t∈[1, 12*24*7*3]

[0033] In this embodiment, when the traffic peak values ​​of a task in the past three weeks are all less than 20% of the specified traffic peak value of the task, it is determined to be a Type B task.

[0034] In this embodiment, by analyzing the traffic peak sequence of the protection task in the past three weeks, it is determined whether the task has a periodic trend with a period of 7 days. If so, the task is determined to be a type A task.

[0035] In this embodiment, by calculating X t , the autocorrelation coefficient ρ of t∈[1,12*24*7*3] k To achieve type A task judgment.

[0036] In this embodiment, when calculating the autocorrelation coefficient γ k = Cov(x t , x t-k ), k is taken as 2016, because the unit time is 5 minutes, and 7 days contains 12*24*7=2016 unit time in total.

[0037] In this embodiment, if ρ 2016 ≥0.8 (this threshold can be set to a real number greater than or equal to 0.5 and less than 1), indicating that the historical traffic peak sequence of the protection task has significant autocorrelation (period is 7 days), that is, there is a periodic trend with a period of 7 days, and it is determined to be a Type A task.

[0038] In this embodiment, if Figure 2 As shown, the traffic peak sequence of type A task is decomposed into a trend part (Trend) and a residual part (residual), and the trend part and the residual part are predicted respectively, and the predicted values ​​of the two are summed up as the predicted value of the traffic peak.

[0039] In this embodiment, let X t Represents the historical peak traffic sequence of the protected target, Among them, Y t Represents the trend sequence, Represents the residual sequence. The subscript t is calculated by i, j, and N, where i represents the day of the week to which the current period belongs, j represents the number of unit time in a day to which the current period belongs, and N represents the number of unit time contained in a day, so t = N*i+j.

[0040] In this embodiment, when predicting the future traffic peak value of a task, 5 minutes is assumed as 1 unit time, and one week contains 2016 unit time. Each time, the traffic peak value of 2016 unit time in the next week is predicted.

[0041] use It represents the peak traffic volume of the protection task in the tth unit time of the i-th week.

[0042] Since the trend series Y tis a low-frequency residual sequence It is high frequency. In this embodiment, a Butterworth filter is used to perform low-pass filtering on the historical traffic peak sequence, and the result obtained is the trend part Y t , Y t =h(t)*X t (* is the convolution operation).

[0043] Subtract the trend sequence from the original sequence to get the residual

[0044] For the protection target, take the traffic peak data in the tth time unit in the past three weeks (already passed) Filter to get the relevant trend part Calculate the mean Will As the trend part Y of the traffic peak in the t-th time unit in the next week t The predicted value of .

[0045] In this embodiment, the reason why the data of the past three weeks is used to predict the next week is that the protection task target is affected by its own business changes and the external network environment, and the traffic trend law will gradually change. If more than three weeks of historical data are used for prediction, overfitting will occur.

[0046] In this embodiment, a second-order autoregressive model (AR(2)) is used to analyze the residual To model: in is the parameter of the AR(2) model, of real number type, e t is the error term, let e t are independent and have a mean of 0 and a variance of Gaussian distribution.

[0047] In this embodiment, As The predicted value of . It can be obtained through the previous calculation. are the parameters of the AR(2) model, and the prediction is The problem is equivalent to the parameters of AR(2) Estimation problem.

[0048] In this example, the Yule-Walker equation is used to calculate the AR(2) model. Parameters This method is a classic time series analysis algorithm and will not be elaborated here.

[0049] In this embodiment, The estimated value and and Bring Back Get the residual prediction value

[0050] In this embodiment, the residual prediction value is added to the trend prediction value to obtain the flow peak prediction value:

[0051] In this embodiment, when the task is first scheduled, the task's traffic peak value is used as the scheduling basis, and the scheduling system selects appropriate security devices for the protection task with the goal of minimizing the number of firewalls that are turned on. This problem is a typical one-dimensional bin packing problem, which is an NP-Hard problem.

[0052] In SaaS firewall applications, requests from users will arrive one after another, so the initial scheduling algorithm is an "online algorithm (not required to obtain all inputs at the beginning)".

[0053] In this embodiment, the “First-Fit algorithm” is used to perform initial scheduling of the protection tasks.

[0054] In this embodiment, C i , i∈[1,n] represents the current available protection traffic of the powered-on security devices in the SaaS firewall system.

[0055] Use O j Indicates the specified traffic peak value of the j-th protection task.

[0056] Traverse the powered-on security devices in order of number and send the protection tasks to the devices that meet C i ≥O j The first security device is updated with the available protection flow C of the security device. i =C i -O j .

[0057] If the current startup safety devices do not meet C i ≥O j , then a new security device is started and task j is scheduled to the newly started security device, and the available protection flow C of the security device is updated n+1 =C n+1 -O j .

[0058] In this embodiment, after the system has been running for a period of time, the prediction system selects type A tasks and type B tasks, and predicts the flow peak value of type A tasks in each unit time (each unit time is 5 minutes) in the next 7 days.

[0059] In this embodiment, the "Descending First Fit Algorithm" is used.

[0060] -Decreasing)” to reschedule the protection tasks.

[0061] In this embodiment, rescheduling is performed every 5 minutes.

[0062] In this embodiment, D i , i∈[1,n] represents the n security devices in the SaaS firewall system whose current status is turned on and the number of protection tasks carried by them is not 0; C i , i∈[1,n] represents the current available protection traffic of the powered-on security devices in the SaaS firewall system.

[0063] In this embodiment, before the real rescheduling is performed, a simulated rescheduling is performed first. The simulated rescheduling only generates a scheduling plan and does not actually migrate the protection task.

[0064] Before simulating rescheduling, all powered-on safety devices D i The current available protection flow C i Reset to its maximum protection flow.

[0065] All protection tasks in the system are sorted in descending order according to the specified traffic peak value: for type A tasks, the predicted traffic peak value is used instead of the specified traffic peak value for sorting; for type B tasks, the maximum value in the traffic peak sequence of the past three weeks is used instead of the specified traffic peak value for sorting.

[0066] Select the safety devices for the sorted protection tasks in sequence. When selecting the safety devices, traverse the safety devices in sequence according to the numbers.

[0067] For type A task j, the protection task is assigned to the first security device that meets the condition. The condition is that the current available protection flow C of the security device i Greater than or equal to the predicted traffic peak value P of the task in the next upcoming time unit (5 minutes) j , update D i Current available flow: D i =D i -P j .

[0068] For type B task j, the protection task is assigned to the first safety device that meets the conditions. The condition is that the available protection flow C of the safety device i Greater than or equal to the maximum traffic peak value j of the task in the past three weeks max Update D i Current available flow: Di =D i -j max .

[0069] For other tasks j, arrange the protection tasks to meet the protection flow C available on the current device i Greater than or equal to the current task traffic peak value specified value O j The first safety device D i and update D i Current available flow: D i =D i -O j .

[0070] Because P j ≤O j , j max ≤O j ,The minimum number of startup safety devices after simulated rescheduling must not be greater than the minimum number of startup safety devices required before rescheduling.

[0071] When the simulation rescheduling is completed, if there is a D that has been turned on i , because the rescheduling causes the number of protection tasks on it to change from non-zero to zero, the result of the rescheduling is that the number of powered-on safety devices is reduced. At this time, the simulated rescheduling result has energy-saving benefits.

[0072] If the simulated rescheduling result has energy-saving benefits, the rescheduling is actually performed and the idle safety devices are shut down and powered off; otherwise, the rescheduling is not performed.

[0073] In this embodiment, the service availability is used To describe the quality of service. When the traffic that attempts to enter the protection target exceeds the peak traffic that the security device can protect, it may cause protection interruption and cause a breach of the service level agreement (SLA) corresponding to the protection task.

[0074] In this embodiment, for type A or type B protection tasks, when the “current availability”

[0075] When it decreases to a value close to the agreed service availability value in the SLA agreement, it is no longer judged as a type A or B task. In subsequent simulation rescheduling, the traffic peak specified value of the task is used to participate in sorting and calculation.

Claims

1. A SaaS firewall energy consumption optimization method, characterized by: The protection task scheduling system receives the user's protection request, wherein the security protection request mainly includes the protection target address and the network traffic peak value entering the protection target; The protection task scheduling system selects a security device that meets the task specified traffic peak from the security device resource pool, and this process is called task scheduling; The traffic prediction system monitors the real-time traffic of each protection task and records the peak traffic of the protection task per unit time; The traffic prediction system selects tasks with significant periodic trends based on historical traffic peak data, which are called type A tasks; The traffic prediction system selects tasks whose maximum value in the historical traffic peak sequence is significantly lower than the user-specified traffic peak, which are called type B tasks; The traffic prediction system predicts the future traffic peak value of type A tasks; The task scheduling system periodically reschedules the protection tasks in the system. When rescheduling, type A tasks are rescheduled using their traffic peak prediction values, type B tasks are rescheduled using the maximum value in their historical traffic peak sequence, and other protection tasks are rescheduled using the task's traffic peak specified value; The security device resource pool periodically checks all security devices and shuts down idle security devices (not carrying protection tasks) while maintaining a small amount of redundancy, so as to achieve the purpose of energy saving.

2. As claimed in claim 1, a method for initial scheduling of protection tasks, characterized in that: When the protection task scheduling system receives a new protection request from a user, it uses the "first adaptation algorithm" to schedule the protection task for the first time - it traverses the sequence of available security devices in sequence and sends the protection task to the first security device that meets the specified traffic peak of the protection task; The protection task uses traffic traction to make external traffic pass through the appropriate firewall device for traffic filtering before entering the protection target.

3. The method for screening out tasks with rescheduling benefits (including type A tasks and type B tasks) as described in claim 1, characterized in that: The traffic prediction system monitors the real-time traffic of each protection task, taking 5 minutes as a time unit, and records the peak value of the actual traffic of the protection task target within each time unit. Each protection task generates 12*24 peak values ​​every day; The traffic prediction system regards the traffic peak data of a task in the past three weeks as a time series, which contains 12*24*7*3 data in total. The autocorrelation coefficient is calculated with 2016 as the time interval (2016=12*24*7). , where K=2016, when When , the time series has a significant autocorrelation with a period of 7 days, and the corresponding task is determined to be a type A task; if the traffic peak time series of a task in the past three weeks are all less than 20% of the specified traffic peak value of the task, it is determined to be a type B task.

4. As described in claim 1, the method for decomposing the flow peak time series of type A task into a trend part and a residual part is characterized by: When the traffic prediction system predicts the time series composed of the traffic peak value of type A protection task, it first decomposes it into a trend series and a residual series; make Represents the historical peak traffic sequence of the protected target, ,in, It represents the trend part. represents the residual part; Use Butterworth filter to Perform filtering to obtain the low-frequency trend part ; Subtract the trend sequence from the original sequence to get the residual ; Calculate the trend series for the last three weeks and the residual sequence .

5. The method for predicting future traffic peaks of type A tasks as described in claim 1, characterized in that: When the flow prediction system predicts the flow peak value of the type A protection task, it predicts the trend sequence and the residual sequence respectively, and then sums the two to obtain the future flow peak prediction value.

6. The method for predicting the future flow peak trend portion of a type A task as claimed in claim 5, characterized in that: The prediction of the traffic peak value of a task at a future time means that the prediction time range is the next week (7 days), and the prediction form is the traffic peak value every 5 minutes in the future; The traffic prediction system calculates the average of the trend part of the traffic peak value in the tth 5-minute period in the last three weeks ,by As the predicted value of the trend part of the traffic peak in the tth 5-minute period in the next week.

7. The method for predicting the residual part of the future flow peak of type A task as described in claim 5, characterized in that: The traffic prediction system uses a second-order autoregressive model (AR(2)) to predict the residual sequence Make an estimate, ,in, are the parameters of the AR(2) model, of real number type, is the error term, let are independent and have a mean of 0 and a variance of Gaussian distribution of For the upcoming t, t-1 and t-2 are the past periods, and for the past periods and, using Calculated, unknown quantity are the parameters of the AR(2) model, and the problem becomes Parameter estimation problems; The traffic prediction system uses the Yule-Walker equation to calculate the parameters of the AR(2) model. Make estimates; Final use Prediction residual sequence .

8. A method for rescheduling a protection task as claimed in claim 1, characterized in that: After the SaaS firewall system has been running for a period of time, the task scheduling system periodically reschedules the protection tasks in the system, and reduces the number of powered-on security devices by changing the distribution of current tasks on security devices; Before actually executing the rescheduling operation, simulated rescheduling is performed first. All simulated rescheduling steps are only simulated calculations and are not actually executed. Only when the result of simulated rescheduling is a reduction in the number of power-on safety devices, is real task rescheduling performed according to the simulated rescheduling plan.

9. A method for simulating rescheduling as claimed in claim 8, characterized in that: Use the "First-Fit-Decreasing" algorithm to simulate the rescheduling of all protection tasks in the system; use Indicates n security devices in the SaaS firewall system whose current status is turned on and whose number of protection tasks is not 0; use Indicates safety equipment The maximum available protection flow rate; For a type A task j in the system, It indicates the traffic peak value of the task in the next unit time predicted by the prediction system; use represents the user-specified traffic peak value for protection task j; n safety devices The current available protection flow Reset to its maximum available protection flow; All protection tasks in the system are sorted in descending order according to the specified traffic peak values. Type A tasks use the predicted traffic peak value instead of the specified traffic peak value for sorting, and Type B tasks use the maximum value of their traffic peak sequence in the past three weeks instead of the specified traffic peak value for sorting; Select safety equipment for the ranked protection tasks in turn; When selecting safety equipment, go through the safety equipment in order by number; For type A task j, the protection task is assigned to the first security device that meets the condition. The condition is that the current available protection traffic of the security device Greater than or equal to the predicted traffic peak value of the task in the next upcoming time unit (5 minutes) ,renew Current available traffic ; For type B task j, the protection task is assigned to the first security device that meets the conditions. The condition is that the available protection flow of the security device is Greater than or equal to the maximum traffic peak value of the task in the past three weeks ,renew Current available traffic ; For other tasks j, arrange the protection tasks to meet the protection flow available on the current device Greater than or equal to the specified value of the current task traffic peak The first safety device On and update Current available traffic .

Images