Security service chain automatic arrangement and deployment method based on particle swarm optimization

Abstract

The invention relates to an automatic arrangement and deployment method for a security service chain based on a particle swarm algorithm, and belongs to the technical field of computer network security. According to the method, programmable preprocessing setting is carried out on the network flow in the virtualization environment, bidirectional support of automatic arrangement of the virtualization security service chain can be completed, the optimal security service chain strategy combination is obtained through particle swarm optimization model matching, the security service chain is implemented and deployed based on the optimal matching, continuous optimization and adjustment are carried out, and the security service chain scheduling efficiency is improved. And completing an automatic arrangement process. Aiming at the problem of high bandwidth consumption in the automatic arrangement process of the virtualized security service chain, the optimal solution is obtained by setting the constraint condition, so that the request success rate is effectively improved, the bandwidth consumption is reduced, and the effective transmission capability is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer network security, and in particular relates to a method for automatically arranging and deploying a security service chain based on a particle swarm algorithm. Background Art

[0002] With the rapid development of cloud computing and software defined networks (SDN), how to quickly reconstruct the security solutions of traditional networks and thus improve the flexibility and efficiency of network security protection has become an urgent problem to be solved. The service chain (SC) of traditional networks pulls network data flows that meet specific attributes through a service sequence composed of multiple business function service nodes, providing a means for traditional networks to prevent and control malicious attacks. The software defined security (SDS) architecture decouples the control plane and data plane of network security devices. The bottom layer is abstracted as resources in the security resource pool, and the top layer flexibly orchestrates security services in a software defined manner to achieve flexible security protection.

[0003] The traditional security service chain orchestration solution is based on SDN (Software Defined Network) + OpenFlow. It is necessary to deploy SDN drainage switches separately outside the security resource pool. Each time the traffic passes through the security component, the SDN drainage device needs to participate in the orchestration and scheduling of the traffic. After multiple scheduling and repeated forwarding, the forwarding performance of the business traffic is reduced after the traffic is scheduled through the security resource pool. Therefore, it is necessary to introduce a new traffic scheduling mechanism and security service chain orchestration deployment method to adapt to the characteristics of virtualized networks and various application scenarios, and improve the overall forwarding performance of the security resource pool. Summary of the invention

[0004] 1. Technical issues to be resolved

[0005] The technical problem to be solved by the present invention is how to provide a method for automatic orchestration and deployment of a security service chain based on a particle swarm algorithm to solve the problem of reduced forwarding performance of business traffic after traffic scheduling through a security resource pool.

[0006] (II) Technical solution

[0007] In order to solve the above technical problems, the present invention proposes a method for automatic orchestration and deployment of a security service chain based on a particle swarm algorithm, the method comprising the following steps:

[0008] Step S1: Initialize the particle swarm of the automatic orchestration deployment model and randomly generate a group of particles, each of which represents a possible strategy combination, also called an orchestration solution;

[0009] Step S2, calculate fitness: calculate the fitness value of each particle according to the fitness function, the fitness function is:

[0010] Fitness(x,y)=x 2 +y 2

[0011] Among them, x and y represent two input variables, the input variable x is defined as the number of user requests, and the input variable y is defined as the bandwidth consumption;

[0012] The particle swarm algorithm evaluates the position of each particle based on this fitness function and guides the particles to move to areas with smaller fitness values, thereby finding the minimum value of the fitness function;

[0013] Step S3: evaluating the fitness of each particle according to a predetermined fitness function;

[0014] Step S4, record the position of the particle with the best fitness in the particle swarm, that is, the global optimal solution; update the speed and position of each particle by considering the individual historical optimal position and the global optimal position;

[0015] Step S5, repeating steps S2 to S4 until the termination condition is met, and obtaining the position of the particle with the best fitness, which is the optimal solution, corresponding to the best security service chain strategy combination;

[0016] Step S6: Deploy and adjust the security service chain according to the best strategy combination represented by the optimal solution, continuously optimize and adjust, and complete the automatic orchestration process.

[0017] Furthermore, the fitness value in S2 is a direct output of the fitness function or requires certain conversion.

[0018] Furthermore, before the step S1, it also includes: a sample parameter preprocessing process, specifically, by performing programmable preprocessing settings on network traffic in a virtualized environment, bidirectional support for automatic orchestration of a virtualized security service chain is completed.

[0019] Furthermore, multiple constraints need to be considered during the automatic orchestration process, including: the number of requests on the security service chain must be less than or equal to the amount of resources that the corresponding physical node can provide; the bandwidth request amount must also be less than or equal to the bandwidth provided on the virtual link; there can only be one mapping between the virtual link and the actual physical path.

[0020] Furthermore, minimizing the total bandwidth is set as the optimal solution for automatic scheduling.

[0021] Furthermore, the automatic orchestration deployment model also includes: a policy conflict decision node, a network traffic scheduling node and a security resource pool.

[0022] Furthermore, in the event of a conflict in automatic orchestration decisions, the policy conflict decision node first automatically provides network security protection services for business traffic through an open policy scheduling interface; due to the different influences of the previous and subsequent policies, there may be certain conflicts between the execution actions. At this time, the optimal policy combination obtained based on the particle swarm algorithm is used to automatically coordinate and manage the relationship between the various services, so that the policy conflict decision node can correctly orchestrate network flow transmission according to the priority of the security service chain.

[0023] Furthermore, the policy conflict decision node also transmits the scheduling optimization decision result to the corresponding network traffic scheduling node.

[0024] Furthermore, the network traffic scheduling node is responsible for analyzing and managing the virtualized security network elements in the security resource pool, realizing automatic monitoring of the network element load information, outputting the corresponding security traffic scheduling configuration according to the security service chain orchestration strategy, parsing the security network element type, and evaluating the best policy scheduling solution from the scheduling optimization decision results of the policy conflict decision node. Through the message queue, the actually configured security traffic scheduling information policy is automatically transmitted to the virtualized security network elements in the security resource pool to realize the directional processing of data traffic.

[0025] Furthermore, the message queue adopts an asynchronous communication mode. The sender in the security resource pool sends the message to the queue without waiting for the response of the receiver, thereby improving the response speed of the security service chain.

[0026] (III) Beneficial effects

[0027] The present invention proposes a method for automatic orchestration and deployment of a security service chain based on a particle swarm algorithm. The present invention proposes a method for automatic orchestration and deployment of a security service chain based on a particle swarm algorithm. The particle swarm algorithm model is used to design the data transmission process, improve the programmability of the service chain, and realize the two-way support of the automatic orchestration of the virtualized security service chain. In view of the high bandwidth consumption problem in the automatic orchestration process of the virtualized security service chain, the optimal solution is obtained by setting constraints, which not only effectively improves the request success rate, but also reduces bandwidth consumption and improves the ability of effective transmission.

[0028] The particle swarm algorithm-based security service chain automatic orchestration and deployment technology of the present invention can improve the traffic scheduling and detection performance by up to 65% in a virtualized environment compared to traditional SDN-based traffic scheduling technology, solving many problems of insufficient performance, complex management, and low efficiency in traditional traffic diversion and service chain orchestration technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 A schematic diagram of a method for automatically arranging and deploying a security service chain based on a particle swarm algorithm according to the present invention;

[0030] Figure 2 This is a schematic diagram of the average total bandwidth consumption under the three methods;

[0031] Figure 3 Schematic diagram of the success rate of security service chain requests under three methods;

[0032] Figure 4 This is a comparison chart of the maximum throughput under the two models;

[0033] Figure 5 The following is a comparison chart of the maximum number of new connections and concurrent connections under the two models. DETAILED DESCRIPTION

[0034] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0035] Terminology explanation:

[0036] SDN Software Defined Network

[0037] SDS Software Defined Security

[0038] SC Service Chain,SC(Service Chain)

[0039] The present invention can complete two-way support for automatic orchestration of virtualized security service chains by making programmable preprocessing settings for network traffic in a virtualized environment, adopt particle swarm algorithm model matching to obtain the best security service chain strategy combination, implement and deploy security service chains based on the best match, continuously optimize and adjust, and complete the automatic orchestration process.

[0040] In order to solve the problem of high bandwidth consumption in the automatic orchestration of virtualized security service chain, the optimal solution is obtained by setting constraints, which not only effectively improves the request success rate, but also reduces bandwidth consumption, improves the efficiency of the orchestration algorithm and effective transmission capacity.

[0041] The present invention proposes a method for automatic orchestration and deployment of a security service chain based on a particle swarm algorithm. The particle swarm algorithm model is used to design the data transmission process, improve the programmability of the service chain, and realize the two-way support of the automatic orchestration of the virtualized security service chain. In view of the high bandwidth consumption problem in the automatic orchestration of the virtualized security service chain, the optimal solution is obtained by preprocessing sample parameters and extracting sample parameter settings, which not only effectively improves the request success rate, but also reduces bandwidth consumption and improves the ability of effective transmission.

[0042] (1) Sample parameter preprocessing

[0043] By setting programmable preprocessing for network traffic in a virtualized environment, bidirectional support for automatic orchestration of virtualized security service chains can be achieved. However, multiple constraints need to be considered during the automatic orchestration process, including:

[0044] The number of requests on the security service chain must be less than or equal to the amount of resources that the corresponding physical node can provide;

[0045] The bandwidth request amount also needs to be less than or equal to the bandwidth provided on the virtual link;

[0046] There can be only one mapping between a virtual link and an actual physical path;

[0047] At the same time, in order to reduce the bandwidth consumption during the automatic arrangement of the virtual environment security service chain, the present invention sets the minimized total bandwidth as the optimal solution for the automatic arrangement.

[0048] (2) Sample parameter setting and extraction

[0049] To extract the sample parameters, it is first necessary to complete the setting of the characteristic sample parameters. In a certain embodiment, the physical topology structure of the virtualized environment includes a main core layer switch, and the number of other switches in the aggregation layer and the edge layer are defined as N (5) and M (40), respectively. The specific settings of the sample parameters are shown in Table 1. The total number of requests for the virtualized link is set to Z (500 times). To ensure the authenticity of the sample results, a total of K (20 times) tests are performed under the same parameters. The number of virtual network functions on the security service chain is increased from 1 to 20 according to the number of tests, and the number of requests each time is set to 20.

[0050] Table 1 Test sample parameter settings

[0051]

[0052]

[0053] (3) Automatic orchestration and deployment model design

[0054] After obtaining the test sample parameters in the virtualized environment, an automatic orchestration deployment model needs to be established for the security protection design of the virtualized network. According to the security business requirements of the upper-level users and the automatic architecture service chain strategy, the virtual security network element protection function is realized, and the data stream being transmitted is securely dispatched to the virtual security network element to achieve security protection of the transmission sequence.

[0055] The present invention proposes a method for automatic orchestration and deployment of a security service chain based on a particle swarm algorithm. The specific process is as follows:

[0056] Step S1: Initialize the particle swarm of the automatic orchestration deployment model and randomly generate a group of particles, each of which represents a possible strategy combination, also called an orchestration solution.

[0057] Step S2, calculate fitness: According to the evaluation function (fitness function) of the problem, calculate the fitness value of each particle. This value can be the direct output of the fitness function, or it may need to be converted (such as taking the opposite number to adapt to the maximization problem).

[0058] Step S3: perform fitness evaluation on each particle according to a predetermined fitness function.

[0059] Step S4: Record the position of the particle with the best fitness in the particle swarm, i.e., the global optimal solution. Update the speed and position of each particle by considering the individual historical optimal position and the global optimal position.

[0060] Step S5, repeating steps S2 to S4 until the termination condition is met, and obtaining the position of the particle with the best fitness, which is the optimal solution, corresponding to the best security service chain strategy combination.

[0061] Step S6: Deploy and adjust the security service chain according to the best strategy combination represented by the optimal solution, continuously optimize and adjust, and complete the automatic orchestration process.

[0062] Wherein, the fitness function implementation method is:

[0063] In function optimization problems, the fitness function usually directly uses the objective function. For example, in the problem of finding the minimum value, the smaller the objective function value, the higher the fitness of the particle. The present invention designs a binary optimization function and sets the objective function as f(x, y) = x 2 +y 2 , we need to find the minimum value of the function. In this problem, we directly use the objective function as the fitness function, and the function formula is defined as follows:

[0064] Fitness(x,y)=x 2 +y 2

[0065] Where x and y represent two input variables. The present invention comprehensively considers the number of user requests in the security service chain orchestration and the bandwidth consumption in the orchestration process as fitness indicators. Therefore, the input variable of x is defined as the number of user requests, and the input variable of y is defined as bandwidth consumption. The particle swarm algorithm will evaluate the position of each particle according to this fitness function, and guide the particles to move to the area with a smaller fitness value, so as to find the minimum value of the function.

[0066] The automatic orchestration and deployment model of the virtualized environment security service chain can automatically realize the orchestration of service chain strategies and the automatic deployment of virtual security network elements, securely dispatch data flows to the corresponding virtual security network elements for security protection, improve security protection reliability, and reduce management workload. In this process, two key issues need to be completed:

[0067] 1) Solve the policy conflict problem in the automatic orchestration of security service chains in virtualized environments;

[0068] 2) Solve the problem of network traffic scheduling optimization.

[0069] To solve the above two problems, the present invention designs a security service chain automatic orchestration deployment model based on particle swarm algorithm, such as Figure 1 As shown, it also includes: a policy conflict decision node, a network traffic scheduling node and a security resource pool;

[0070] In the case of conflicts in automatic orchestration decisions, the policy conflict decision node first automatically provides network security protection services for business traffic through the open policy scheduling interface. However, due to the influence of different previous and subsequent policies, there is a high probability that there will be some conflicts between the execution actions. At this time, the optimal policy combination obtained based on the particle swarm algorithm is used to automatically coordinate and manage the relationship between various services, so that the policy conflict decision node can correctly orchestrate network flow transmission according to the priority of the security service chain, eliminate conflicts in the environment, reduce network congestion, thereby reducing CPU load and CPU utilization, and at the same time transmit the scheduling optimization decision results to the corresponding network traffic scheduling node.

[0071] The network traffic scheduling node is responsible for analyzing and managing the virtualized security network elements in the security resource pool, effectively realizing the automated monitoring of network element load information, outputting the corresponding security traffic scheduling configuration according to the security service chain orchestration strategy, parsing the security network element type, and evaluating the best policy scheduling solution from the scheduling optimization decision results of the policy conflict decision node. Through the message queue, the actually configured security traffic scheduling information policy is automatically transmitted to the virtualized security network elements in the security resource pool to realize the directional processing of data traffic.

[0072] The message queue uses asynchronous communication. The sender in the security resource pool (inbound traffic, generally refers to the source IP address of the network traffic) sends the message to the queue without waiting for the response from the receiver (outbound traffic, generally refers to the destination IP address of the network traffic). This can improve the response speed of the security service chain.

[0073] (4) Sample parameter comparison training

[0074] Based on the extracted sample parameters, the experimental data analysis was conducted on the average total bandwidth consumption of the zero-touch network orchestration method, the real-time seamless orchestration method, and the method used in this project. In the experiment, the same physical topology was input into the virtualized environment, and the same number of security service chain requests were input into the three methods, and the average total bandwidth consumption of the three algorithms was compared. The calculation process of the average total bandwidth consumption is shown in the following formula:

[0075]

[0076] Where D represents the total data volume and T represents the data transmission time. Figure 2 shown.

[0077] according to Figure 2 It can be seen that although the calculation process of the zero-contact network orchestration method is relatively simple and can greatly improve the efficiency of the orchestration algorithm, the corresponding average total bandwidth consumption is relatively high, and the consumption is far greater than the real-time seamless orchestration method and the method of this project. The changes of the present invention are more stable than the zero-contact network orchestration method and the real-time seamless orchestration method. In the process of increasing number of user requests for the security service chain of the virtualized environment, the average total bandwidth consumption of the present invention can be stably maintained at a certain level range. This is mainly because in the process of automatic orchestration of the service chain, the present invention sets the minimized total bandwidth as the automatic orchestration goal, which reduces the total average bandwidth consumption in the process of automatic orchestration of the virtual environment security service chain, and ensures that the average total bandwidth consumption can be stably maintained at a certain level range.

[0078] An experimental comparison and analysis of the request success rate under different algorithm conditions was conducted. In the test, the same physical topology structure was input into the virtual link to ensure that the number of security service chain requests of the three methods was the same. The request success rates of the zero-contact network orchestration method, the real-time seamless orchestration method and the present invention were experimentally analyzed and compared. The calculation of the request success rate is shown in the following formula:

[0079]

[0080] Among them, Nc represents the number of successful requests, and N1 represents the total number of requests. The specific experimental results are as follows Figure 3As shown, according to the experimental results, the user security service chain request success rate corresponding to the zero-contact network orchestration method is much lower than the real-time seamless orchestration method and the present invention. By comparing the zero-contact network orchestration method and the present invention, it can be seen that as the number of cloud network users' requests for the security service chain continues to increase, the request success rate of the present invention can remain stable and is always higher than the zero-contact network orchestration method. This shows that the present invention can effectively improve the user's request success rate to a certain extent while saving bandwidth consumption, and achieve better service chain automatic orchestration. The reason for the analysis is that the service nodes are dynamically scheduled through the security service chain automatic orchestration deployment model based on the particle swarm algorithm, and the real-time feedback results are used to effectively reduce the system failure rate, thereby improving the request success rate.

[0081] (5) Real network data test verification

[0082] By extracting about 500Gbps of real data from a telecommunications user for comparative testing and verification, under the premise of using the same physical topology, the particle swarm algorithm-based security service chain automatic orchestration deployment model and the traditional SDN-based traffic scheduling model were compared and tested. The tester recorded the maximum throughput, maximum number of new connections, and maximum number of concurrent connections that can be achieved under the two models, and the test results were compared. Figure 4 , 5 shown.

[0083] Test conclusion: Compared with the traditional SDN-based traffic scheduling technology, the automatic orchestration technology of the security service chain based on the particle swarm algorithm can improve the traffic scheduling and detection performance by up to 65% in a virtualized environment, solving many problems of insufficient performance, complex management, and low efficiency in traditional traffic diversion and service chain orchestration technologies.

[0084] The present invention proposes a method for automatic orchestration and deployment of a security service chain based on a particle swarm algorithm. The particle swarm algorithm model is used to design the data transmission process, improve the programmability of the service chain, and realize the two-way support of the automatic orchestration of the virtualized security service chain. In view of the high bandwidth consumption problem in the automatic orchestration of the virtualized security service chain, the optimal solution is obtained by setting constraints, which not only effectively improves the request success rate, but also reduces bandwidth consumption and improves the ability of effective transmission.

[0085] The particle swarm algorithm-based security service chain automatic orchestration and deployment technology of the present invention can improve the traffic scheduling and detection performance by up to 65% in a virtualized environment compared to traditional SDN-based traffic scheduling technology, solving many problems of insufficient performance, complex management, and low efficiency in traditional traffic diversion and service chain orchestration technologies.

[0086] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for automatic deployment and orchestration of security service chains based on particle swarm algorithm, characterized in that: The method comprises the following steps: Step S1: Initialize the particle swarm of the automatic orchestration deployment model and randomly generate a group of particles, each of which represents a possible strategy combination, also called an orchestration solution; Step S2, calculate fitness: calculate the fitness value of each particle according to the fitness function, the fitness function is: Fitness(x,y)=x 2 +y 2 Among them, x and y represent two input variables, the input variable x is defined as the number of user requests, and the input variable y is defined as the bandwidth consumption; The particle swarm algorithm evaluates the position of each particle based on this fitness function and guides the particles to move to areas with smaller fitness values, thereby finding the minimum value of the fitness function; Step S3: evaluating the fitness of each particle according to a predetermined fitness function; Step S4, record the position of the particle with the best fitness in the particle swarm, that is, the global optimal solution; update the speed and position of each particle by considering the individual historical optimal position and the global optimal position; Step S5, repeating steps S2 to S4 until the termination condition is met, and obtaining the position of the particle with the best fitness, which is the optimal solution, corresponding to the best security service chain strategy combination; Step S6: Deploy and adjust the security service chain according to the best strategy combination represented by the optimal solution, continuously optimize and adjust, and complete the automatic orchestration process.

2. The method for automatically arranging and deploying a security service chain based on a particle swarm algorithm according to claim 1, characterized in that: The fitness value in S2 is the direct output of the fitness function or requires certain conversion.

3. The method for automatically arranging and deploying a security service chain based on a particle swarm algorithm according to claim 1, characterized in that: Before the step S1, it also includes: a sample parameter preprocessing process, specifically, by performing programmable preprocessing settings on the network traffic in the virtualized environment, two-way support for automatic orchestration of the virtualized security service chain is completed.

4. The method for automatically arranging and deploying a security service chain based on a particle swarm algorithm according to claim 1, characterized in that: During the automatic orchestration process, various constraints need to be considered, including: the number of requests on the security service chain must be less than or equal to the amount of resources that the corresponding physical node can provide; the bandwidth request amount must also be less than or equal to the bandwidth provided on the virtual link; there can only be one mapping between the virtual link and the actual physical path.

5. The method for automatically arranging and deploying a security service chain based on a particle swarm algorithm as claimed in claim 1, characterized in that: Minimizing the total bandwidth is set as the optimal solution for automatic scheduling.

6. The method for automatically arranging and deploying a security service chain based on a particle swarm algorithm according to any one of claims 1 to 5, characterized in that: The automatic orchestration deployment model also includes: a policy conflict decision node, a network traffic scheduling node and a security resource pool.

7. The method for automatically arranging and deploying a security service chain based on a particle swarm algorithm as claimed in claim 6, characterized in that: In the event of a conflict in automatic orchestration decisions, the policy conflict decision node first automatically provides network security protection services for business traffic through an open policy scheduling interface; due to the different influences of the previous and subsequent policies, there is a high probability that there will be certain conflicts between the execution actions. At this time, the optimal policy combination obtained based on the particle swarm algorithm is used to automatically coordinate and manage the relationship between the various services, so that the policy conflict decision node can correctly orchestrate network flow transmission according to the priority of the security service chain.

8. The method for automatically arranging and deploying a security service chain based on a particle swarm algorithm as claimed in claim 6, characterized in that: The policy conflict decision node also transmits the scheduling optimization decision results to the corresponding network traffic scheduling node.

9. The method for automatically arranging and deploying a security service chain based on a particle swarm algorithm as claimed in claim 6, characterized in that: The network traffic scheduling node is responsible for analyzing and managing the virtualized security network elements in the security resource pool, realizing automatic monitoring of network element load information, outputting corresponding security traffic scheduling configuration according to the security service chain orchestration strategy, parsing the security network element type, and evaluating the best policy scheduling solution from the scheduling optimization decision results of the policy conflict decision node. Through the message queue, the actually configured security traffic scheduling information policy is automatically transmitted to the virtualized security network elements in the security resource pool to realize the directional processing of data traffic.

10. The method for automatically arranging and deploying a security service chain based on a particle swarm algorithm as claimed in claim 9, characterized in that: The message queue uses asynchronous communication. The sender in the security resource pool sends the message to the queue without waiting for the receiver's response, which improves the response speed of the security service chain.

Images