Security service chain arrangement method and device, electronic equipment and medium
By using particle swarm algorithms to automatically orchestrate the security service chain in a virtualized environment, the problem of inefficiency of traditional orchestration solutions is solved, and bandwidth consumption is reduced and orchestration efficiency is improved.
Patent Information
- Application Number
- CN202411914665.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-24
- Publication Date
- 2025-04-11
AI Technical Summary
In the prior art, the traditional security service chain orchestration scheme is based on the SDN+OpenFlow method, and it is necessary to deploy SDN drainage switches separately outside the security resource pool, resulting in low efficiency.
The particle swarm algorithm is used to programmable preprocess the network traffic in the virtualized environment, and the automatic orchestration of the virtualized security service chain is completed. By setting the objective function to minimize the total bandwidth consumption of the security service chain, the particle fitness value is determined and its speed and position is updated until the number of iterations reaches the preset value, the optimal policy combination is obtained and the security service chain is deployed.
It effectively reduces bandwidth consumption, improves the efficiency and effective transmission capabilities of the orchestration algorithm, and realizes the optimization and adjustment of the automatic orchestration process.
Smart Images
Figure CN119814419A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer network security technology, and in particular to a method, device, electronic device and medium for orchestrating a security service chain. Background Art
[0002] With the rapid development of cloud computing and software defined networks (SDN), how to quickly reconstruct the security solutions of traditional networks and thereby improve the flexibility and efficiency of network security protection has become an urgent problem to be solved.
[0003] In the prior art, the service chain (SC) of traditional networks pulls network data flows that meet specific attributes through a service sequence composed of multiple business function service nodes, providing a means for traditional networks to prevent and control malicious attacks. The software-defined security (SDS) architecture decouples the control plane and data plane of network security devices, abstracts the bottom layer into resources in the security resource pool, and flexibly orchestrates security services in a software-defined manner to achieve flexible security protection.
[0004] However, the traditional security service chain orchestration solution is based on the SDN+OpenFlow approach, which requires the deployment of a separate SDN drainage switch outside the security resource pool. Every time the traffic passes through the security component, the SDN drainage device needs to participate in the orchestration and scheduling of the traffic. After multiple scheduling and repeated forwarding, there is a problem of low efficiency. Summary of the invention
[0005] In view of this, it is necessary to provide a security service chain orchestration method, device, electronic device and medium to solve the problem of low efficiency in the prior art.
[0006] In order to solve the above problems, the present application provides a security service chain orchestration method, including: S101, obtaining user security service demand data, and based on the user security service demand data, taking the strategy combination of the security service chain as particles to initialize a particle swarm; S102, with the goal of minimizing the total bandwidth consumption of the security service chain, determining an objective function, and calculating the fitness value of the particle based on the objective function; S103, based on the fitness value, updating the speed and position of the particle; S104, return to S103, until the number of iterations reaches a preset value, an optimal strategy combination is obtained, and the security service chain is deployed based on the optimal strategy combination.
[0007] In some possible implementations, the policy combination includes the type and quantity of security network elements.
[0008] In some possible implementations, the security service chain is composed of a number of security network elements, the types of which include protection network elements and detection network elements, and the calculation formula for the total bandwidth consumption is:
[0009] In the formula, Indicates the total bandwidth consumption. Indicates the number of protective network elements in the security service chain. Indicates the number of detection network elements in the security service chain. Indicates the bandwidth consumption caused by the protection network element participating in the service traffic forwarding. Indicates the bandwidth consumption caused by the detection network element participating in the service traffic forwarding. Indicates the bandwidth consumption caused by the occupation of protection network element system resources.
[0010] In some possible implementations, the calculation formula for bandwidth consumption caused by the security network element participating in service traffic forwarding and the bandwidth consumption caused by the security network element system resource occupation is:
[0011]
[0012] In the formula, Indicates the bandwidth consumption caused by the security network element participating in the service traffic forwarding. Indicates the bandwidth consumption caused by the occupation of security network element system resources. Indicates the base bandwidth.
[0013] In some possible implementations, the objective function also aims to minimize the number of security network elements in the security service chain.
[0014] In some possible implementations, the objective function is:
[0015] In the formula, represents the objective function, Indicates the number of security network elements, Indicates the total bandwidth consumption of the security service chain.
[0016] In some possible implementations, updating the speed and position of the particle based on the fitness value includes: determining the optimal position of the particle swarm and the historical optimal position of each individual particle in the particle swarm based on the fitness value, and updating the speed and position of the particle based on the optimal position of the particle swarm and the historical optimal position of the individual particle.
[0017] The present application also provides a security service chain arrangement device, including: 8. A security service chain arrangement device, comprising: A data acquisition unit, used to acquire user security business demand data; A policy optimization unit is used to use the policy combination of the security service chain as a particle based on the user security business demand data, initialize the particle group, minimize the total bandwidth consumption of the security service chain as the goal, determine the objective function, calculate the fitness value of the particle based on the objective function, update the speed and position of the particle based on the fitness value, return to recalculate the fitness value of the particle, update the speed and position of the particle, until the number of iterations reaches a preset value, and obtain the optimal policy combination; The service chain orchestration unit is used to deploy the security service chain based on the optimal strategy combination.
[0018] The present application also provides an electronic device, including a memory and a processor; The memory is used to store programs; The processor is coupled to the memory and is used to execute the program stored in the memory to implement the steps of the security service chain orchestration method described above.
[0019] The present application also provides a computer-readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the security service chain orchestration method described above are implemented.
[0020] The beneficial effects of the present application are as follows: the security service chain orchestration method provided by the present application adopts a particle swarm algorithm to perform programmable preprocessing settings on network traffic in a virtualized environment, completes two-way support for automatic orchestration of virtualized security service chains, and at the same time, by setting objective function matching, obtains the overall minimum consumed bandwidth that meets user security capability requirements, thereby obtaining the best security network element matching combination, that is, the best security service chain strategy combination, which can effectively reduce bandwidth consumption, improve the efficiency of the orchestration algorithm and the effective transmission capacity, and implement and deploy the security service chain based on the best match, continuously optimize and adjust, and complete the automatic orchestration process. BRIEF DESCRIPTION OF THE DRAWINGS
[0021] Figure 1 A schematic diagram of an embodiment of the security service chain orchestration method provided by the present application; Figure 2 Schematic diagram of average total bandwidth consumption under the three methods provided in this application; Figure 3 A schematic diagram comparing the maximum throughput under the two models provided in this application; Figure 4 A schematic diagram comparing the maximum number of new connections and concurrent connections under the two models provided for this application; Figure 5 A schematic diagram of the structure of an embodiment of the security service chain arrangement device provided by the present application; Figure 6 A schematic diagram of the structure of an embodiment of an electronic device provided in this application. DETAILED DESCRIPTION
[0022] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.
[0023] It should be understood that the schematic drawings are not drawn to scale. The flowcharts used in this application illustrate operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowcharts may be implemented out of order, and steps without logical contextual relationships may be reversed in order or implemented simultaneously. In addition, those skilled in the art may add one or more other operations to the flowcharts, or may remove one or more operations from the flowcharts, under the guidance of the content of this application. Some of the block diagrams shown in the accompanying drawings are functional entities, and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor systems and / or microcontroller systems.
[0024] The descriptions of "first", "second", etc. involved in the embodiments of the present application are only used to describe the implicit purpose, and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the technical features defined as "first" and "second" may explicitly or implicitly include at least one of the features. "And / or" describes the association relationship of the associated objects, indicating that three relationships may exist, for example: A and / or B, which can represent: A exists alone, A and B exist at the same time, and B exists alone.
[0025] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.
[0026] The present application provides a security service chain orchestration method, which is described below.
[0027] Figure 1 A schematic diagram of an embodiment of the security service chain arrangement method provided in this application is shown in FIG. Figure 1 As shown, the security service chain orchestration method includes: S101, obtaining user security service demand data, and based on the user security service demand data, taking the strategy combination of the security service chain as particles to initialize the particle swarm; It should be noted that the particle swarm is initialized to randomly generate a set of particles, each of which represents a possible strategy combination, also called an orchestration solution.
[0028] It should also be noted that various constraints need to be considered during the automatic orchestration process. The request volume on the security service chain must be less than or equal to the amount of resources that the corresponding physical node can provide. At the same time, the bandwidth request volume also needs to be less than or equal to the bandwidth provided on the virtual link. There can only be one mapping between the virtual link and the actual physical path. For this purpose, various constraints are described.
[0029] S102, with the goal of minimizing the total bandwidth consumption of the security service chain, determining an objective function, and calculating the fitness value of the particle based on the objective function; S103, based on the fitness value, determine the optimal position of the particle swarm and the historical optimal position of each individual particle in the particle swarm, and based on the optimal position of the particle swarm and the historical optimal position of the individual particle, update the speed and position of the particle; S104. Return to S103 until the number of iterations reaches a preset value, an optimal strategy combination is obtained, and the security service chain is deployed based on the optimal strategy combination.
[0030] It should be noted that according to the optimal strategy combination represented by the optimal solution, the number and type of network elements in the security service chain are deployed and adjusted, and continuous optimization and adjustment are performed to complete the automatic orchestration and deployment process.
[0031] Compared with the prior art, the present application adopts a particle swarm algorithm to perform programmable preprocessing settings on network traffic in a virtualized environment, completes two-way support for automatic orchestration of virtualized security service chains, and at the same time, by setting objective function matching, obtains the overall minimum bandwidth consumption that meets user security capability requirements, thereby obtaining the best combination of security network elements, that is, the best security service chain strategy combination, which can effectively reduce bandwidth consumption, improve the efficiency of the orchestration algorithm and the effective transmission capacity, and implement and deploy the security service chain based on the best match, continuously optimize and adjust, and complete the automatic orchestration process.
[0032] In order to improve the quality of the optimal solution of the strategy combination, in some embodiments, the objective function also aims to minimize the number of security network elements in the security service chain. Specifically, the objective function is:
[0033] In the formula, represents the objective function, Indicates the number of security network elements, Indicates the total bandwidth consumption of the security service chain.
[0034] It should be noted that in actual application scenarios, a security service chain is composed of multiple security network elements, each of which is defined as a security service unit. According to different deployment methods and security attributes, security network elements are divided into two categories: protection network elements and detection network elements. Protection network elements are usually deployed in series on the security service chain, participate in the forwarding of business traffic and occupy certain system resources. Due to the two factors of forwarding delay and resource occupation, a certain amount of bandwidth consumption will be generated. Detection network elements are deployed in a bypass on the security service chain and do not participate in the forwarding of business traffic, but will still cause some forwarding delays due to system resource occupation, thus also generating a certain amount of bandwidth consumption.
[0035] Based on the above description, the total bandwidth consumption is calculated as:
[0036] In the formula, Indicates the total bandwidth consumption. Indicates the number of protective network elements in the security service chain. Indicates the number of detection network elements in the security service chain. Indicates the bandwidth consumption caused by the protection network element participating in the service traffic forwarding. Indicates the bandwidth consumption caused by the detection network element participating in the service traffic forwarding. Indicates the bandwidth consumption caused by the occupation of protection network element system resources.
[0037] The calculation formula for the bandwidth consumption caused by the security network element participating in the service traffic forwarding and the bandwidth consumption caused by the security network element system resource occupation is:
[0038]
[0039] In the formula, Indicates the bandwidth consumption caused by the security network element participating in the service traffic forwarding. Indicates the bandwidth consumption caused by the occupation of security network element system resources. represents the base bandwidth, The value is automatically identified and dynamically adjusted according to the upstream and downstream forwarding interface bandwidths. The value is usually 100Mbps, 1000Mbps, or 10000Mbps.
[0040] This application uses a particle swarm algorithm model to match the minimum number of security network elements and the overall minimum bandwidth consumption that meet the user's security capability requirements, thereby obtaining the best combination of security network elements, that is, the best security service chain strategy combination, and implements and deploys the security service chain based on the best match, continuously optimizes and adjusts, and completes the automatic orchestration process.
[0041] According to SDN, when deploying security service chains based on the optimal strategy combination, the virtualized environment security service chain automatic orchestration deployment model can automatically realize the orchestration of service chain strategies and the automatic deployment of virtual security network elements, and safely dispatch data flows to the corresponding virtual security network elements for security protection, thereby improving the reliability of security protection and reducing management workload. In this process, two key issues need to be completed: 1) Solve the policy conflict problem in the automatic orchestration of security service chains in virtualized environments; 2) Solve the problem of network flow scheduling optimization.
[0042] To solve the above two problems, this application designs a security service chain automatic orchestration deployment model based on particle swarm algorithm, including policy conflict decision nodes and traffic scheduling nodes.
[0043] In the case of conflicts in automatic orchestration decisions, the policy conflict decision node first automatically provides network security protection services for business traffic through the open policy scheduling interface. However, due to the influence of different previous and subsequent policies, there is a high probability that there will be some conflicts between the execution actions. At this time, the optimal policy combination based on the particle swarm algorithm is used to automatically coordinate and manage the relationship between various services, so that the decision node can correctly orchestrate network flow transmission according to the priority of the network service chain, eliminate conflicts in the environment, reduce network congestion, thereby reducing CPU load and CPU utilization, and at the same time transmit the decision results to the corresponding flow adjustment point.
[0044] The traffic scheduling node is responsible for analyzing and managing the virtualized security network elements in the security resource pool, effectively realizing the automatic monitoring of network element load information, outputting the corresponding security flow scheduling configuration according to the security service chain orchestration strategy, parsing the security network element type, and evaluating the best policy scheduling solution from the policy scheduling optimization feedback information. Through the message queue, the actual configured security flow scheduling information policy is automatically transmitted to the traffic scheduling node to realize the directional processing of data traffic. Because the message queue adopts asynchronous communication, the sender (the inbound direction of the traffic, generally refers to the source IP address of the network traffic) sends the message to the queue without waiting for the response of the receiver (the outbound direction of the traffic, generally refers to the destination IP address of the network traffic), thus improving the response speed of the security service chain.
[0045] In order to verify the effectiveness of the method of this application, this application conducted experimental verification, including: To extract the sample parameters, we first need to complete the setting of the characteristic sample parameters: the physical topology of the virtualized environment contains a main core layer switch, and the number of other switches in the aggregation layer and edge layer is defined as N (5) and M (40) respectively. The specific setting of the sample parameters is shown in Table 1. The total number of requests for the virtualized link is set to Z (500 times). To ensure the authenticity of the sample results, a total of K (20 times) tests were conducted under the same parameters. The number of virtual network functions on the security service chain was increased from 1 to 20 according to the number of tests, and the number of requests each time was set to 20.
[0046] Table 1: Test sample parameter settings
[0047] Based on the extracted sample parameters, the experimental data analysis of the average total bandwidth consumption of the zero-touch network orchestration method, the real-time seamless orchestration method and the method adopted in this application was conducted: in the experiment, the same physical topology was input into the virtualized environment, the same number of security service chain requests were input into the three methods, and the average total bandwidth consumption of the three algorithms was compared. The calculation process of the average total bandwidth consumption is shown in the following formula:
[0048] In the formula, represents the average total bandwidth consumption, Indicates the total amount of data. Indicates the data transmission time.
[0049] The average total bandwidth consumption under the three methods is as follows: Figure 2 As shown by Figure 2It can be seen that although the calculation process of the zero-touch network orchestration method is relatively simple and can greatly improve the efficiency of the orchestration algorithm, the corresponding average total bandwidth consumption is relatively high, and the consumption is far greater than the real-time seamless orchestration method and the method of this project. The changes of this method are more stable than the zero-touch network orchestration method and the real-time seamless orchestration method. As the number and types of network elements in the security service chain of the virtualized environment continue to increase, the average total bandwidth consumption of this method can be stably maintained at a certain level. This is mainly because this method sets the minimum total bandwidth as the automatic orchestration goal during the automatic orchestration of the service chain, reducing the total average bandwidth consumption during the automatic orchestration of the virtual environment security service chain, and ensuring that the average total bandwidth consumption can be stably maintained at a certain level.
[0050] Finally, real network data test verification: by extracting a user's real data of about 500Gbps traffic for comparative test verification, under the premise of using the same physical topology structure, the security service chain automatic orchestration deployment model based on the particle swarm algorithm is compared with the traditional SDN-based traffic scheduling model. The tester records the maximum throughput, maximum number of new connections and maximum number of concurrent connections that can be achieved under the two models to obtain a comparison of the test results. Figure 3 , Figure 4 shown.
[0051] Test conclusion: Compared with the traditional SDN-based traffic scheduling technology, the adaptive orchestration and deployment technology of the security service chain based on the particle swarm algorithm can improve the traffic scheduling and detection performance by up to 65% in a virtualized environment, solving many problems of insufficient performance, complex management, and low efficiency in traditional traffic diversion and service chain orchestration technologies.
[0052] In order to better implement a security service chain arrangement method in an embodiment of the present application, based on a security service chain arrangement method, correspondingly, as Figure 5 As shown, the embodiment of the present application also provides a security service chain arrangement device 500, including: The data acquisition unit 501 is used to acquire user security service demand data; The strategy optimization unit 502 is used to use the strategy combination of the security service chain as a particle based on the user security business demand data, initialize the particle group, minimize the total bandwidth consumption of the security service chain as the goal, determine the objective function, calculate the fitness value of the particle based on the objective function, update the speed and position of the particle based on the fitness value, return to recalculate the fitness value of the particle, update the speed and position of the particle, until the number of iterations reaches a preset value, and obtain the optimal strategy combination; The service chain arrangement unit 503 is used to deploy the security service chain based on the optimal strategy combination.
[0053] The security service chain orchestration device 500 provided in the above embodiment can implement the technical solution described in the above security service chain orchestration method embodiment. The specific implementation principles of the above units can refer to the corresponding contents in the above security service chain orchestration method embodiment, which will not be repeated here.
[0054] like Figure 3 As shown, the present application also provides an electronic device 600. The electronic device 600 includes a processor 601, a memory 602 and a display 603. Figure 3 Only some components of the electronic device 600 are shown, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.
[0055] In some embodiments, the memory 602 may be an internal storage unit of the electronic device 600, such as a hard disk or memory of the electronic device 600. In other embodiments, the memory 602 may also be an external storage device of the electronic device 600, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc., equipped on the electronic device 600.
[0056] Furthermore, the memory 602 may include both an internal storage unit of the electronic device 600 and an external storage device. The memory 602 is used to store application software installed in the electronic device 600 and various data.
[0057] In some embodiments, the processor 601 may be a central processing unit (CPU), a microprocessor or other data processing chip, used to run program codes or process data stored in the memory 602, such as the security service chain orchestration method in the present application.
[0058] In some embodiments, the display 603 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch device, etc. The display 603 is used to display information on the electronic device 600 and to display a visual user interface. The components 601-603 of the electronic device 600 communicate with each other via a system bus.
[0059] In some embodiments of the present application, when the processor 601 executes the security service chain orchestration program in the memory 602, the following steps may be implemented: Obtain user security business demand data, and based on the user security business demand data, use the strategy combination of the security service chain as particles to initialize the particle swarm; With the goal of minimizing the total bandwidth consumption of the security service chain, determine the objective function, and calculate the fitness value of the particle based on the objective function; Based on the fitness value, update the speed and position of the particle, return to recalculate the fitness value of the particle, update the speed and position of the particle, until the number of iterations reaches the preset value, and obtain the optimal strategy combination; Deploy security service chains based on the optimal strategy combination.
[0060] It should be understood that: when the processor 601 executes the security service chain orchestration program in the memory 602, in addition to the above functions, other functions can also be implemented. For details, please refer to the description of the corresponding method embodiment above.
[0061] Furthermore, the embodiment of the present application does not specifically limit the type of the electronic device 600 mentioned, and the electronic device 600 may be a portable electronic device such as a mobile phone, a tablet computer, a personal digital assistant (PDA), a wearable device, a laptop computer, etc. Exemplary embodiments of portable electronic devices include but are not limited to portable electronic devices equipped with IOS, Android, Microsoft or other operating systems. The above-mentioned portable electronic devices may also be other portable electronic devices, such as a laptop computer with a touch-sensitive surface (e.g., a touch panel). It should also be understood that in some other embodiments of the present application, the electronic device 600 may not be a portable electronic device, but a desktop computer with a touch-sensitive surface (e.g., a touch panel).
[0062] Accordingly, an embodiment of the present application also provides a computer-readable storage medium, which is used to store computer-readable programs or instructions. When the program or instructions are executed by a processor, the steps or functions of the security service chain orchestration method provided by the above-mentioned method embodiments can be implemented.
[0063] Those skilled in the art will appreciate that all or part of the processes of the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the above-mentioned program can be stored in a computer-readable storage medium, wherein the computer-readable storage medium is a disk, an optical disk, a read-only storage memory, or a random access memory, etc.
[0064] The above is a detailed introduction to a security service chain orchestration method provided by the present application. This article uses specific examples to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for technical personnel in this field, based on the ideas of the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.
[0065] The above is only a preferred specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by any technician familiar with the technical field within the technical scope disclosed in the present application should be covered within the protection scope of the present application.
Claims
1. A security service chain arrangement method, characterized in that: include: S101, obtaining user security service demand data, and based on the user security service demand data, taking the strategy combination of the security service chain as particles to initialize a particle swarm; S102, with the goal of minimizing the total bandwidth consumption of the security service chain, determining an objective function, and calculating the fitness value of the particle based on the objective function; S103, based on the fitness value, updating the speed and position of the particle; S104, return to S103, until the number of iterations reaches a preset value, an optimal strategy combination is obtained, and the security service chain is deployed based on the optimal strategy combination.
2. The method for arranging a security service chain according to claim 1, characterized in that: The policy combination includes the type and quantity of security network elements.
3. The method for arranging a security service chain according to claim 2, characterized in that: The security service chain is composed of several security network elements, the types of which include protection network elements and detection network elements. The calculation formula for the total bandwidth consumption is: In the formula, Indicates the total bandwidth consumption. Indicates the number of protective network elements in the security service chain. Indicates the number of detection network elements in the security service chain. Indicates the bandwidth consumption caused by the protection network element participating in the service traffic forwarding. Indicates the bandwidth consumption caused by the detection network element participating in the service traffic forwarding. Indicates the bandwidth consumption caused by the occupation of protection network element system resources.
4. The method for arranging a security service chain according to claim 3, characterized in that: The calculation formula for the bandwidth consumption caused by the security network element participating in the service traffic forwarding and the bandwidth consumption caused by the security network element system resource occupation is: In the formula, Indicates the bandwidth consumption caused by the security network element participating in the service traffic forwarding. Indicates the bandwidth consumption caused by the occupation of security network element system resources. Indicates the base bandwidth.
5. The method for arranging a security service chain according to claim 1, characterized in that: The objective function also aims to minimize the number of security network elements in the security service chain.
6. The method for arranging a security service chain according to claim 5, characterized in that: The objective function is: In the formula, represents the objective function, Indicates the number of security network elements, Indicates the total bandwidth consumption of the security service chain.
7. The method for arranging a security service chain according to claim 1, characterized in that: Based on the fitness value, updating the speed and position of the particle includes: determining the optimal position of the particle swarm and the historical optimal position of each individual particle in the particle swarm based on the fitness value, and updating the speed and position of the particle based on the optimal position of the particle swarm and the historical optimal position of the individual particle.
8. A security service chain arrangement device, characterized in that: include: A data acquisition unit, used to acquire user security business demand data; A policy optimization unit is used to use the policy combination of the security service chain as a particle based on the user security business demand data, initialize the particle group, minimize the total bandwidth consumption of the security service chain as the goal, determine the objective function, calculate the fitness value of the particle based on the objective function, update the speed and position of the particle based on the fitness value, return to recalculate the fitness value of the particle, update the speed and position of the particle, until the number of iterations reaches a preset value, and obtain the optimal policy combination; The service chain orchestration unit is used to deploy the security service chain based on the optimal strategy combination.
9. An electronic device, characterized in that: including memory and processor; The memory is used to store programs; The processor is coupled to the memory and is used to execute the program stored in the memory to implement the steps of the security service chain orchestration method described in any one of claims 1 to 7 above.
10. A computer-readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by the processor, the steps of the security service chain orchestration method described in any one of claims 1 to 7 are implemented.