Distributed security resource intelligent arrangement method based on multiple resource awareness

Abstract

The invention provides a distributed security resource intelligent arrangement method based on multiple resource awareness, and relates to the field of network security, and the method comprises the following steps: an information collection module collects security service requests from edge cloud nodes and a data center, determines a security service function chain (SSFC), and collects security resource information of a cloud security resource pool at the same time; the SSFC information integration module is used for analyzing the required configuration of a security virtual network function (SVNF), and the security resource information integration module is used for analyzing the real-time resource use condition of the infrastructure layer; the method comprises the following steps: firstly, integrating information of SSFC, then transmitting the integrated information to a TTS algorithm execution module, calculating total consumption by the TTS algorithm execution module, constructing an objective function, and optimizing node and link distribution of the SSFC by adopting a Twood-step Tabu Search (TTS) method; and finally, issuing the optimized deployment strategy to an infrastructure layer for execution. According to the scheme, the resource utilization rate is improved, and the deployment cost is reduced.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a distributed security resource intelligent orchestration method based on multiple resource perception. Background Art

[0002] With the deepening of digital transformation, more and more large enterprises choose to adopt multi-cloud and multi-domain architecture to deploy their business nodes in different cloud centers and different network management domains. This architecture usually includes multiple data centers and edge cloud nodes distributed in different geographical locations to better meet localized computing needs and data processing. However, the widespread deployment of this architecture also brings new security challenges. In this environment, each data node may become a potential target of attack, so effective security protection measures must be implemented to ensure the security and stability of the overall network. Traditional security services usually rely on dedicated hardware devices, such as firewalls and intrusion detection systems. These hardware devices are usually deployed in the internal data center of the enterprise, have static characteristics, and have fixed computing and storage capabilities. They cannot be dynamically expanded or reduced according to demand. Security requests in multi-cloud and multi-domain scenarios are dynamically changing, and different requirements may occur at any time, or new data nodes may be connected. Traditional static configuration leads to low resource utilization and difficulty in quickly responding to new security threats. At the same time, the purchase, installation and maintenance costs of hardware equipment are high, the replacement cycle is long, and the coordination and management between multiple hardware devices are complex, often requiring a dedicated technical team for maintenance. This complexity and static nature make the network environment rigid and the cost expenditure too high.

[0003] The emergence of Software Defined Network (SDN) and Network Function Virtualization (NFV) technologies has provided solutions to the above problems. NFV separates network functions from specific hardware devices, and various types of network functions are implemented by software, which are called Virtual Network Functions (VNFs) [1]. In addition, network services in NFV can be represented as a chain consisting of several VNFs in a specific order, called a Service Function Chain (SFC) [2]. In security scenarios, NFV virtualizes traditional security devices into Security Virtual Network Functions (SVNFs), manages and orchestrates security virtual network functions through SDN technology [3], and forms a Security Service Function Chain (SSFC) to provide security services for multiple businesses. Figure 1As shown in the figure, different nodes have many protection requirements, and the cloud security resource pool contains many security resources. First, the cloud security management platform needs to collect the storage information of the cloud security resource pool and all the security service function chain information, and generate a service chain deployment plan based on this. Then, the deployment strategies in the deployment plan are sent to the cloud nodes and the cloud security resource pool. The resource pool starts the virtualized security protection components on the corresponding physical nodes, and different business nodes are connected to the cloud security resource pool according to the specific deployment strategy. This emerging multi-cloud and multi-domain architecture has brought about significant changes in security requirements. Traditional resource pools often provide one-to-one security services for large enterprises to ensure that the personalized security needs of customers are met without having to share security resource pools with other enterprises. In this context, the design and operation and maintenance of cloud security resource pools face new challenges, and need to provide flexible and efficient security service support for different businesses in the multi-cloud and multi-domain environment within the same enterprise.

[0004] In a multi-cloud, multi-domain scenario, enterprises can deploy services in a trusted internal environment without having to worry about the potential security risks of cross-resource pool sharing. However, this internal trusted scenario places higher demands on the orchestration of security resources. The security resource pool needs to dynamically orchestrate numerous security service function chains based on existing physical resources to meet the security needs of different business nodes of the enterprise while minimizing resource consumption. Specifically, this requires the resource pool to efficiently utilize key resources such as CPU, memory, and bandwidth to optimize overall performance while meeting security service requirements.

[0005] The Security Service Function Chain (SSFC) is a security processing flow composed of multiple SVNFs in a specific order. The concept of SSFC originates from the Service Function Chain (SFC). Its core idea is to connect multiple VNFs in series so that the data flow passes through different functional modules in a preset order. For example, in a typical SSFC, the data flow may first pass through a firewall for access control, then pass through an intrusion detection system (IDS) for abnormal traffic detection, and finally ensure the confidentiality of the data through a data encryption module. In this way, SSFC can provide end-to-end security protection to meet the security requirements of different application scenarios.

[0006] The orchestration method of SSFC refers to how to efficiently deploy and manage SSFC in the actual network environment to ensure the reliability of security functions and resource utilization. At present, the orchestration of SSFC mainly involves two core issues: one is how to reasonably allocate SVNFs on different physical nodes to improve the utilization of computing resources, storage resources and network bandwidth; the other is how to optimize the traffic path of SSFC to reduce network transmission overhead and data processing delay. Existing SSFC orchestration methods are usually based on optimization algorithms, such as integer linear programming (ILP), mixed integer linear programming (MILP), heuristic algorithms (such as genetic algorithms, ant colony algorithms, particle swarm optimization) and intelligent scheduling methods based on deep reinforcement learning (DRL). These methods have certain applications in different application scenarios, but in a multi-cloud and multi-domain environment, due to the complexity of network topology, heterogeneity of resource distribution and diversity of security policies, the existing methods still face problems such as high computational complexity and insufficient dynamic adaptability. Therefore, further optimizing the orchestration strategy of SSFC so that it can adapt to the multi-cloud and multi-domain environment more efficiently is one of the key directions of current research. Summary of the invention

[0007] In view of the shortcomings of the prior art, the present invention proposes a distributed security resource intelligent orchestration method based on multiple resource perception, which reduces the repeated consumption of instantiated resources and optimizes the overall utilization efficiency of the resource pool by aggregating the same type of security virtual network functions (SVNF) on a physical node. The present invention abstracts the SSFC deployment as a mixed integer linear programming problem, takes minimizing the deployment cost as the optimization goal, and designs a step-by-step taboo search (TTS) algorithm to solve the mixed integer linear programming problem. The TTS algorithm achieves more efficient service chain deployment and lower resource overhead by optimizing the allocation of nodes and links in stages.

[0008] In order to achieve the above object, the present invention provides the following technical solutions:

[0009] A distributed security resource intelligent orchestration method based on multiple resource perception includes the following four steps:

[0010] 1. Information collection: The information collection module collects service requests from edge cloud nodes or data centers; and collects security resource information and network topology information from the security resource pool;

[0011] 2. Information integration: The SSFC information integration module determines the SSFC based on the security service requests collected by the information collection module and parses the required security virtual network function (SVFN) configuration; the security resource information integration module analyzes the real-time resource usage of the infrastructure layer, including the usage of computing resources, storage resources, and bandwidth resources;

[0012] 3. Algorithm execution: The information integrated by the SSFC information integration submodule and the resource information integration submodule is transmitted to the TTS algorithm execution module. The TTS algorithm execution module uses the step-by-step taboo search (TTS) method to optimize the node and link allocation of SSFC.

[0013] 4. Policy distribution: The optimized deployment strategy is distributed to the infrastructure layer for execution.

[0014] Compared with the prior art, the present invention has the following beneficial effects:

[0015] 1. The present invention adopts a multi-resource-aware optimization method to optimize at three levels: computing resources, instantiated resources, and server resources, thereby improving the resource utilization of SSFC and reducing unnecessary resource consumption. Traditional methods usually do not fully consider the repeated consumption of instantiated resources, resulting in repeated instantiation of SVNFs of the same type on multiple physical nodes, resulting in a waste of computing and storage resources. The present invention proposes a service aggregation strategy to preferentially deploy instantiated SVNFs of the same type on physical nodes to reduce the computing and storage overhead caused by repeated instantiation and improve the overall utilization efficiency of the resource pool. In addition, the present invention introduces the number of enabled servers as an optimization target in terms of server resource management to ensure that the number of enabled servers is minimized, improve the overall utilization of server resources, reduce resource fragmentation, optimize the use of computing resources, and reduce computing and operation and maintenance costs.

[0016] 2. The present invention proposes a step-by-step taboo search (TTS) optimization solution method to improve the deployment optimization efficiency of SSFC and overcome the problems of high computational complexity, long solution time, and easy to fall into local optimality in existing optimization methods. Existing optimization methods usually adopt an overall search strategy, which requires the simultaneous calculation of the node mapping and link mapping of SVNF, resulting in excessively high computational complexity. Especially in a multi-cloud and multi-domain environment, facing a large number of heterogeneous resources and dynamic security requirements, the solution time increases significantly. The present invention splits the deployment optimization problem of SSFC by a staged optimization method, making the optimization process more efficient and reducing the consumption of computing resources. The TTS algorithm combines the global search capability of taboo search in the optimization process, and dynamically adjusts the search range to avoid the search from falling into local optimality. In addition, the TTS algorithm can quickly adjust the deployment strategy during the optimization process, so that the traffic path of SSFC is optimized, effectively reducing unnecessary network bandwidth overhead and improving the rationality of resource scheduling. Compared with the particle swarm optimization (PSO) algorithm, the TTS algorithm of the present invention can converge to the optimal deployment solution faster, reduce the optimization calculation time, improve the calculation efficiency, and ensure efficient resource scheduling during the SSFC deployment process in a large-scale multi-cloud and multi-domain environment.

[0017] In summary, the advantage of the present invention lies in improving the utilization of computing resources, instantiated resources and server resources through a multi-resource-aware optimization method, while improving the solution efficiency and calculation speed through a step-by-step taboo search optimization solution method, thereby realizing efficient deployment and resource optimization of SSFC in a multi-cloud and multi-domain environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0019] Figure 1 A schematic diagram of a cloud security resource pool provided for an example of the present invention.

[0020] Figure 2 An overall step diagram of a distributed security resource intelligent orchestration method based on multiple resource perception provided by an embodiment of the present invention.

[0021] Figure 3 A general framework diagram of a distributed security resource intelligent orchestration method based on multiple resource perception provided by an embodiment of the present invention DETAILED DESCRIPTION

[0022] In order to better understand the technical solution, the method of the present invention is described in detail below with reference to the accompanying drawings.

[0023] The security service function chain orchestration method based on multi-resource perception proposed in the present invention mainly consists of four steps, namely information collection, information integration, algorithm execution and policy delivery. Information collection refers to the multi-cloud management platform receiving user requests from edge cloud nodes and data centers and collecting infrastructure information of the security resource pool; information integration refers to analyzing and integrating the collected information and establishing a mathematical model, mainly expressed in the form of undirected weighted graphs and directed weighted graphs; algorithm execution refers to abstracting the SSFC orchestration optimization problem into a mixed integer linear optimization problem, and using a step-by-step taboo search algorithm to solve it; and finally delivering the optimized deployment strategy to the infrastructure for execution. Figure 1 As shown, it includes the following four steps:

[0024] Step S1: Information collection

[0025] Before modeling and algorithm optimization, it is necessary to collect security requests from edge cloud nodes and data centers and security resource information and infrastructure information from the existing cloud security resource pool. The specific steps are as follows:

[0026] S1.1. Collect security feature requests;

[0027] The information collection module receives security function requests from edge cloud nodes and data centers, extracts key parameters in the requests, including the requested security function type (for example: firewall, intrusion detection, data encryption), resource request type (for example: CPU, memory, bandwidth) and delay sensitivity (for example: XX), and builds a security function service chain.

[0028] S1.2. Collect cloud security resource pool information;

[0029] The information collection module collects information on security component functions (e.g., firewall, intrusion detection, data encryption) in the cloud security resource pool, network topology information, overall infrastructure resource information and currently available infrastructure resource information (e.g., CPU, memory, bandwidth), and security resource instantiation information.

[0030] Step S2: Information integration

[0031] S2.1, Security resource information integration;

[0032] The security resource information integration module represents the underlying network of the resource pool as an undirected weighted graph G according to the cloud security resource pool information collected in S1. S =(N S , L S ), where N S Represents the set of all physical nodes. Each node can deploy one or more SVNFs and provide resources such as CPU and memory. S Represents the set of all links, providing bandwidth resources for information transmission between physical nodes. The available CPU resources of physical node n are represented by R n CPU , n∈N S , the available memory resources are represented by R n M , n∈N S , the available bandwidth resource of link l is represented by R l B , l∈L S At the same time, in order to support the service aggregation method, the SVNF type that has been instantiated on the physical node is recorded. The type of the instantiation of the physical node n is I n , n∈N S .

[0033] S2.2, SSFC information integration;

[0034] The SSFC information integration module builds SSFC based on the key parameters of user requests collected in S1 and parses the required secure virtual network function configuration.

[0035] The security service function chains are connected in a serial manner. Therefore, the present invention connects multiple SSFCs through a directed weighted graph G r =(S,T), where V r ∈S represents the SVNF set of a SSFC request, E r ∈T represents the set of virtual links between each SVNF. v CPU , v∈V r Indicates the CPU resources required by the SVNF to implement the service; D v M , v∈V r Indicates the memory resources required by the SVNF to implement the service. v CPU , v∈V r Indicates the resources required to instantiate this type of VNF on a physical node; DI v M ,v∈V r This means that SVNFs of the same type have the same instantiation resource consumption. e B ,e∈E r Indicates the bandwidth resources required by the virtual link in the SSFC request.

[0036] Step S3: Algorithm execution

[0037] The SSFC information integration module and the security resource information integration module pass the established graph model data to the TTS algorithm execution model, which then constructs the objective function and executes the step-by-step taboo search algorithm to complete the optimization process:

[0038] S3.1. Calculate overall resource consumption

[0039] The present invention describes cloud security protection resource deployment as a mixed integer linear optimization problem. The optimization goal of the problem is to minimize the consumption of three resources to achieve security service function chain deployment. In order to meet the basic node mapping principle, the present invention limits one SVNF to be deployed on only one physical node. Different SVNFs in the same SSFC chain cannot be deployed on the same physical node:

[0040]

[0041] in, Indicates SVNF request v i Whether to deploy on a physical node j, if the deployment is successful, the value is 1, otherwise it is 0. Formula (1) indicates that the SVNF to be deployed can and can only be deployed on one physical node, and formula (2) indicates that for all physical nodes, at most one SVNF of SSFC can be deployed on it. At the same time, in order to ensure that the resources of the physical node meet the resources required by the SVNF, it is necessary to ensure that it meets the instantiation resources and business resources. The node resource consumption formula is as follows:

[0042]

[0043] The two cases in the formula respectively indicate whether the same type of resources have been deployed on the physical node before SVNF deployment. If they have been deployed, no instantiation resources need to be consumed. The resource limit formulas for CPU and memory are as follows:

[0044]

[0045] The link mapping constraint is set by formula (7) to avoid the situation where the link resources cannot support the actual SSFC demand. Indicates the virtual link e in the SSFC request i Whether it is deployed on the physical link j If deployed, it is 1, otherwise it is 0.

[0046]

[0047] In summary, the total cost formula for SSFC deployment is:

[0048]

[0049] S3.2. Constructing the objective function

[0050] The present invention not only focuses on traditional resource consumption, but also takes whether the physical node deploys a secure virtual network function (SVNF) as one of the important criteria for resource consumption. By optimizing the orchestration of the security service function chain (SSFC), it ensures that security resources are concentrated on as few physical nodes as possible. This strategy can bring significant benefits: First, by shutting down physical nodes where SVNF is not deployed, unnecessary server operations are reduced, energy consumption and operating costs are reduced. Especially in large-scale service cluster environments, energy conservation becomes an important consideration for data centers. Secondly, centralized deployment can reduce the waste of fragmented resources. Although there is no direct numerical value to measure resource fragmentation, avoiding node fragmentation is to improve server resource utilization and avoid underutilized resources being scattered on multiple nodes. This information can be reflected based on the number of servers turned on. Based on this, the final objective function is derived:

[0051]

[0052] Among them, β1 and β2 are the balance factors between physical node resource consumption and link resource consumption, α1 and α2 are the balance factors between deployment resource consumption and server switch resource consumption, α1+α2=1, β1+β2=1. Indicates that SVNF is deployed on the physical node. If SVNF is not deployed on the physical node, is 0. By adjusting the balance factors β1 and β2 in the objective function according to the actual situation of the resource pool, a more realistic resource consumption can be obtained. By default, β1 and β2 are both 0.5.

[0053] S3.3. Execute the taboo search algorithm

[0054] The optimization process of taboo search includes the generation and selection of neighborhood solutions and the dynamic update of the taboo list. In each iteration, the algorithm searches the neighborhood of the current solution locally to find potential better solutions, and avoids repeated searches of solutions that have been visited through the taboo list. The specific process of the algorithm is shown in Algorithm 1. First, the algorithm generates an initial solution IS, assigns it to the current solution CS, and initializes the current solution to the optimal solution BS. The taboo list TL is used to record the most recently visited solutions to prevent the algorithm from backtracking to these solutions and thus jumping out of the local optimum. In each iteration, CS will be added to the taboo list to ensure the diversity of search directions. The algorithm generates a neighborhood solution set N and selects the first solution n as a candidate solution. If the solution is not in the taboo list and is better than the current solution CS under the objective function, the current solution CS is updated. When the neighborhood solution set is empty, the algorithm checks whether the current solution is better than the optimal solution BS. If so, the optimal solution is updated. In order to maintain the length of the taboo list, if the size of the taboo list exceeds the preset length, the algorithm will remove the earliest solution. This process is repeated until the number of iterations reaches the predetermined value. Finally, the algorithm outputs the optimal solution BS, that is, the optimal deployment plan.

[0055]

[0056]

[0057] The optimal solution BS is the optimal deployment solution.

[0058] Policy issuance:

[0059] Step S4: Policy issuance

[0060] This step sends the optimized SSFC orchestration and node and link allocation to the cloud security resource pool infrastructure for execution.

Claims

1. A distributed security resource intelligent orchestration method based on multiple resource perception, characterized in that: The implementation steps include: Step S1: Information collection: Before modeling and executing the optimization algorithm, it is necessary to collect security resource information and infrastructure information from edge cloud nodes, data centers, and existing cloud security resource pools; Step S1.1, collecting security function requests; Step S1.2, collecting cloud security resource pool information; Step S2: Information integration: The SSFC information integration module determines the SSFC based on the security service requests collected by the information collection module and parses the required security virtual network function configuration; the security resource information integration module analyzes the real-time resource usage of the infrastructure layer; Step S2.1: security resource information integration; Step S2.2: SSFC information integration; Step S3: Algorithm execution: The information integrated by the SSFC information integration submodule and the resource information integration submodule is transmitted to the TTS algorithm execution module, and the TTS algorithm execution module adopts a step-by-step taboo search method to optimize the node and link allocation of the SSFC; Step S3.1: Calculate the overall consumption; Step S3.2: constructing the objective function; Step S3.3: Execute the tabu search algorithm; Step S4: Policy delivery: The optimized deployment strategy is delivered to the infrastructure layer for execution.

2. According to claim 1, a distributed security resource intelligent arrangement method based on multiple resource perception is characterized in that: The specific implementation process of step S1.1 is as follows: Step S1.1, collecting security function requests; The information collection module receives security function requests from edge cloud nodes and data centers, extracts key parameters in the requests, including the requested security function type, resource request type, and delay sensitivity, and builds a security function service chain.

3. According to the method of distributed security resource intelligent arrangement based on multiple resource perception according to claim 1, it is characterized in that: The specific implementation process of step S1.2 is as follows: Step S1.2 collects cloud security resource pool information; The information collection module collects security component function information, network topology information, overall infrastructure resource information, currently available infrastructure resource information, and security resource instantiation information in the cloud security resource pool.

4. According to the method of distributed security resource intelligent arrangement based on multiple resource perception according to claim 1, it is characterized in that: The specific implementation process of step S2.1 is as follows: Step S2.1: security resource information integration; The security resource information integration module represents the underlying network of the resource pool as an undirected weighted graph G according to the cloud security resource pool information collected in S2. S =(N S , L S ), where L S Represents the set of all physical nodes. Each node can deploy one or more SVNFs and provide resources such as CPU and memory. S Represents the set of all links, providing bandwidth resources for information transmission between physical nodes. The available CPU resources of physical node n are represented by R n CPU , n∈N S , the available memory resources are represented by R n M , n∈N S , the available bandwidth resource of link l is represented by R l B , l∈L S At the same time, in order to support the service aggregation method, the SVNF type that has been instantiated on the physical node is recorded. The type instantiated on the physical node n is I n , n∈N S .

5. According to the method of distributed security resource intelligent arrangement based on multiple resource perception according to claim 1, it is characterized in that: The specific implementation process of step S2.2 is as follows: Step S2.2: SSFC information integration; The SSFC information integration module builds SSFC based on the key parameters of user requests collected in S1 and parses the required secure virtual network function configuration; The security service function chains are connected in a serial manner. Therefore, the present invention connects multiple SSFCs through a directed weighted graph G r =(S, T), where V r ∈S represents the SVNF set of a SSFC request, E r ∈T represents the set of virtual links between each SVNF; D v CPU , v∈V r Indicates the CPU resources required by the SVNF to implement the service; D v M , v∈V r Indicates the memory resources required by the SVNF to implement the service; D I v CPU , v∈V r Indicates the resources required to instantiate this type of VNF on a physical node; DI v M , v∈V r This means that the same type of SVNFs have the same instantiation resource consumption; D e B , e∈E r Indicates the bandwidth resources required by the virtual link in the SSFC request.

6. The method for intelligently arranging distributed security resources based on multiple resource perception according to claim 1, characterized in that: The specific implementation process of step S3.1 is as follows: Step S3.1: Calculate the overall consumption; In order to meet the basic node mapping principle, the present invention restricts one SVNF to be deployed on only one physical node, and different SVNFs in the same SSFC chain cannot be deployed on the same physical node: in, Indicates SVNF request v i Whether to deploy on a physical node j , if the deployment is successful, the value is 1, otherwise it is 0; Formula (1) indicates that the SVNF to be deployed can and can only be deployed on one physical node, and Formula (2) indicates that for all physical nodes, at most one SVNF of SSFC can be deployed on them; at the same time, in order to ensure that the resources of the physical node meet the resources required by the SVNF, it is necessary to ensure that it meets the instantiation resources and business resources. The node resource consumption formula is as follows: The two cases in the formula respectively indicate whether the same type of resources have been deployed on the physical node before SVNF deployment. If they have been deployed, no instantiation resources need to be consumed. The resource limit formulas for CPU and memory are as follows: The link mapping constraint is set by formula (7) to avoid the situation where the link resources cannot support the actual SSFC demand. Indicates the virtual link e in the SSFC request i Whether it is deployed on the physical link j On, if deployed, it is 1, otherwise it is 0; In summary, the total cost formula for SSFC deployment is:

7. The method for intelligently arranging distributed security resources based on multiple resource perception according to claim 1, characterized in that: The specific implementation process of step S3.2 is as follows: Step S3.2: constructing the objective function; According to the total consumption formula of SSFC deployment, the cloud security protection resource deployment is described as a mixed integer linear optimization problem in step S3. The optimization goal of the problem is to minimize the consumption of three resources to achieve the deployment of the security service function chain; The objective function is constructed as Where β1 and β2 are the balancing factors between physical node resource consumption and link resource consumption, α1 and α2 are the balancing factors between deployment resource consumption and server switch resource consumption, α1+α2=1, β1+β2=1; Indicates that SVNF is deployed on the physical node. If SVNF is not deployed on the physical node, The present invention adopts a taboo search algorithm, sacrificing some accuracy to obtain an approximate optimal solution, significantly optimizing the time performance of the solution; recording the searched solutions, and avoiding repeated selection within a certain period through a taboo list, thereby improving the search efficiency and preventing the algorithm from falling into a local optimal solution; and finally obtaining an optimized node and link allocation strategy.

8. The method for intelligently arranging distributed security resources based on multiple resource perception according to claim 1, characterized in that: The specific implementation process of step S3.3 is as follows: Step S3.3: Execute the tabu search algorithm; The optimization process of taboo search includes the generation and selection of neighborhood solutions and the dynamic update of the taboo list. In each iteration, the algorithm searches for potential better solutions by performing a local search in the neighborhood of the current solution, and avoids repeated searches of solutions that have been visited through the taboo list. The specific process of the algorithm is shown in Algorithm 1. First, the algorithm generates an initial solution IS, assigns it to the current solution CS, and initializes the current solution to the optimal solution BS. The taboo list TL is used to record the most recently visited solutions to prevent the algorithm from backtracking to these solutions and thus jumping out of the local optimum. In each iteration, CS is added to the taboo list to ensure the diversity of search directions; the algorithm generates a neighborhood solution set N and selects the first solution n as the candidate solution; If the solution is not in the taboo list and is better than the current solution CS under the objective function, the current solution CS is updated; when the neighborhood solution set is empty, the algorithm checks whether the current solution is better than the optimal solution BS, and if so, updates the optimal solution; in order to maintain the length of the taboo list, if the size of the taboo list exceeds the preset length, the algorithm will remove the earliest solution. This process is repeated until the number of iterations reaches the predetermined value; Finally, the algorithm outputs the optimal solution BS found, that is, the optimal deployment plan; The optimal solution BS is the optimal deployment solution.

9. The method for intelligently arranging distributed security resources based on multiple resource perception according to claim 1, characterized in that: Step S4 finally sends the optimal deployment plan to the edge cloud nodes, data centers, and cloud security resource pool infrastructure for execution.

Images