A distributed security resource intelligent arrangement method based on multiple resource perception

Abstract

The application provides a kind of distributed security resource intelligent arrangement method based on multiple resource perception, it is related to network security field, the method includes: information collection module is collected from edge cloud node, data center security service request, determines security service function chain (Security Service Function Chaining, SSFC), while collecting the security resource information of cloud security resource pool;SSFC information integration module parses the security virtual network function (Security Virtual Network Function, SVNF) configuration required, the real-time resource usage of infrastructure layer is analyzed by security resource information integration module;Then the integrated information is passed to TTS algorithm execution module, TTS algorithm execution module calculates overall consumption, constructs objective function, adopts two-step Tabu Search (Two-step Tabu Search, TTS) method, optimizes the node and link allocation of SSFC;Finally, the optimized deployment strategy is issued to infrastructure layer execution.The above scheme of the application improves resource utilization and reduces deployment cost.

Description

Technical Field

[0001] This invention relates to the field of network security, and in particular to a distributed intelligent orchestration method for security resources based on multi-resource awareness. Background Technology

[0002] With the deepening of digital transformation, more and more large enterprises are choosing to adopt a multi-cloud, multi-domain architecture to deploy their business nodes in different cloud centers and different network management domains. This architecture typically includes multiple data centers and edge cloud nodes distributed across different geographical locations to better meet localized computing needs and data processing. However, the widespread deployment of this architecture also brings new security challenges. In this environment, each data node may become a potential target for attacks, so effective security protection measures must be implemented to ensure the security and stability of the overall network. Traditional security services typically rely on dedicated hardware devices, such as firewalls and intrusion detection systems. These hardware devices are usually deployed in the enterprise's internal data center, have static characteristics, and their computing and storage capabilities are fixed, unable to be dynamically expanded or reduced according to demand. Security requests in a multi-cloud, multi-domain scenario are dynamic and may change at any time, or new data nodes may be added. Traditional static configurations result in low resource utilization and difficulty in quickly responding to new security threats. At the same time, the purchase, installation, and maintenance costs of hardware devices are high, the upgrade cycle is long, and the coordination and management between multiple hardware devices are complex, often requiring a dedicated technical team for maintenance. This complexity and static nature make the network environment rigid and the cost too high.

[0003] The emergence of Software Defined Network (SDN) and Network Functions Virtualization (NFV) technologies has provided solutions to the above problems. NFV separates network functions from specific hardware devices, and various types of network functions are implemented by software, which is called Virtual Network Function (VNF) [1]. In addition, network services in NFV can be represented as a chain composed of several VNFs in a specific order, which is called Service Function Chain (SFC) [2]. In security scenarios, NFV virtualizes traditional security devices into Security Virtual Network Functions (SVNFs), and manages and orchestrates the Security Virtual Network Functions through SDN technology [3] to form a Security Service Function Chain (SSFC) to provide security services for multiple services. Figure 1As shown, different nodes have numerous protection needs, and the cloud security resource pool contains a multitude of security resources. First, the cloud security management platform needs to collect the storage information of the cloud security resource pool and all security service function chain information, and generate a service chain deployment plan based on this. Then, the deployment strategies in the deployment plan are distributed to the cloud nodes and the cloud security resource pool. The resource pool starts virtualized security protection components on the corresponding physical nodes, and different business nodes access the cloud security resource pool according to specific deployment strategies. This emerging multi-cloud, multi-domain architecture brings significant changes to security requirements. Traditional resource pools often provide one-to-one security services to large enterprises, ensuring that personalized security needs are met without having to share security resource pools with other enterprises. In this context, the design and operation of cloud security resource pools face new challenges, requiring flexible and efficient security service support for different businesses within the same enterprise's multi-cloud, multi-domain environment.

[0004] In multi-cloud, multi-domain scenarios, enterprises can deploy services within a trusted internal environment without worrying about security risks associated with sharing resources across resource pools. However, this trusted internal environment places higher demands on the orchestration of security resources. Security resource pools need to dynamically orchestrate numerous security service function chains based on existing physical resources to meet the security needs of different business nodes within the enterprise, while minimizing resource consumption. Specifically, this requires resource pools to efficiently utilize critical resources such as CPU, memory, and bandwidth to optimize overall performance while meeting security service requirements.

[0005] A Security Service Function Chain (SSFC) is a security processing flow composed of multiple Service Function Networks (SVNFs) arranged in a specific order. The concept of SSFC originates from Service Function Chain (SFC), and its core idea is to chain multiple VNFs together, allowing data flows to pass through different functional modules sequentially according to a pre-defined order. For example, in a typical SSFC, data flows might first pass through a firewall for access control, then through an Intrusion Detection System (IDS) for abnormal traffic detection, and finally through a data encryption module to ensure data confidentiality. In this way, SSFC can provide end-to-end security protection, meeting the security needs of different application scenarios.

[0006] SSFC orchestration refers to how to efficiently deploy and manage SSFCs in a real-world network environment to ensure the reliability of security functions and resource utilization. Currently, SSFC orchestration mainly involves two core issues: first, how to rationally allocate SVNFs across different physical nodes to improve the utilization of computing resources, storage resources, and network bandwidth; and second, how to optimize SSFC traffic paths to reduce network transmission overhead and data processing latency. Existing SSFC orchestration methods are typically based on optimization algorithms, such as Integer Linear Programming (ILP), Mixed Integer Linear Programming (MILP), heuristic algorithms (such as genetic algorithms, ant colony optimization, and particle swarm optimization), and intelligent scheduling methods based on Deep Reinforcement Learning (DRL). These methods have applications in various scenarios, but in multi-cloud and multi-domain environments, due to the complexity of network topology, the heterogeneity of resource distribution, and the diversity of security policies, existing methods still face problems such as high computational complexity and insufficient dynamic adaptability. Therefore, further optimizing SSFC orchestration strategies to more efficiently adapt to multi-cloud and multi-domain environments is one of the key research directions. Summary of the Invention

[0007] This invention addresses the shortcomings of existing technologies by proposing a distributed intelligent orchestration method for security resources based on multi-resource awareness. By aggregating Security Virtual Network Functions (SVNFs) of the same type on a single physical node, it reduces the redundant consumption of instantiated resources and optimizes the overall utilization efficiency of the resource pool. This invention abstracts SSFC deployment as a mixed-integer linear programming problem, with minimizing deployment cost as the optimization objective, and designs a step-by-step tabu search (TTS) algorithm to solve this problem. The TTS algorithm achieves more efficient service chain deployment and lower resource overhead by optimizing node and link allocation in stages.

[0008] To achieve the above objectives, the present invention provides the following technical solution:

[0009] A distributed security resource intelligent orchestration method based on multi-resource awareness includes the following four steps:

[0010] 1. Information Collection: The information collection module collects service requests from edge cloud nodes or data centers; at the same time, it collects security resource information and network topology information from the security resource pool.

[0011] 2. Information Integration: The SSFC information integration module determines the SSFC based on the security service requests collected by the information collection module and parses the required Security Virtual Network Function (SVFN) configuration; the security resource information integration module analyzes the real-time resource usage of the infrastructure layer, including the usage of computing resources, storage resources and bandwidth resources.

[0012] 3. Algorithm Execution: The integrated information from the SSFC information integration submodule and the resource information integration submodule is transmitted to the TTS algorithm execution module. The TTS algorithm execution module uses the step-by-step tabu search (TTS) method to optimize the node and link allocation of the SSFC.

[0013] 4. Strategy Deployment: Deploy the optimized deployment strategy to the infrastructure layer for execution.

[0014] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0015] 1. This invention employs a multi-resource-aware optimization method, optimizing at three levels: computing resources, instantiation resources, and server resources. This improves the resource utilization of SSFCs and reduces unnecessary resource consumption. Traditional methods often fail to adequately consider the repeated consumption of instantiation resources, leading to the repeated instantiation of the same type of SVNFs on multiple physical nodes, resulting in wasted computing and storage resources. This invention proposes a service aggregation strategy, prioritizing the deployment of already instantiated SVNFs of the same type on physical nodes to reduce the computing and storage overhead caused by repeated instantiation and improve the overall utilization efficiency of the resource pool. Furthermore, this invention introduces the number of servers in use as an optimization target in server resource management, ensuring that the number of servers in use is minimized, improving the overall utilization of server resources, reducing resource fragmentation, optimizing the use of computing resources, and simultaneously reducing computing and maintenance costs.

[0016] 2. This invention proposes a step-by-step Tabu Search (TTS) optimization method to improve the deployment optimization efficiency of SSFC and overcome the problems of high computational complexity, long solution time, and susceptibility to local optima in existing optimization methods. Existing optimization methods typically employ a global search strategy, requiring simultaneous calculation of node and link mappings in SVNF, resulting in excessively high computational complexity. This is especially true in multi-cloud, multi-domain environments, where the solution time increases significantly due to a large number of heterogeneous resources and dynamic security requirements. This invention breaks down the SSFC deployment optimization problem into stages, making the optimization process more efficient while reducing computational resource consumption. The TTS algorithm incorporates the global search capability of tabu search during the optimization process and dynamically adjusts the search range to avoid getting trapped in local optima. Furthermore, the TTS algorithm can quickly adjust the deployment strategy during the optimization process, ensuring that the traffic path of the SSFC reaches the optimal level, effectively reducing unnecessary network bandwidth overhead and improving the rationality of resource scheduling. Compared to the Particle Swarm Optimization (PSO) algorithm, the TTS algorithm of this invention can converge to the optimal deployment scheme faster, reduce optimization calculation time, improve computational efficiency, and ensure efficient resource scheduling during SSFC deployment in a large-scale multi-cloud and multi-domain environment.

[0017] In summary, the advantages of this invention lie in improving the utilization of computing resources, instantiation resources, and server resources through a multi-resource-aware optimization method, while improving solution efficiency and computation speed through a step-by-step tabu search optimization solution method, thereby achieving efficient deployment and resource optimization of SSFC in a multi-cloud and multi-domain environment. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0019] Figure 1 A schematic diagram of a cloud security resource pool provided for an example of this invention.

[0020] Figure 2 This is a flowchart illustrating the overall steps of a distributed intelligent orchestration method for secure resources based on multi-resource awareness, as provided in an embodiment of the present invention.

[0021] Figure 3 A general framework diagram of a distributed intelligent orchestration method for secure resources based on multi-resource awareness provided in this embodiment of the invention. Detailed Implementation

[0022] To better understand this technical solution, the method of the present invention will be described in detail below with reference to the accompanying drawings.

[0023] The proposed security service function chain orchestration method based on multi-resource awareness consists of four main steps: information collection, information integration, algorithm execution, and policy deployment. Information collection refers to the multi-cloud management platform receiving user requests and collecting infrastructure information from edge cloud nodes and data centers. Information integration involves analyzing and integrating the collected information to establish a mathematical model, primarily represented by undirected weighted graphs and directed weighted graphs. Algorithm execution abstracts the SSFC orchestration optimization problem into a mixed-integer linear optimization problem, solving it using a stepwise tabu search algorithm. Finally, the optimized deployment policy is deployed to the infrastructure for execution. Figure 1 As shown, it includes the following four steps:

[0024] Step S1: Information Gathering

[0025] Before modeling and algorithm optimization, it is necessary to collect security requests from edge cloud nodes and data centers, as well as security resource information and infrastructure information from existing cloud security resource pools. The specific steps are as follows:

[0026] S1.1, Collect security function requests;

[0027] The information collection module receives security function requests from edge cloud nodes and data centers, extracts key parameters from the requests, including the type of security function requested (e.g., firewall, intrusion detection, data encryption), the type of resource request (e.g., CPU, memory, bandwidth), and latency sensitivity (e.g., XX), and constructs a security function service chain.

[0028] S1.2, Collect information on the cloud security resource pool;

[0029] The information collection module collects information on security component functions (e.g., firewalls, intrusion detection, data encryption), network topology, overall infrastructure resources, currently available infrastructure resources (e.g., CPU, memory, bandwidth), and security resource instantiation information from the cloud security resource pool.

[0030] Step S2: Information Integration

[0031] S2.1, Integration of security resource information;

[0032] Based on the cloud security resource pool information collected in S1, the security resource information integration module represents the underlying network of the resource pool as an undirected weighted graph G. S =(N S L S ), where N S This represents the set of all physical nodes. Each node can deploy one or more SVNFs, providing it with resources such as CPU and memory. S This represents the set of all links, providing bandwidth resources for information transmission between physical nodes. The available CPU resources for physical node n are represented as R. n CPU , n∈N S Available memory resources are represented as R n M , n∈N S The available bandwidth resources of link l are represented as R. l B , l∈L S In addition, to support the service aggregation method, the SVNF type of the physical node that has been instantiated is recorded. The type of the physical node n instantiated is I. n , n∈N S .

[0033] S2.2, SSFC information integration;

[0034] The SSFC information integration module constructs the SSFC based on the key parameters of the user request collected in S1, and parses the required secure virtual network function configuration.

[0035] The security service function chain is connected serially; therefore, this invention connects multiple SSFCs through a directed weighted graph G. r = (S,T) is used to represent V. r ∈S represents the SVNF set of an SSFC request, E r ∈T represents the set of virtual links between each SVNF. D v CPU ,v∈V r This indicates the CPU resources required for the SVNF request to fulfill the business logic; D v M ,v∈V r This indicates the memory resources required by the SVNF request to implement the business logic; DI v CPU ,v∈V r This represents the resources required to instantiate this type of VNF on a physical node; DI v M ,v∈V r This indicates that SVNFs of the same type have the same instantiation resource consumption. e B ,e∈E r This indicates the bandwidth resources required by the virtual link in the SSFC request.

[0036] Step S3: Algorithm Execution

[0037] The SSFC information integration module and the security resource information integration module pass the established graph model data to the TTS algorithm execution model. Then, the TTS algorithm execution model constructs the objective function and executes the stepwise tabu search algorithm to complete the optimization process.

[0038] S3.1 Calculate the total resource consumption

[0039] This invention describes cloud security protection resource deployment as a mixed-integer linear optimization problem. The optimization objective is to minimize the consumption of three types of resources to achieve the deployment of the security service function chain. To satisfy the basic node mapping principle, this invention restricts a single SVNF to be deployed on only one physical node, and different SVNFs in the same SSFC chain cannot be deployed on the same physical node.

[0040]

[0041] in, Indicates SVNF request v i Is it deployed on a physical node? jIf deployment is successful, the value is 1; otherwise, it is 0. Formula (1) indicates that an SVNF can be deployed on one and only one physical node, and formula (2) indicates that for all physical nodes, at most one SSFC SVNF can be deployed on them. Meanwhile, to ensure that the resources of the physical node meet the requirements of the SVNF, it is necessary to ensure that it meets the requirements for instantiation resources and business resources. The node resource consumption formula is as follows:

[0042]

[0043] The two cases in the formula indicate whether the same type of resources have already been deployed on the physical node before SVNF deployment. If they have already been deployed, no instantiation resources are needed. The resource limit formulas for CPU and memory are as follows:

[0044]

[0045] By setting link mapping constraints using formula (7), situations where link resources cannot support the actual SSFC requirements can be avoided. Indicates the virtual link e in the SSFC request i Whether deployed on physical link l j If deployed, the value is 1; otherwise, it is 0.

[0046]

[0047] In summary, the total deployment cost formula for SSFC is:

[0048]

[0049] S3.2 Constructing the objective function

[0050] This invention not only focuses on traditional resource consumption but also considers whether physical nodes have deployed Secure Virtual Network Functions (SVNFs) as a crucial criterion for resource consumption. By optimizing the orchestration of Security Service Function Chains (SSFCs), it ensures that security resources are concentrated on running on as few physical nodes as possible. This strategy yields significant benefits: First, by shutting down physical nodes without deployed SVNFs, unnecessary server operation is reduced, lowering energy consumption and operating costs. This is particularly important in large-scale service cluster environments where energy conservation is a critical consideration for data centers. Second, centralized deployment reduces the waste of fragmented resources. Although there is no direct numerical measure of resource fragmentation, avoiding node fragmentation improves server resource utilization by preventing underutilized resources from being spread across multiple nodes. The number of servers running reflects this information. Based on this, the final objective function is derived:

[0051]

[0052] Where β1 and β2 are the balance factors between physical node resource consumption and link resource consumption, and α1 and α2 are the balance factors between deployment resource consumption and server switching resource consumption, α1+α2=1, β1+β2=1. This indicates that the physical node has SVNF deployed. If the physical node does not have SVNF deployed, then... The value is 0. By adjusting the balance factors β1 and β2 in the objective function according to the actual situation of the resource pool, a more realistic resource consumption is obtained. By default, both β1 and β2 are 0.5.

[0053] S3.3, Execute the tabu search algorithm

[0054] The optimization process of tabu search includes the generation and selection of neighborhood solutions, and the dynamic updating of the tabu list. In each iteration, the algorithm searches for potential better solutions by performing a local search on the neighborhood of the current solution, and avoids repeatedly searching for solutions that have already been visited by using the tabu list. The specific algorithm flow is shown in Algorithm 1. First, the algorithm generates an initial solution IS, assigns it to the current solution CS, and initializes the current solution as the optimal solution BS. The tabu list TL is used to record recently visited solutions, preventing the algorithm from backtracking to these solutions and thus escaping local optima. In each iteration, CS is added to the tabu list to ensure the diversity of search directions. The algorithm generates a neighborhood solution set N and selects the first solution n from it as a candidate solution. If the solution is not in the tabu list and is better than the current solution CS under the objective function, then the current solution CS is updated. When the neighborhood solution set is empty, the algorithm checks whether the current solution is better than the optimal solution BS; if so, the optimal solution is updated. To maintain the length of the tabu list, if the size of the tabu list exceeds a preset length, the algorithm removes the oldest solution. This process is repeated until the number of iterations reaches a predetermined value. Finally, the algorithm outputs the optimal solution BS, which is the optimal deployment plan.

[0055]

[0056]

[0057] The optimal solution (BS) is the optimal deployment plan.

[0058] Strategy distribution:

[0059] Step S4: Policy Distribution

[0060] This step distributes the optimized SSFC orchestration and node / link allocation to the cloud security resource pool infrastructure for execution.

Claims

1. A distributed intelligent orchestration method for secure resources based on multi-resource awareness, characterized in that, The implementation steps include the following: Step S1: Information Gathering: Before modeling and executing optimization algorithms, it is necessary to gather security resource information and infrastructure information from edge cloud nodes, data centers, and existing cloud security resource pools. Step S1.1: Collect security function requests; Step S1.2: Collect security resource information; Step S2: Information Integration: The Security Service Function Chaining (SSFC) information integration module determines the SSFC based on the security function requests collected by the information collection module and parses the required Security Virtual Network Function (SVNF) configuration; the security resource information integration module analyzes the real-time resource usage of the infrastructure layer. Step S2.1: Integration of security resource information; Step S2.2: SSFC information integration; Step S3: Algorithm Execution: The information integrated by the SSFC information integration module and the security resource information integration module is transmitted to the Two-step Tabu Search (TTS) algorithm execution module. The TTS algorithm execution module uses the two-step tabu search method to optimize the node and link allocation of the SSFC. Step S3.1: Calculate the total consumption; Step S3.2: Construct the objective function; Step S3.3: Execute the tabu search algorithm; Step S4: Policy Deployment: Deploy the optimized deployment policy to the infrastructure layer for execution.

2. The distributed security resource intelligent orchestration method based on multi-resource awareness according to claim 1, characterized in that, The specific implementation process of step S1.1 is as follows: Step S1.1: Collect security function requests; The information collection module receives security function requests from edge cloud nodes and data centers, extracts key parameters from the requests, including the type of security function requested, the type of resource request, and latency sensitivity, and constructs a security service function chain.

3. The distributed security resource intelligent orchestration method based on multi-resource awareness according to claim 1, characterized in that, The specific implementation process of step S1.2 is as follows: Step S1.2: Collect security resource information; The information collection module collects information on the functions of security components, network topology, overall infrastructure resources, currently available infrastructure resources, and security resource instantiation in the cloud security resource pool.

4. The distributed secure resource intelligent orchestration method based on multi-resource awareness according to claim 1, characterized in that, The specific implementation process of step S2.1 is as follows: Step S2.1: Integration of security resource information; Based on the security resource information collected in S2, the security resource information integration module represents the underlying network of the resource pool as an undirected weighted graph G. S =(N S ,L S ), where N S This represents the set of all physical nodes, with each node deploying one or more SVNFs and providing them with CPU and memory resources. s This represents the set of all links, where links provide bandwidth resources for information transmission between physical nodes; the available CPU resources for physical node n can be represented as... Available memory resources are represented as The available bandwidth resources of link l are represented as follows: To support service aggregation methods, the SVNF type of the instantiated physical nodes is recorded. The instantiated type of physical node n is I. n ,n∈N S .

5. The distributed security resource intelligent orchestration method based on multi-resource awareness according to claim 1, characterized in that, The specific implementation process of step S2.2 is as follows: Step S2.2: SSFC information integration; The SSFC information integration module constructs the SSFC based on the key parameters of the security function requests collected in S1, and parses the required security virtual network function configurations. The security service function chain is connected serially, therefore multiple SSFCs are connected through a directed weighted graph G. r = (S, T) is used to represent the set of SVNFs of SSFC, where S represents the set of virtual links between each SVNF.

6. The distributed secure resource intelligent orchestration method based on multi-resource awareness according to claim 1, characterized in that, The specific implementation process of step S3.1 is as follows: Step S3.1: Calculate the total consumption; To satisfy basic node mapping principles, an SVNF can only be deployed on one physical node, and different SVNFs in the same SSFC chain cannot be deployed on the same physical node: in, Indicates a security feature request (v) i Is it deployed on physical node n? j Above, the value is 1 if deployment is successful, otherwise it is 0; S represents the SVNF set of SSFC, N S V represents the set of all physical nodes. r This represents the set of all security function requests; Formula (1) indicates that the SVNF to be deployed can only be deployed on one physical node, and Formula (2) indicates that for all physical nodes, at most one SSFC SVNF can be deployed on them; at the same time, in order to ensure that the resources of the physical node meet the resource requirements of the SVNF, it is necessary to ensure that it meets the instantiation resources and business resources. The node resource consumption formula is as follows: in Indicates at physical node n j Deploy security features request v i Required CPU resources Indicates at physical node n j Deploy security features request v i Required memory resources; Indicates a security feature request (v) i Required CPU resources Indicates the memory resources required for security feature requests; This indicates the SVNF type of the vi instance that the security feature request is made of. Indicates deployment on node n j All instantiated SVNF types; Indicates in security feature request v i Instantiate as The CPU resources required for this type of SVNF Indicates in security feature request v i Instantiation The memory resources required for the SVNF type; The two cases in the formula indicate whether the same type of resources have already been deployed on the physical node before SVNF deployment. If they have already been deployed, no instantiation resources are needed. The resource limit formulas for CPU and memory are as follows: in Represents physical node n j Remaining available CPU resources Represents physical node n j The remaining available memory resources; by setting link mapping constraints through formula (7), the situation where the link resources cannot support the actual SSFC requirements is avoided, where Indicates the virtual link e in the SSFC request i Whether deployed on physical link l j If deployed, it is 1; otherwise, it is 0. r For the set of all virtual links, L S For the set of all physical links; Indicates virtual link e in SSFC request i The bandwidth resources required Indicates physical link l j Remaining bandwidth resources; In summary, the total deployment cost formula for SSFC is as follows:

7. The distributed secure resource intelligent orchestration method based on multi-resource awareness according to claim 6, characterized in that, The specific implementation process of step S3.2 is as follows: Step S3.2: Construct the objective function; Based on the SSFC deployment total consumption formula, step S3 describes the deployment of cloud security protection resources as a mixed integer linear optimization problem. The optimization objective of the problem is to minimize the consumption of the three types of resources to achieve the deployment of the security service function chain. Construct the objective function as follows Where β1 and β2 are the balance factors between physical node resource consumption and link resource consumption, and α1 and α2 are the balance factors between deployment resource consumption and server on / off resource consumption, α1+α2=1, β1+β2=1. Representing physical node n i If SVNF is deployed, and physical node n i If SVNF is not deployed, then The tabu search algorithm is adopted, sacrificing some accuracy to obtain an approximate optimal solution, which significantly optimizes the time performance of the solution. The searched solutions are recorded, and repeated selections are avoided within a certain period through a tabu list, thereby improving search efficiency and preventing the algorithm from getting trapped in local optima. Finally, the optimized node and link allocation strategy is obtained.

8. The distributed security resource intelligent orchestration method based on multi-resource awareness according to claim 1, characterized in that, The specific implementation process of step S3.3 is as follows: Step S3.3: Execute the tabu search algorithm; The optimization process of tabu search includes the generation and selection of neighborhood solutions, as well as the dynamic updating of the tabu list. In each iteration, the algorithm searches for potential better solutions by performing a local search on the neighborhood of the current solution, and avoids repeatedly searching for solutions that have already been visited by using the tabu list. First, the algorithm generates an initial solution IS, assigns it to the current solution CS, and initializes the current solution as the optimal solution BS. The tabu list TL is used to record recently visited solutions, preventing the algorithm from backtracking to these solutions and thus escaping local optima. In each iteration, CS is added to the tabu list to ensure the diversity of search directions; the algorithm generates a neighborhood solution set N and selects the first solution n from it as a candidate solution; If the solution is not in the tabu list and is better than the current solution CS under the objective function, then update the current solution CS. When the neighborhood solution set is empty, the algorithm checks whether the current solution is better than the optimal solution BS. If so, the optimal solution is updated. To maintain the length of the tabu list, if the size of the tabu list exceeds the preset length, the algorithm will remove the oldest solution. This process is repeated until the number of iterations reaches the predetermined value. Finally, the algorithm outputs the found optimal solution BS, which is the optimal deployment scheme.

9. The distributed security resource intelligent orchestration method based on multi-resource awareness according to claim 1, characterized in that, Step S4 ultimately distributes the optimal deployment plan to edge cloud nodes, data centers, and cloud security resource pool infrastructure for execution.

Images