Network security task scheduling method and system

Abstract

The invention discloses a network security task scheduling method and system, and the method comprises the steps: constructing a revenue function decision model which is used for calculating a revenue value of a network security task; the input network security tasks are stored in a to-be-executed task queue, the to-be-executed task queue stores to-be-processed network security tasks according to a task arrival time sequence, and arrival time stamps, expected completion time and required resource types of all the tasks are recorded; acquiring a multi-dimensional matrix representing the states of current available computing resources, storage resources and network resources of the system; according to the revenue function decision model and the multi-dimensional matrix, calculating a scheduling sequence of each network security task in the to-be-executed task queue; generating a task scheduling scheme according to the scheduling sequence; and executing the task scheduling scheme, and scheduling and executing the network security task. According to the invention, the problems of single network security task scheduling strategy and unreasonable resource allocation in the prior art can be solved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network security task scheduling method and system. Background Art

[0002] With the rapid development of information technology, the scheduling of network security tasks has become a key link in maintaining the security of the network environment. These tasks involve multiple aspects such as defending against network attacks, monitoring abnormal behaviors, and responding to security incidents, which are crucial for protecting personal privacy, corporate data, and national security. However, as network threats continue to evolve, the scale and complexity of network security tasks are also increasing, which puts higher requirements on scheduling methods.

[0003] At present, network security task scheduling mainly relies on some traditional strategies, such as first-in-first-out (FIFO) or fixed priority-based scheduling methods. These methods are simple and easy to implement, but they fail to fully consider the security value and time sensitivity of the task, and cannot flexibly adjust the scheduling strategy according to the changes in task characteristics and network environment. At the same time, the existing scheduling methods also have shortcomings in system resource management, lacking the ability to monitor and dynamically adjust resource status in real time, which often leads to unbalanced resource allocation and affects the efficiency and effectiveness of task execution. Summary of the invention

[0004] In view of this, the present application provides a network security task scheduling method and system, which solves the problems of single network security task scheduling strategy and unreasonable resource allocation in the prior art.

[0005] The present application provides a network security task scheduling method, including:

[0006] Constructing a benefit function decision model, wherein the benefit function decision model is used to calculate the benefit value of a network security task, and the benefit function decision model includes a security value assessment module, a time urgency assessment module, and a resource consumption assessment module;

[0007] The input network security task is stored in a queue of pending tasks, wherein the queue of pending tasks stores pending network security tasks in the order of task arrival time, and records the arrival timestamp, expected completion time and required resource type of each task;

[0008] Obtain a multidimensional matrix representing the current status of available computing resources, storage resources, and network resources of the system;

[0009] Calculating the scheduling order of each network security task in the to-be-executed task queue according to the profit function decision model and the multidimensional matrix;

[0010] Generate a task scheduling plan according to the scheduling order;

[0011] Execute the task scheduling plan to schedule the execution of the network security task.

[0012] The constructing of the profit function decision model includes:

[0013] Build a multi-layer evaluation model based on deep neural networks to evaluate the safety value, time urgency and resource consumption of tasks;

[0014] Collect historical task data including task feature data and actual effect data;

[0015] The historical task data is used to train the parameters of the multi-layer evaluation model through a back-propagation algorithm to obtain a profit function decision model.

[0016] The step of storing the input network security task into a queue of tasks to be executed includes:

[0017] Obtain basic attribute information of the task, including task type, expected execution time, resource requirements, and impact scope;

[0018] Assign a unique identifier and timestamp to each task;

[0019] Create a task dependency graph to record the pre- and post-task dependencies;

[0020] The basic attribute information, identifier, timestamp and dependency of the task are stored in the task queue data structure.

[0021] The network security task scheduling method also includes:

[0022] Based on the task arrival timestamp, calculate the waiting time of the task in the queue;

[0023] Dynamically adjust the time urgency weight of the task according to the task type and waiting time;

[0024] When the task waiting time exceeds the preset threshold, the priority enhancement mechanism is triggered;

[0025] Updates the basic attribute information of the task in the queue.

[0026] The obtaining of a multidimensional matrix representing the current status of available computing resources, storage resources, and network resources of the system includes:

[0027] Real-time collection of CPU usage, memory usage, and network bandwidth usage of each computing node in the system;

[0028] Summarize the available capacity and usage thresholds of various resources;

[0029] Based on the CPU usage, memory usage, network bandwidth usage of each computing node, and the available capacity and usage threshold of various resources, a multidimensional matrix reflecting resource status and constraints is constructed;

[0030] Periodically update a multidimensional matrix.

[0031] The calculating the scheduling order of each network security task in the to-be-executed task queue according to the profit function decision model and the multidimensional matrix includes:

[0032] Acquire information about network security tasks from the queue of tasks to be executed;

[0033] Extracting characteristic data of the network security task from the information;

[0034] Inputting the characteristic data into the benefit function decision model to calculate the benefit value of the network security task;

[0035] Verify whether the system resources meet the task execution requirements by using the multidimensional matrix;

[0036] For network security tasks whose system resources meet the task execution requirements, they are sorted according to the benefit value to obtain the scheduling order.

[0037] The extracting characteristic data of the network security task from the information includes:

[0038] Extracting qualitative and quantitative features of the network security task from the information, the qualitative features including task type, resource requirements, and impact scope, and the quantitative features including expected execution time;

[0039] Establishing a feature quantification indicator system, wherein the feature quantification indicator system includes quantification rules designed for vulnerability scanning, threat detection and security audit task types;

[0040] Using the quantification rule, the extracted qualitative features are converted into quantitative features;

[0041] The extracted quantitative features and the transformed quantitative features are standardized to generate standardized feature vectors.

[0042] Generating a task scheduling scheme according to the scheduling sequence includes:

[0043] The task scheduling problem is converted into a combinatorial optimization problem, wherein the objective function of the combinatorial optimization problem is to maximize the total benefit value;

[0044] A genetic algorithm is used to calculate a solution to the combinatorial optimization problem, wherein the genetic algorithm includes population initialization, crossover operation and mutation operation;

[0045] Checking whether the solution meets the task priority and dependency requirements;

[0046] When the solution meets the requirements, converting the solution into a specific task scheduling scheme;

[0047] The task scheduling scheme includes:

[0048] Task execution schedule, specifying the start and end time of each task;

[0049] Resource allocation plan, which specifies the specific computing nodes and resource quotas used by each task;

[0050] Task priority queue, used to handle the insertion of sudden high-priority tasks.

[0051] Generating a task scheduling scheme according to the scheduling sequence further includes:

[0052] Setting task priority adjustment rules, wherein the task priority adjustment rules include security level, time limit and resource consumption threshold;

[0053] Monitoring systems process performance metrics and security event data;

[0054] When the processing performance indicator or the security event data triggers the task priority adjustment rule, updating the scheduling order;

[0055] Generate a task scheduling plan based on the updated scheduling order.

[0056] The executing the task scheduling scheme includes:

[0057] Distribute tasks to designated computing nodes according to the task execution schedule;

[0058] Configure the task running environment and allocate preset resource quotas;

[0059] Start the task execution process and monitor the task execution status;

[0060] When a task anomaly is detected, the task rescheduling mechanism is triggered;

[0061] Record task execution results and resource usage.

[0062] The method further comprises:

[0063] Collecting task execution results and actual effect data, the actual effect data including task completion time, resource usage and task execution effect;

[0064] The benefit function decision model is periodically updated using the task execution results and actual effect data.

[0065] The periodically updating the profit function decision model includes:

[0066] Set the model update cycle and performance evaluation indicator threshold;

[0067] Calculate the performance evaluation indicators of the current task scheduling scheme;

[0068] When the performance evaluation index is less than the performance evaluation index threshold, triggering a model parameter update operation;

[0069] The benefit function decision model is updated using the task execution results and actual effect data.

[0070] The present application also provides a network security task scheduling system, including:

[0071] A benefit function decision model construction module is used to construct a benefit function decision model, wherein the benefit function decision model is used to calculate the benefit value of a network security task, and the benefit function decision model includes a security value assessment module, a time urgency assessment module, and a resource consumption assessment module;

[0072] A task queue management module is used to store the input network security tasks into a pending task queue, wherein the pending task queue stores pending network security tasks in the order of task arrival time, and records the arrival timestamp, expected completion time and required resource type of each task;

[0073] Resource monitoring module, used to obtain a multi-dimensional matrix representing the current status of available computing resources, storage resources and network resources of the system;

[0074] A scheduling calculation module, used to calculate the scheduling order of each network security task in the to-be-executed task queue according to the profit function decision model and the multidimensional matrix;

[0075] A scheme generating module, used for generating a task scheduling scheme according to the scheduling sequence;

[0076] The task execution module is used to execute the task scheduling plan and schedule the execution of the network security task.

[0077] The present application also provides a computer device, the computer device comprising:

[0078] at least one processor; and,

[0079] a memory communicatively connected to the at least one processor; wherein,

[0080] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the above-mentioned network security task scheduling method.

[0081] An embodiment of the present application also provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute the above-mentioned network security task scheduling method.

[0082] An embodiment of the present application also provides a computer program product, including computer instructions, characterized in that when the computer instructions are executed by a processor, the steps of the above-mentioned network security task scheduling method are implemented.

[0083] This application has the following technical effects:

[0084] 1. By constructing a profit function decision model that includes security value assessment, time urgency assessment, and resource consumption assessment, a comprehensive assessment and dynamic scheduling of network security tasks is achieved;

[0085] 2. By real-time monitoring of system resource status and building a multi-dimensional matrix, the rationality of resource allocation and the feasibility of task execution are ensured;

[0086] 3. The correctness of the task execution order is ensured by establishing a task dependency graph and considering dependency constraints during the scheduling process;

[0087] 4. By collecting historical task data and periodically updating the decision model, continuous optimization of the scheduling strategy is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0088] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0089] Figure 1 is a flow chart of a network security task scheduling method provided by an embodiment of the present application;

[0090] Figure 2 The network security task scheduling system provided by the embodiment of the present application is a structural framework Figure 1 ;

[0091] Figure 3 The network security task scheduling system provided by the embodiment of the present application is a structural framework Figure 2 . DETAILED DESCRIPTION

[0092] The embodiments of the present application are described below in conjunction with the drawings in the present application. It should be understood that the implementation methods described below in conjunction with the drawings are exemplary descriptions for explaining the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions of the embodiments of the present application.

[0093] It will be understood by those skilled in the art that, unless specifically stated, the singular forms "one", "said", and "the" used herein may also include plural forms. It should be further understood that the terms "including" and "comprising" used in the embodiments of the present application refer to that the corresponding features can be implemented as the presented features, information, data, steps, operations, elements and / or components, but do not exclude the implementation as other features, information, data, steps, operations, elements, components and / or combinations thereof supported by the technical field. It should be understood that when an embodiment of the present invention refers to an element being "connected" or "coupled" to another element, the one element may be directly connected or coupled to the other element, or may refer to the one element and the other element establishing a connection relationship through an intermediate element. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The term "and / or" used herein indicates at least one of the items defined by the term, for example, "A and / or B" may be implemented as "A", or as "B", or as "A and B".

[0094] It should be understood that the terms "including" and "having" and any variations thereof used herein are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products or devices.

[0095] The technical scheme in the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is only a part of the embodiment of the present invention, not all of the embodiments. Based on the embodiment of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0096] like Figure 1 As shown, the network security task scheduling method of the embodiment of the present application includes:

[0097] S1: Construct a profit function decision model to calculate the profit value of network security tasks;

[0098] The benefit function decision model in S1 is a multi-objective evaluation system used to comprehensively evaluate the value, urgency, and resource consumption of network security tasks. The model quantifies these factors into a unified benefit value as the basis for task scheduling decisions.

[0099] In specific implementation, the profit function decision model contains three core evaluation modules:

[0100] 1. Security value assessment module: assesses the degree to which the task improves system security, including threat level, impact scope, and protection effect;

[0101] 2. Time urgency assessment module: assesses the timeliness requirements of tasks, including task deadlines, waiting times, and dependencies;

[0102] 3. Resource consumption assessment module: assesses the system resources required for task execution, including the usage of resources such as CPU, memory, and network bandwidth.

[0103] Specifically, constructing a profit function decision model includes:

[0104] S1.1: Build a multi-layer evaluation model based on deep neural network;

[0105] The network structure of the multi-layer evaluation model includes:

[0106] Input layer: receives the original feature data of the task;

[0107] Feature extraction layer: Use a multi-layer convolutional neural network to extract high-dimensional features of the task;

[0108] Evaluation layer: contains multiple parallel fully connected layers, corresponding to evaluation indicators of different dimensions;

[0109] Fusion layer: Fusion the evaluation indicators in a weighted manner and output the final benefit value.

[0110] When designing the model, different feature weights and evaluation rules are set for different types of network security tasks (such as vulnerability scanning, intrusion detection, etc.). For example, for vulnerability scanning tasks, more emphasis is placed on its protection effect; for intrusion detection tasks, more emphasis is placed on timeliness.

[0111] S1.2: Collect historical task data including task feature data and actual effect data;

[0112] Historical task data collection mainly includes:

[0113] Basic task information: task type, execution time, resource requirements, etc.

[0114] Execution process data: CPU usage, memory usage, network traffic, etc.

[0115] Execution effect data: task completion rate, detection rate, false alarm rate, etc.

[0116] System status data: load level, resource utilization, task queue length, etc.

[0117] These data are collected through system logs, performance monitoring tools and security devices, and are stored and managed in a unified data format.

[0118] S1.3: Use historical task data to train the parameters of the multi-layer evaluation model through the back propagation algorithm;

[0119] The specific steps of the model training process include:

[0120] 1. Data preprocessing: cleaning, standardization and feature engineering of historical task data;

[0121] 2. Divide the data set: Divide the data set into training set, validation set and test set in a ratio of 8:1:1;

[0122] 3. Model training: Use batch gradient descent method to optimize model parameters, and the loss function uses mean square error;

[0123] 4. Performance verification: Use the validation set to evaluate model performance and improve model performance by adjusting hyperparameters;

[0124] 5. Model deployment: Deploy the trained model to the production environment for real-time calculation of task benefits.

[0125] During the training process, one or more of the following optimization strategies can be adopted: use the dropout layer to prevent overfitting; use batch normalization to accelerate training convergence; use the learning rate decay strategy to improve model stability; introduce an early stopping mechanism to avoid overtraining.

[0126] S2: storing the input network security task into the task queue to be executed;

[0127] The pending task queue in S2 adopts a distributed queue management architecture to ensure the efficiency of task management in large-scale concurrent scenarios. The queue management system uses a consistent hashing algorithm for task sharding and implements distributed coordination through ZooKeeper. Specifically, storing the input network security task into the pending task queue includes:

[0128] S2.1: Obtain basic attribute information of the task;

[0129] The basic attribute information of the task obtained in S2.1 includes the following:

[0130] 1. Task type: such as vulnerability scanning, threat detection, security audit, etc.

[0131] 2. Expected execution time: the estimated task execution time based on historical data;

[0132] 3. Resource requirements: including specific indicators such as the number of CPU cores, memory size, and network bandwidth;

[0133] 4. Scope of impact: network area, number of hosts and business systems involved in the task.

[0134] S2.2: Assign a unique identifier and timestamp to each task;

[0135] The implementation of assigning identifiers and timestamps to tasks in S2.2 includes:

[0136] 1. Identifier generation: The Snowflake algorithm is used to generate a globally unique 64-bit task ID, which includes a timestamp, a worker node ID, and a sequence number;

[0137] 2. Timestamp recording: Use a unified UTC timestamp, accurate to milliseconds, to facilitate cross-time zone task management;

[0138] 3. Version control: Manage multiple execution records of tasks through version numbers, and support task retry and rollback.

[0139] S2.3: Create a task dependency graph;

[0140] The task dependency graph in S2.3 adopts a directed acyclic graph (DAG) structure and is stored using an adjacency list. It mainly records:

[0141] 1. Predecessor dependencies: other tasks that must be completed before the current task is executed;

[0142] 2. Post-dependency: other tasks that depend on the current task;

[0143] 3. Parallel relationship: a set of tasks that can be executed simultaneously with the current task;

[0144] 4. Mutually exclusive relationship: a set of tasks that cannot be executed at the same time as the current task.

[0145] Example of a dependency graph data structure:

[0146] ```json

[0147] {

[0148] "taskId":"TASK_001",

[0149] "prerequisites":["TASK_002","TASK_003"],

[0150] "dependents":["TASK_004"],

[0151] "parallel":["TASK_005","TASK_006"],

[0152] "mutex":["TASK_007"]

[0153] }

[0154] ```

[0155] S2.4: storing the task information into the task queue data structure;

[0156] The task queue data structure in S2.4 is implemented using a multi-level priority queue, including:

[0157] 1. Priority division: set three priority queues: high, medium and low;

[0158] 2. Task location index: Use B+ tree to establish a mapping from task ID to queue location;

[0159] 3. Expiration time management: handle task timeout and timing scheduling through the time wheel algorithm.

[0160] Specifically, the task information can be stored in the task queue data structure in the following way to implement the dynamic priority adjustment mechanism of the task:

[0161] S2.A1: Calculate the waiting time of the task in the queue based on the task arrival timestamp;

[0162] Optionally, record the time t when the task was queued in and the current time t now ; Calculate the waiting time t wait =t now -t in ; Regularly check the waiting time of tasks in the waiting queue.

[0163] S2.A2: Dynamically adjust the time urgency weight according to the task type and waiting time;

[0164] Optionally, set the initial weight w according to the task type base ; Set the time decay factor: f(t) = 1 + log(1 + t wait / T), where T is the benchmark waiting time; the final weight is calculated based on the initial weight and the time decay factor: w = w base *f(t).

[0165] S2.A3: When the waiting time exceeds the preset threshold, the priority enhancement mechanism is triggered;

[0166] Optionally, the waiting time threshold can be set to twice the expected execution time of the task; in the priority promotion mechanism, resource thresholds and dependency conditions can be set, resource threshold: promotion is allowed when system resource utilization is less than 50%; dependency condition: all predecessor tasks have been completed. When the waiting time exceeds the preset threshold and meets the resource threshold and dependency conditions, the priority of the corresponding task can be promoted.

[0167] S2.A4: Update the basic attribute information of the task in the queue;

[0168] For example, the basic attribute information of a task in a queue can be updated in the following update manner:

[0169] Update frequency: Check the task status every 60 seconds;

[0170] Update content: including waiting time, priority weight, resource requirements, etc.;

[0171] Update Record: Maintain the change history of task attributes.

[0172] S3: Get a multidimensional matrix;

[0173] S3 mainly implements real-time monitoring of system resource status and the construction of constraint conditions. A distributed resource monitoring architecture can be adopted, monitoring agents can be deployed on each computing node, and data collection and transmission can be achieved through message queues.

[0174] Specifically, obtaining a multidimensional matrix includes:

[0175] S3.1: Real-time collection of resource usage of each computing node in the system;

[0176] When collecting resource usage in real time, the monitoring agent obtains low-level indicators such as CPU usage and memory occupancy through Linux system calls. For CPU usage, not only the overall utilization is recorded, but also the user state and kernel state occupancy are broken down, as well as the CPU time slice allocation of the process. Memory monitoring includes indicators such as physical memory usage, virtual memory usage, and page swap rate. Network resource monitoring focuses on parameters such as interface bandwidth utilization, packet throughput, and network latency. Monitoring data is collected in a timed sampling manner, and the sampling interval can be dynamically adjusted according to the system load, usually between 1 and 5 seconds.

[0177] S3.2: Summarize the available capacity and usage thresholds of various resources;

[0178] For the management of available resource capacity and usage thresholds, an adaptive threshold calculation mechanism can be used. That is, by statistically analyzing historical resource usage data, a baseline model of resource usage is established. The baseline model takes into account time periodicity (such as daily and weekly load change patterns) and load trends, and dynamically adjusts resource thresholds. For example, during business peak periods, the resource usage threshold can be appropriately increased; during trough periods, the threshold can be lowered, so that more resources can be reserved for handling sudden tasks.

[0179] S3.3: Construct a multidimensional matrix reflecting resource status and constraints;

[0180] In the process of constructing a multidimensional matrix that reflects resource status and constraints, a multidimensional tensor is used to represent resource status and constraint relationships. The rows of the matrix represent different computing nodes, the columns represent different types of resource indicators, and the third dimension represents the time series. This three-dimensional matrix structure can not only express the current resource status, but also reflect the time characteristics of resource usage. For example, the CPU usage of a computing node may fluctuate periodically. By analyzing this pattern, future resource availability can be better predicted.

[0181] S3.4: Periodically update the multidimensional matrix;

[0182] The periodic update of multi-dimensional matrices adopts an incremental update mechanism. During each update, only the changed data is processed instead of rebuilding the entire matrix. The historical version is maintained during the update process, and rollback operations are supported. If it is found that the new update causes the task scheduling effect to deteriorate, it can be quickly restored to the previous state. In addition, the matrix data can be compressed and stored. For data areas that do not change much, sparse matrix storage is used to reduce storage overhead.

[0183] In order to ensure the validity of the multidimensional matrix, multi-level data verification can be performed during the construction of the multidimensional matrix. Specifically, during the data collection process, outliers are filtered out through data validity checks; during the aggregation process, statistical methods are used to identify and process outliers; during the matrix construction process, consistency checks are performed to ensure the rationality of the constraints.

[0184] In a specific example, in a large enterprise network security protection system, 10 computing nodes are deployed to perform security tasks. The resource status of these nodes is monitored in real time to build a multi-dimensional matrix.

[0185] The monitoring agent on each computing node collects resource data every 5 seconds. Taking node Node-01 as an example, the data collected at a certain time is as follows:

[0186] ```json

[0187] {

[0188] "nodeId":"Node-01",

[0189] "timestamp":"2024-03-15 10:30:00",

[0190] "metrics":{

[0191] "cpu":{

[0192] "total_usage":45.6,

[0193] "user_space":32.1,

[0194] "kernel_space":13.5,

[0195] "load_average":[2.1,2.3,2.0]

[0196] },

[0197] "memory":{

[0198] "total":32768,

[0199] "used":12288,

[0200] "free":20480,

[0201] "swap_used":1024

[0202] },

[0203] "network":{

[0204] "interface":"eth0",

[0205] "rx_bytes_sec":15000000,

[0206] "tx_bytes_sec":8000000,

[0207] "connections":1200

[0208] }

[0209] }

[0210] }

[0211] ```

[0212] According to the historical data analysis, the resource usage pattern of the node is obtained: 10:00 to 11:00 am on weekdays is the peak period, and the CPU usage threshold can be set to 80%; for other periods, it is set to 60%. The multidimensional matrix generated based on this is an example:

[0213] ```json

[0214] {

[0215] "node_constraints":{

[0216] "Node-01":{

[0217] "peak_hours":{

[0218] "cpu_threshold":80,

[0219] "memory_threshold":28672,

[0220] "network_threshold":20000000

[0221] },

[0222] "normal_hours":{

[0223] "cpu_threshold":60,

[0224] "memory_threshold":24576,

[0225] "network_threshold":15000000

[0226] }

[0227] }

[0228] }

[0229] }

[0230] ```

[0231] S4: Calculate the scheduling order of each network security task in the task queue to be executed;

[0232] Specifically, calculating the scheduling order of each network security task in the task queue to be executed includes:

[0233] S4.1: Obtain information about network security tasks from a queue of tasks to be executed;

[0234] The information of network security tasks is obtained from the queue of tasks to be executed. This process can be done in batches, processing a group of tasks at a time to improve processing efficiency. During the information acquisition process, a sliding window can also be maintained, and the window size is dynamically adjusted according to the processing capacity, thereby ensuring the real-time scheduling and avoiding overload due to processing too many tasks.

[0235] S4.2: Extract characteristic data of cybersecurity tasks from information;

[0236] Exemplarily, extracting characteristic data of network security tasks from information includes: extracting qualitative characteristics and quantitative characteristics; establishing a characteristic quantification index system; converting qualitative characteristics into quantitative characteristics; generating a standardized characteristic vector;

[0237] Optionally, establishing a feature quantification indicator system includes:

[0238] First, for qualitative features, such as task types, a hierarchical classification system is used. For example, vulnerability scanning tasks can be further subdivided into subtypes such as host vulnerability scanning, web application vulnerability scanning, and database vulnerability scanning. Each task type has its own specific set of attributes, which are expressed in the form of feature vectors. Resource demand features include the demand for hardware resources such as CPU, memory, and network bandwidth, and also consider the usage patterns of these resources, such as continuous use or burst use. Impact scope features describe the system scope and potential business impact that task execution may affect.

[0239] Then, for different qualitative features, corresponding quantitative rules are used for quantification. For vulnerability scanning tasks, the hazard level, impact range, and difficulty of exploitation of the vulnerability are considered and converted into quantitative scores of 0-100. For threat detection tasks, attention is paid to the quantification of indicators such as alarm level, false alarm rate, and detection rate. The quantification of security audit tasks focuses on dimensions such as audit coverage, data integrity, and traceability depth. These quantitative rules are stored in the rule base and can be dynamically adjusted and expanded according to actual needs.

[0240] Optionally, generating a standardized feature vector includes: standardizing the quantitative features to obtain a feature vector, and then reducing the dimension of the feature vector to generate a standardized feature vector. Specifically, standardizing the quantitative features includes: for continuous features, using the Z-score standardization method to convert the feature value into a standard normal distribution with a mean of 0 and a variance of 1; for discrete features, using the One-hot encoding method for conversion; for time series features, using the sliding window normalization method to ensure the temporal continuity of the feature value. Specifically, the feature vector after standardization is reduced in dimension through a feature selection algorithm to remove redundant and irrelevant features, and finally a standardized feature vector is generated.

[0241] S4.3: Calculate the benefit value of cybersecurity tasks;

[0242] In the process of calculating the revenue value, a weighted scoring method is adopted. Each feature dimension has its corresponding weight coefficient, which is learned from historical data through machine learning methods. In addition, considering the correlation between features, feature cross terms are introduced to capture the nonlinear relationship between features. The revenue value calculation results will be normalized to ensure that the revenue values ​​of different types of tasks are comparable.

[0243] S4.4: Verify whether system resources meet the task execution requirements;

[0244] In the resource verification phase, we first check hard constraints, including whether the required system resources meet the minimum requirements. Then we evaluate soft constraints, such as the optimal use of resources and the balance of system load. The time dimension of resources is taken into account during the constraint checking process, which not only verifies the current resource status, but also predicts the resource availability in the future. For tasks that cannot meet the constraints, they can be marked and put back into the waiting queue, and scheduling can be attempted again after the resource status improves.

[0245] S4.5: Sort by revenue value to get the dispatch order;

[0246] Taking into account multiple objectives such as task benefits, resource constraints, and dependencies, the optimal scheduling solution is searched through a heuristic algorithm. In order to improve computing efficiency, a task grouping strategy can be adopted to group tasks with similar characteristics together for batch processing. The scheduling results will be regularly evaluated and optimized to ensure that they adapt to the dynamically changing environment.

[0247] Assume that the system receives a web application vulnerability scanning task and needs to evaluate its scheduling priority. First, extract the feature data of the task:

[0248] ```json

[0249] {

[0250] "taskId":"VULN-SCAN-20240315-001",

[0251] "qualitative_features":{

[0252] "task_type":"web_vulnerability_scan",

[0253] "target_system":"online_payment",

[0254] "scan_scope":"full",

[0255] "impact_level":"critical"

[0256] },

[0257] "quantitative_features":{

[0258] "expected_duration":3600,

[0259] "target_hosts":5,

[0260] "urls_count":200,

[0261] "scan_depth":3

[0262] }

[0263] }

[0264] ```

[0265] Feature quantization process:

[0266] 1. Task type quantification: web_vulnerability_scan->0.9 (high-risk task)

[0267] 2. Target system quantification: online_payment->0.95 (core business system)

[0268] 3. Impact level quantification: critical->1.0 (highest level)

[0269] 4. Scanning range standardization:

[0270] ```Python

[0271] scan_depth_normalized=scan_depth / max_depth=3 / 5=0.6

[0272] urls_density=urls_count / target_hosts=40

[0273] ```

[0274] The final generated feature vector:

[0275] ```json

[0276] {

[0277] "standardized_features":{

[0278] "task_type_score":0.9,

[0279] "system_criticality":0.95,

[0280] "impact_score":1.0,

[0281] "scope_score":0.6,

[0282] "complexity_score":0.8

[0283] }

[0284] }

[0285] ```

[0286] Input the feature vector into the profit function decision model and calculate the profit value to be 0.85. Check the current resource status:

[0287] ```json

[0288] {

[0289] "resource_check":{

[0290] "cpu_available":true,

[0291] "memory_available":true,

[0292] "network_available":true,

[0293] "estimated_start_time":"2024-03-15 10:35:00"

[0294] }

[0295] }

[0296] ```

[0297] Since the revenue value of this task is high and the resources meet the requirements, it is placed in the high priority queue and scheduled to be executed in 5 minutes. At the same time, considering that this is a scanning task for a core business system, 20% of additional resources are reserved as a buffer to deal with possible emergencies.

[0298] S5: Generate task scheduling plan;

[0299] Specifically, generating a task scheduling plan includes:

[0300] S5.1: Convert the task scheduling problem into a combinatorial optimization problem;

[0301] The task scheduling problem is transformed into a combinatorial optimization problem, and a mathematical model with the goal of maximizing the total benefit value is established. The model transforms factors such as task execution time, resource allocation, priority, and dependency into constraints. The objective function not only considers the benefits of a single task, but also includes the synergy between tasks. For example, the combined execution of certain security tasks may bring additional benefits.

[0302] S5.2: Compute solutions to combinatorial optimization problems using genetic algorithms;

[0303] An improved genetic algorithm is used to solve this combinatorial optimization problem. In the population initialization phase, a set of feasible initial solutions is generated using heuristic rules. Each chromosome represents a complete scheduling solution, including the execution order of tasks and resource allocation information. The chromosome is encoded in a hybrid encoding method, where the integer part represents the task sequence and the real part represents the resource allocation ratio. This encoding method not only ensures the feasibility of the solution, but also provides sufficient search space.

[0304] In the iterative process of the genetic algorithm, the crossover operation adopts a position-based sequential crossover method. This method can maintain the relative order relationship between tasks while introducing new execution order combinations. The mutation operation includes task sequence mutation and resource allocation mutation. Sequence mutation changes the task order through random exchange, insertion or flipping operations, while resource allocation mutation changes the resource allocation plan through small adjustments. In order to improve the efficiency of the algorithm, the mutation probability can also be dynamically adjusted according to the diversity of the population.

[0305] S5.3: Check whether the solution meets the requirements;

[0306] Exemplarily, detecting whether a solution meets the requirements includes: first checking the task priority constraint to ensure that high-priority tasks can be executed in time. Then, verifying the dependency constraint, and ensuring that the task execution order meets the dependency requirements through topological sorting. Then, checking the resource constraint to ensure that the resource allocation at any time does not exceed the system capacity. For the solution that passes the test, its fitness value can also be calculated as the basis for selecting the solution corresponding to the solution.

[0307] S5.4: Convert the solution into a specific task scheduling scheme;

[0308] When generating a specific task scheduling plan, create a detailed execution schedule as a presentation of the task scheduling plan. The execution schedule uses time slot allocation to divide continuous time into discrete execution units. Each time slot records the set of tasks to be executed and the corresponding resource allocation plan. In addition, a dynamic resource allocation table can be maintained to record the resource usage of each computing node in different time periods. This refined planning ensures the executability of the plan.

[0309] Under the premise of executing the timetable, converting the solution into a specific task scheduling scheme includes:

[0310] S5.A1: Set task priority adjustment rules;

[0311] Set multi-dimensional adjustment rules, including security level rules, time limit rules, and resource consumption rules. For example, when a serious security threat is detected, the priority of related tasks will be automatically increased.

[0312] S5.A2: Monitoring systems process performance indicators and security event data;

[0313] Monitor processing performance indicators and security event data in real time to promptly identify situations that require adjustment.

[0314] S5.A3: Update scheduling order;

[0315] When the adjustment rule is triggered, the scheduling order of the affected tasks is recalculated and updated.

[0316] S5.A4: Generate a task scheduling plan based on the updated scheduling order;

[0317] The entire scheduling plan generation process is continuously optimized. The execution effect data, including task completion, resource utilization efficiency, and security protection effect, are collected through the feedback mechanism. These data are used to optimize the parameter settings of the genetic algorithm, adjust the priority rules, and improve the resource allocation strategy. In addition, the execution effect of the current plan can be regularly evaluated, and the plan regeneration process can be triggered when necessary.

[0318] In a specific example, there are currently five network security tasks that need to be scheduled:

[0319] ```json

[0320] {

[0321] "pending_tasks":[

[0322] {

[0323] "task_id":"T001",

[0324] "type":"vulnerability_scan",

[0325] "priority":"high",

[0326] "expected_duration":1800,

[0327] "revenue_value":0.85,

[0328] "dependencies":[]

[0329] },

[0330] {

[0331] "task_id":"T002",

[0332] "type":"threat_detection","priority":"medium","expected_duration":3600,"revenue_value":0.72,"dependencies":[]

[0333] },

[0334] {

[0335] "task_id":"T003",

[0336] "type":"log_analysis","priority":"low",

[0337] "expected_duration":2400,"revenue_value":0.45,"dependencies":["T002"]},

[0338] {

[0339] "task_id":"T004",

[0340] "type":"security_audit","priority":"high",

[0341] "expected_duration":1200,"revenue_value":0.88,"dependencies":["T001"]},

[0342] {

[0343] "task_id":"T005",

[0344] "type":"malware_scan","priority":"medium","expected_duration":900,"revenue_value":0.65,"dependencies":[]

[0345] } ]

[0347] }

[0348] ```

[0349] Genetic algorithm encoding scheme: A chromosome represents a possible scheduling scheme, including task sequence and resource allocation ratio:

[0350] ```json

[0351] {

[0352] "chromosome":{

[0353] "task_sequence":[4,1,5,2,3], / / represents the order of task execution

[0354] "resource_allocation":[0.3,0.2,0.15,0.2,0.15] / / Represents the resource allocation ratio

[0355] }

[0356] }

[0357] ```

[0358] After genetic algorithm optimization, the final scheduling plan is generated:

[0359] ```json

[0360] {

[0361] "schedule_plan":{

[0362] "time_slots":[

[0363] {

[0364] "start_time":"2024-03-15 10:00:00",

[0365] "tasks":["T004","T001"], / / Tasks executed in parallel

[0366] "resource_allocation":{

[0367] "T004":{

[0368] "node":"Node-01",

[0369] "cpu_cores":4,

[0370] "memory":"8GB",

[0371] "network":"100Mbps"

[0372] },

[0373] "T001":{

[0374] "node":"Node-02",

[0375] "cpu_cores":4,

[0376] "memory":"8GB",

[0377] "network":"100Mbps"

[0378] }

[0379] }

[0380] },

[0381] {

[0382] "start_time":"2024-03-15 10:20:00",

[0383] "tasks":["T005","T002"],

[0384] "resource_allocation":{...}

[0385] },

[0386] {

[0387] "start_time":"2024-03-15 11:00:00",

[0388] "tasks":["T003"],

[0389] "resource_allocation":{...}

[0390] } ]

[0392] }

[0393] }

[0394] ```

[0395] S6: Execute task scheduling plan;

[0396] S6.1: Distribute tasks to designated computing nodes;

[0397] A distributed task execution framework can be used to distribute tasks to various computing nodes through the task execution engine. The task distribution process uses a reliable transmission mechanism based on message queues to ensure that task information can be accurately delivered to the target node. Each computing node maintains a local task queue to manage the set of tasks to be executed by the current node.

[0398] S6.2: Configure the task running environment and allocate preset resource quotas;

[0399] When configuring the task running environment, the appropriate execution container is automatically selected according to the task type. For vulnerability scanning tasks, container images containing various scanning tools are preset; for threat detection tasks, dedicated containers with integrated detection engines are prepared. The resource quota of the container is precisely controlled through the Linux cgroup mechanism, including CPU share, memory limit, disk IO bandwidth, etc. In addition, the corresponding isolation strategy can be set according to the security level of the task to ensure that tasks in different security domains do not affect each other.

[0400] S6.3: Start the task execution process and monitor the task execution status;

[0401] At the process level, the heartbeat mechanism is used to monitor the survival status of the task process; at the performance level, real-time collection of CPU usage, memory usage, network traffic and other indicators; at the function level, the output logs and intermediate results of the task are analyzed to evaluate the execution effect. The monitoring data is stored in a time series database to support historical trend analysis and anomaly detection.

[0402] In addition, in order to optimize execution efficiency, the necessary data and configuration are preloaded to prepare the execution environment before the task is officially started. For example, for frequently executed security scanning tasks, a scanning engine instance pool is maintained to avoid repeated initialization overhead.

[0403] In addition, the parallel processing capability of a single task can be achieved through fine-grained resource scheduling and task slicing.

[0404] S6.4: When a task anomaly is detected, the task rescheduling mechanism is triggered;

[0405] When a task anomaly is detected, fault diagnosis is first performed to determine the cause of the fault through log analysis and performance indicator comparison. Common fault types include resource exhaustion, unavailable dependent services, task timeouts, etc. Then, according to the fault type, appropriate recovery strategies are adopted, such as automatic retry, resource expansion, task migration, etc. For tasks that need to be rescheduled, the current execution progress is saved to ensure that execution can be continued from the breakpoint after rescheduling.

[0406] S6.5: Record task execution results and resource usage;

[0407] The execution record of each task contains complete life cycle information, from task receipt, environment preparation, execution process to final completion. Resource usage statistics include indicators such as peak usage, average usage, and resource usage efficiency. In addition, important events during task execution are also recorded, such as state transitions, exceptions, and important operations. These records are collected and stored through a distributed log system to support subsequent analysis and auditing needs.

[0408] Take the execution process of task T001 (vulnerability scanning task) as an example:

[0409] 1. Task distribution:

[0410] ```json

[0411] {

[0412] "deployment_info":{

[0413] "task_id":"T001",

[0414] "target_node":"Node-02",

[0415] "container_config":{

[0416] "image":"vuln-scan:v2.1",

[0417] "environment":{

[0418] "SCAN_TARGET":"192.168.1.0 / 24","SCAN_DEPTH":"3",

[0419] "SCAN_THREADS":"8"

[0420] },

[0421] "resources":{

[0422] "cpu_limit":"4",

[0423] "memory_limit":"8Gi",

[0424] "network_limit":"100Mi"

[0425] }

[0426] }

[0427] }

[0428] }

[0429] ```

[0430] 2. Execution monitoring data:

[0431] ```json

[0432] {

[0433] "execution_metrics":{

[0434] "task_id":"T001",

[0435] "timestamp":"2024-03-15 10:05:00","status":"running",

[0436] "progress":{

[0437] "completed_hosts":12,

[0438] "total_hosts":50,

[0439] "current_phase":"port_scanning","estimated_remaining_time":1200},

[0440] "resource_usage":{

[0441] "cpu_usage":75.5,

[0442] "memory_usage":6.2,

[0443] "network_throughput":65.8

[0444] }

[0445] }

[0446] }

[0447] ```

[0448] 3. Exception Handling:

[0449] ```json

[0450] {

[0451] "incident_report":{

[0452] "task_id":"T001",

[0453] "timestamp":"2024-03-15 10:15:00",

[0454] "type":"performance_degradation",

[0455] "details":{

[0456] "symptom":"high_memory_usage",

[0457] "threshold":7.5,

[0458] "current_value":7.8,

[0459] "affected_components":["scan_engine"]

[0460] },

[0461] "actions":

[0462] {

[0463] "type":"resource_adjustment",

[0464] "details":"Increased memory limit to 10GB"},

[0465] {

[0466] "type":"scan_parameter_tuning",

[0467] "details":"Reduced concurrent threads to 6"}

[0468] ,

[0469] "resolution_status":"resolved"

[0470] }

[0471] }

[0472] ```

[0473] 4. Execution result record:

[0474] ```json

[0475] {

[0476] "execution_summary":{

[0477] "task_id":"T001",

[0478] "start_time":"2024-03-15 10:00:00",

[0479] "end_time":"2024-03-15 10:30:00",

[0480] "status":"completed",

[0481] "results":{

[0482] "scanned_hosts":50,

[0483] "vulnerabilities_found":23,

[0484] "severity_distribution":{

[0485] "critical":3,

[0486] "high":8,

[0487] "medium":7,

[0488] "low":5

[0489] }

[0490] },

[0491] "resource_statistics":{

[0492] "cpu_average":68.5,

[0493] "memory_peak":7.8,

[0494] "network_total_transfer":"12.5GB"

[0495] },

[0496] "performance_metrics":{

[0497] "scan_speed":1.67, / / hosts per minute

[0498] "accuracy_score":0.95,

[0499] "false_positive_rate":0.03

[0500] }

[0501] }

[0502] }

[0503] ```

[0504] S7: Collect data and update the model;

[0505] A distributed data collection framework can be used to collect task execution effect data at different levels. At the business level, the task completion quality, processing efficiency and security protection effect are collected; at the system level, resource utilization, task throughput and response latency are counted; at the security level, indicators such as threat detection rate, false alarm rate and protection coverage are recorded. These data are aggregated and analyzed in real time through the streaming processing pipeline.

[0506] Specifically, collecting data and updating the model includes:

[0507] S7.1: Collect task execution results and actual effect data;

[0508] The execution process of each task is fully recorded, including the timeliness of completion in the time dimension, the rationality of the use of resources in the dimension, and the effectiveness of protection in the effect dimension. For example, for vulnerability scanning tasks, not only the scanning time and resource consumption are recorded, but also professional indicators such as the number of vulnerabilities found and the verification accuracy are counted. The execution results of each dimension will be quantified into measurable indicators to facilitate subsequent analysis and comparison.

[0509] In the process of collecting actual effect data, we first conduct a data integrity check to ensure that key indicator data is not missing; secondly, we conduct data consistency verification to ensure the consistency of multi-source data through cross-comparison; finally, we conduct data validity evaluation to filter out abnormal or invalid data samples. In addition, we can also establish a data lineage relationship diagram to track the data generation, transmission and conversion process, which is convenient for problem location and data audit.

[0510] S7.2: Decision model with periodic update of payoff function;

[0511] When the task characteristics change significantly, the update cycle is shortened, and when the system is running stably, the cycle is appropriately extended. The update trigger conditions not only consider the fixed time interval, but also include factors such as performance indicator changes and data distribution deviation. When the model performance is detected to be degraded, the update process can be automatically started to ensure that the model always maintains good predictive capabilities.

[0512] Specifically, the periodically updated profit function decision model includes:

[0513] S7.2.1: Set the model update cycle and performance evaluation indicator thresholds;

[0514] The performance evaluation index system includes basic indicators, composite indicators and comprehensive indicators. Basic indicators directly reflect the performance of a single dimension, such as task completion rate, resource utilization rate, etc. Composite indicators combine multiple basic indicators, such as task cost performance indicators; comprehensive indicators integrate the performance of multiple dimensions in a weighted manner to obtain an overall performance score.

[0515] S7.2.2: Calculate the performance evaluation indicators of the current task scheduling scheme;

[0516] S7.2.3: Trigger model parameter update operation;

[0517] The model parameter update process adopts an incremental learning solution, which does not simply replace the old model with new data, but gradually adjusts the model parameters through online learning. This method not only maintains the model's memory of historical experience, but also can adapt to new data features.

[0518] S7.2.4: Update the payoff function decision model.

[0519] During the update process, the model will be verified to ensure that the new model can maintain stable performance in various scenarios. If the performance of the updated model is found to be degraded, the system will automatically roll back to the previous version.

[0520] To ensure the reliability of the model, a new version number is generated for each model update, and the complete model file, training data, and evaluation report are saved, so that the model can be quickly switched and rolled back, and restored to a stable version in time when a problem is found. At the same time, a model knowledge base can be maintained to record the characteristics and applicable scenarios of different versions of models, providing a reference for subsequent optimization.

[0521] like Figure 2 As shown, the embodiment of the present application also provides a network security task scheduling system, including:

[0522] A benefit function decision model construction module 10 is used to construct a benefit function decision model, wherein the benefit function decision model is used to calculate the benefit value of a network security task, and the benefit function decision model includes a security value assessment module, a time urgency assessment module, and a resource consumption assessment module;

[0523] The task queue management module 20 is used to store the input network security tasks into a pending task queue, which stores pending network security tasks in the order of task arrival time and records the arrival timestamp, expected completion time and required resource type of each task;

[0524] Resource monitoring module 30, used to obtain a multi-dimensional matrix representing the current status of available computing resources, storage resources and network resources of the system;

[0525] A scheduling calculation module 40, used to calculate the scheduling order of each network security task in the to-be-executed task queue according to the profit function decision model and the multidimensional matrix;

[0526] A scheme generating module 50 is used to generate a task scheduling scheme according to the scheduling sequence;

[0527] The task execution module 60 is used to execute the task scheduling scheme and schedule the execution of the network security task.

[0528] like Figure 3 As shown, the network security task scheduling system may also include:

[0529] A data collection module 70 is used to collect task execution results and resource usage;

[0530] The model updating module 80 is used to periodically update the profit function decision model according to the collected data.

[0531] It should be understood that, although each operation step is indicated by arrows in the flowchart of the embodiment of the present application, the implementation order of these steps is not limited to the order indicated by the arrows. Unless clearly stated herein, in some implementation scenarios of the embodiment of the present application, the implementation steps in each flowchart can be performed in other orders according to demand. In addition, some or all of the steps in each flowchart may include multiple sub-steps or multiple stages based on actual implementation scenarios. Some or all of these sub-steps or stages may be executed at the same time, and each sub-step or stage in these sub-steps or stages may also be executed at different times respectively. In different scenarios of execution time, the execution order of these sub-steps or stages may be flexibly configured according to demand, and the embodiment of the present application does not limit this.

[0532] The above is only an optional implementation method for some implementation scenarios of the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the technical concept of the solution of the present application, other similar implementation methods based on the technical ideas of the present application are also within the protection scope of the embodiments of the present application.

Claims

1. A network security task scheduling method, characterized in that: include: Constructing a benefit function decision model, wherein the benefit function decision model is used to calculate the benefit value of a network security task, and the benefit function decision model includes a security value assessment module, a time urgency assessment module, and a resource consumption assessment module; The input network security task is stored in a queue of pending tasks, wherein the queue of pending tasks stores pending network security tasks in the order of task arrival time, and records the arrival timestamp, expected completion time and required resource type of each task; Obtain a multidimensional matrix representing the current status of available computing resources, storage resources, and network resources of the system; Calculating the scheduling order of each network security task in the to-be-executed task queue according to the profit function decision model and the multidimensional matrix; Generate a task scheduling plan according to the scheduling order; Execute the task scheduling plan to schedule the execution of the network security task.

2. The method according to claim 1, characterized in that: The constructing of the profit function decision model includes: Build a multi-layer evaluation model based on deep neural networks to evaluate the safety value, time urgency and resource consumption of tasks; Collect historical task data including task feature data and actual effect data; The historical task data is used to train the parameters of the multi-layer evaluation model through a back-propagation algorithm to obtain a profit function decision model.

3. The method according to claim 1, characterized in that The step of storing the input network security task into a queue of tasks to be executed includes: Obtain basic attribute information of the task, including task type, expected execution time, resource requirements, and impact scope; Assign a unique identifier and timestamp to each task; Create a task dependency graph to record the pre- and post-task dependencies; The basic attribute information, identifier, timestamp and dependency of the task are stored in the task queue data structure.

4. The method according to claim 3, characterized in that Also includes: Based on the task arrival timestamp, calculate the waiting time of the task in the queue; Dynamically adjust the time urgency weight of the task according to the task type and waiting time; When the task waiting time exceeds the preset threshold, the priority enhancement mechanism is triggered; Updates the basic attribute information of the task in the queue.

5. The method according to claim 1, characterized in that Obtain a multidimensional matrix that characterizes the current status of available computing resources, storage resources, and network resources in the system, including: Real-time collection of CPU usage, memory usage, and network bandwidth usage of each computing node in the system; Summarize the available capacity and usage thresholds of various resources; Based on the CPU usage, memory usage, network bandwidth usage of each computing node, and the available capacity and usage threshold of various resources, a multidimensional matrix reflecting resource status and constraints is constructed; Periodically update a multidimensional matrix.

6. The method according to claim 1, characterized in that The calculating the scheduling order of each network security task in the to-be-executed task queue according to the profit function decision model and the multidimensional matrix includes: Acquire information about network security tasks from the queue of tasks to be executed; Extracting characteristic data of the network security task from the information; Inputting the characteristic data into the benefit function decision model to calculate the benefit value of the network security task; Verify whether the system resources meet the task execution requirements by using the multidimensional matrix; For network security tasks whose system resources meet the task execution requirements, they are sorted according to the benefit value to obtain the scheduling order.

7. The method according to claim 6, characterized in that The extracting characteristic data of the network security task from the information includes: Extracting qualitative and quantitative features of the network security task from the information, the qualitative features including task type, resource requirements, and impact scope, and the quantitative features including expected execution time; Establishing a feature quantification indicator system, wherein the feature quantification indicator system includes quantification rules designed for vulnerability scanning, threat detection and security audit task types; Using the quantification rule, the extracted qualitative features are converted into quantitative features; The extracted quantitative features and the transformed quantitative features are standardized to generate standardized feature vectors.

8. The method according to claim 1, characterized in that: Generating a task scheduling scheme according to the scheduling sequence includes: The task scheduling problem is converted into a combinatorial optimization problem, wherein the objective function of the combinatorial optimization problem is to maximize the total benefit value; A genetic algorithm is used to calculate a solution to the combinatorial optimization problem, wherein the genetic algorithm includes population initialization, crossover operation and mutation operation; Checking whether the solution meets the task priority and dependency requirements; When the solution meets the requirements, converting the solution into a specific task scheduling scheme; The task scheduling scheme includes: Task execution schedule, specifying the start and end time of each task; Resource allocation plan, which specifies the specific computing nodes and resource quotas used by each task; Task priority queue, used to handle the insertion of sudden high-priority tasks.

9. The method according to claim 8, characterized in that Generating a task scheduling scheme according to the scheduling sequence further includes: Setting task priority adjustment rules, wherein the task priority adjustment rules include security level, time limit and resource consumption threshold; Monitoring systems process performance metrics and security event data; When the processing performance indicator or the security event data triggers the task priority adjustment rule, updating the scheduling order; Generate a task scheduling plan based on the updated scheduling order.

10. A network security task scheduling system, characterized in that: include: A benefit function decision model construction module is used to construct a benefit function decision model, wherein the benefit function decision model is used to calculate the benefit value of a network security task, and the benefit function decision model includes a security value assessment module, a time urgency assessment module, and a resource consumption assessment module; A task queue management module is used to store the input network security tasks into a pending task queue, wherein the pending task queue stores pending network security tasks in the order of task arrival time, and records the arrival timestamp, expected completion time and required resource type of each task; Resource monitoring module, used to obtain a multi-dimensional matrix representing the current status of available computing resources, storage resources and network resources of the system; A scheduling calculation module, used to calculate the scheduling order of each network security task in the to-be-executed task queue according to the profit function decision model and the multidimensional matrix; A scheme generating module, used for generating a task scheduling scheme according to the scheduling sequence; The task execution module is used to execute the task scheduling plan and schedule the execution of the network security task.

Images