Industrial internet-oriented cloud native security service chain dynamic arrangement method and application

Abstract

The invention relates to the technical field of industrial internet network security and cloud computing crossing, in particular to an industrial internet-oriented cloud native security service chain dynamic arrangement method and application, and the method comprises the steps: deploying a containerized security function module in a virtualization platform of an industrial internet; constructing a direct network communication channel between the security function modules; deploying a dynamic recombination controller, capturing a network data flow in real time, and generating a standardized feature vector containing a protocol type, a load feature and a session state by adopting a metadata analysis algorithm; the intrusion detection system container performs threat judgment on the standardized feature vector to generate a detection report; and transmitting the detection report to the firewall container, and triggering a rule updating operation based on the dynamic policy engine. According to the application, the security protection level and cross-platform adaptive capacity of industrial internet services can be remarkably improved, and efficient protection and management of multi-source data and key services in a novel industrial scene are realized.

Description

Technical Field

[0001] The present application relates to the interdisciplinary technical field of industrial Internet network security and cloud computing, and in particular to a dynamic orchestration method and application of a cloud-native security service chain for the industrial Internet. Background Art

[0002] With the rapid development of the Industrial Internet, traditional industries such as manufacturing, energy, and transportation are increasingly connected to the internet, promoting the deep integration of information technology and industrial systems. However, industrial production systems often involve a large number of terminal devices (such as AGVs, PLC controllers, and industrial robots), which are dispersed across factory floors or remote sites, creating complex environments and weak security protections. Attackers can exploit protocol vulnerabilities, device firmware flaws, or network topology vulnerabilities to launch cyberattacks against industrial systems, causing production halts or safety incidents. Furthermore, industrial sites often need to process massive amounts of real-time data, placing higher demands on data transmission security, privacy protection, and attack detection. However, traditional security solutions, most of which are based on a single cloud or centralized security controller, struggle to adapt to the distributed and diverse industrial production environment, posing a serious challenge to the overall security of the Industrial Internet.

[0003] To address increasingly severe network threats, the concept of security service chaining (SSCC) has emerged. It orchestrates security functions such as intrusion detection, firewalls, encryption and decryption, and antivirus in a specific order to provide multi-layered protection for network traffic. Existing technical solutions often use software-defined networking (SDN) or service meshes to provide traffic redirection and policy distribution for security service chains. However, these traditional architectures commonly suffer from the following pain points:

[0004] 1. Limited dynamism and flexibility: Traditional solutions generally rely on underlying virtual switches, routers, or SDN controllers to orchestrate security modules and direct traffic. This results in high latency in security policy updates and service chain reconstruction, making it difficult to meet real-time protection requirements in complex network environments.

[0005] 2. Poor cross-platform compatibility: Virtualization environments are becoming increasingly diverse. OpenStack platforms may require Neutron components, while Kubernetes environments rely on CNIs (such as Calico) for network management. Traditional security deployment methods have a strong dependency on platform components, making seamless switching and collaborative management difficult in hybrid environments.

[0006] 3. Resource consumption and performance bottlenecks: When using a service mesh or SDN controller for security policy orchestration, additional proxies, sidecars, or forwarding nodes are often required. This not only consumes a large amount of computing and network resources, but also easily introduces additional latency, making it difficult to meet the real-time protection requirements in low-latency, high-concurrency scenarios.

[0007] In order to solve the above problems, a more lightweight, efficient and cross-platform adaptive security service chain dynamic orchestration method is needed to achieve real-time, high-precision threat detection and dynamic update of defense strategies. Summary of the Invention

[0008] The embodiments of the present application provide a dynamic orchestration method and application of a cloud-native security service chain for the Industrial Internet. It adopts an innovative architecture of direct communication between containerized security components, dynamic reorganization controllers, and multi-level defense strategy collaboration to achieve rapid response, cross-platform migration, and efficient threat interception of the security service chain in the Industrial Internet environment.

[0009] To solve the above technical problems, an embodiment of the present application provides a dynamic orchestration method for a cloud-native security service chain for the industrial Internet, comprising the following steps: first, deploying a containerized security function module in the virtualization platform of the industrial Internet; the security function module includes an intrusion detection system container, a firewall container, and an encryption and decryption container; then, building a direct network communication channel between the security function modules; next, deploying a dynamic reorganization controller to receive orchestration instructions issued by an external network security analysis system, parsing instruction parameters and matching a preset threat response policy library, triggering a security service chain topology reconstruction operation; then, capturing network data flows in real time, using a metadata parsing algorithm to generate a standardized feature vector containing protocol type, load characteristics, and session status, and inputting the standardized feature vector into an intrusion detection system container; next, the intrusion detection system container performs threat judgment on the standardized feature vector based on a pre-trained machine learning model, and generates a detection report containing attack type identification, threat confidence, and source terminal location information; finally, transmitting the detection report to the firewall container, triggering a rule update operation based on a dynamic policy engine; the rule update operation includes incremental update of the blocking list, adjustment of the traffic marking policy, and reset of the session status.

[0010] In some exemplary embodiments, before deploying the containerized security function module in the virtualization platform of the industrial Internet, it also includes: creating multiple dedicated virtual machines in the OpenStack cloud platform; each virtual machine is configured with an independent operating environment to provide an isolated virtualization infrastructure for secure container deployment.

[0011] In some exemplary embodiments, in the process of building a direct network communication channel between security components, real-time data interaction across containers is achieved through a standard network protocol interface, forming a dynamically reconfigurable security service chain topology; each security function module implements a container dynamic reorganization mechanism based on the socket and REST API interface, uses a circular buffer to ensure data transmission integrity, and performs dynamic reorganization at the network level to form a flexible and on-demand security service chain.

[0012] In some exemplary embodiments, in the process of capturing network data flows, network data flows are captured in real time by a traffic feature extraction module deployed at the bottom layer of the virtualization platform; virtual network card traffic is captured in real time by tcpdump, and the CICFlowMeter parsing engine is called to extract 29-dimensional network traffic features and convert them into a standardized JSON format input queue.

[0013] In some exemplary embodiments, a dynamic firewall rule update mechanism is provided in the firewall container; based on the real-time detection results received from the intrusion detection system, the firewall container automatically modifies and updates the firewall rules, thereby achieving rapid response and interception of abnormal traffic or attack behavior; for non-Kubernetes environments, the socket communication mechanism is fully adopted to achieve direct data transmission and dynamic reorganization between the containers of each security function module, ensuring that the constructed security service chain can also run efficiently in a traditional virtualization environment.

[0014] In some exemplary embodiments, after the detection report is transmitted to the firewall container and the rule update operation based on the dynamic policy engine is triggered, it also includes: first, deploying a security module container in the Kubernetes environment, and utilizing the native characteristics of Kubernetes to dynamically configure and manage the firewall container by mounting ConfigMap; then, configuring the intrusion detection system container to synchronously write the detection results to the ConfigMap mounted on the firewall container; next, after the firewall container parses the detection report, it dynamically modifies the iptables rule chain; then, developing a cross-platform security reorganization controller, connecting to the OpenStack virtual machine through the SSH protocol, reorganizing the security service chain according to the network attack situation, and realizing the topology reconstruction of the containerized security service chain; finally, synthesizing the experimental data, finally evaluating and outputting the actual application effect, response time, rule accuracy and system scalability of the solution based on the containerized security service chain, and verifying the superiority of the orchestration method in real-time network security protection and dynamic defense strategy.

[0015] In some exemplary embodiments, in the process of dynamically configuring and managing the firewall container by mounting a ConfigMap, ConfigMap, as a lightweight dynamic configuration component, can achieve cross-container data sharing and automatic updating.

[0016] In some exemplary embodiments, during the process of synchronously writing the detection results to the ConfigMap mounted on the firewall container, when the ConfigMap content changes, the firewall container automatically reads the update information and dynamically adjusts the firewall rules to ensure automated security policy updates in a cloud-native environment.

[0017] In some exemplary embodiments, the process of dynamically modifying the iptables rule chain includes: immediately inserting a DROP rule for high-confidence threats with a threshold ≥ 0.85; and enabling traffic marking and rate limiting policies for medium-confidence threats with a threshold of 0.6 ≤ threshold < 0.85.

[0018] An embodiment of the present application also provides an application of the cloud-native security service chain dynamic orchestration method for the industrial Internet described in the above embodiment in a dynamic reorganization scenario of the industrial Internet.

[0019] The technical solution provided by the embodiments of the present application has at least the following advantages:

[0020] An embodiment of the present application provides a dynamic orchestration method and application of a cloud-native security service chain for the industrial Internet, the method comprising the following steps: first, deploying a containerized security function module in a virtualization platform of the industrial Internet; the security function module comprises an intrusion detection system container, a firewall container, and an encryption and decryption container; then, constructing a direct network communication channel between the security function modules; next, deploying a dynamic reorganization controller to receive orchestration instructions issued by an external network security analysis system, parsing instruction parameters and matching a preset threat response policy library, triggering a security service chain topology reconstruction operation; then, capturing network data flows in real time, using a metadata parsing algorithm to generate a standardized feature vector containing a protocol type, a load characteristic, and a session state, and inputting the standardized feature vector into an intrusion detection system container; next, the intrusion detection system container performs threat judgment on the standardized feature vector based on a pre-trained machine learning model, and generates a detection report containing an attack type identifier, a threat confidence level, and source terminal location information; finally, transmitting the detection report to the firewall container, triggering a rule update operation based on a dynamic policy engine; the rule update operation includes incremental update of a blocking list, adjustment of a traffic marking policy, and resetting of a session state.

[0021] This application realizes lightweight real-time reconstruction of the security service chain in a virtualized environment by constructing a containerized security component direct communication architecture and a dynamic reorganization controller, significantly reducing the resource consumption and policy delay caused by traditional solutions relying on SDN controllers or service grids; at the same time, it adopts a hybrid communication protocol (binary Socket frame + REST API interface) and a cross-platform adaptation mechanism (host network mode / ConfigMap mounting) to break through the platform dependence of OpenStack Neutron and Kubernetes Calico network components, support seamless switching of heterogeneous virtualization environments, and greatly improve the response speed of security containers. Through multi-dimensional feature intrusion detection models and multi-level dynamic defense strategies (blocking / speed limiting / marking), a dynamic defense mechanism is implemented, which is 24.2% more efficient than traditional deployment solutions, providing cloud native environments with high-precision, low-latency, and highly adaptable active security defense capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] One or more embodiments are exemplarily described by pictures in the corresponding drawings. These exemplifications do not constitute limitations on the embodiments. Unless otherwise stated, the pictures in the drawings do not constitute proportional limitations.

[0023] Figure 1 A flowchart of a method for dynamic orchestration of a cloud-native security service chain for the Industrial Internet provided in one embodiment of the present application.

[0024] Figure 2 A specific flow chart of a method for dynamic orchestration of a cloud-native security service chain for the Industrial Internet provided in one embodiment of the present application.

[0025] Figure 3A and Figure 3B A diagram of the lightweight communication architecture of a containerized security component provided in one embodiment of the present application.

[0026] Figure 4 This is a firewall log diagram under IP address spoofing, DoS, brute force cracking, and flooding attacks provided in an embodiment of the present application.

[0027] Figure 5 This is a comparison chart of the average response times of 8 independent repeated experiments provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] As can be seen from the background technology, existing technical solutions mostly use software-defined networks (SDN) or service meshes to provide traffic redirection and policy distribution for security service chains. This type of traditional architecture generally has technical problems such as limited dynamics and flexibility, poor cross-platform compatibility, resource consumption and performance bottlenecks.

[0029] This application addresses the problems of rigidity, high threat response latency, and difficulty in cross-component collaboration in traditional security service chains in virtualized environments. A dynamic orchestration method and application for cloud-native security service chains for the industrial Internet are proposed. The method comprises the following steps: first, deploying containerized security function modules in the virtualization platform of the industrial Internet; the security function modules include an intrusion detection system container, a firewall container, and an encryption and decryption container; then, establishing a direct network communication channel between the security function modules; next, deploying a dynamic reorganization controller to receive orchestration instructions issued by an external network security analysis system, parsing instruction parameters and matching them with a preset threat response policy library, triggering a security service chain topology reconstruction operation; then, capturing network data streams in real time, using a metadata parsing algorithm to generate a standardized feature vector containing protocol type, payload characteristics, and session state, and inputting the standardized feature vector into an intrusion detection system container; next, the intrusion detection system container performs threat assessment on the standardized feature vector based on a pre-trained machine learning model, and generates a detection report containing attack type identification, threat confidence, and source terminal location information; finally, transmitting the detection report to the firewall container, triggering a rule update operation based on a dynamic policy engine; the rule update operation includes incremental update of the blocking list, adjustment of the traffic marking policy, and reset of the session state.

[0030] This application builds a security protection system with adaptive network layer reorganization and real-time policy linkage through containerized security function modules, multimodal communication protocols, and machine learning-driven threat detection technology. This solution is suitable for cloud computing and cloud-native environments, supports dynamic orchestration of intrusion detection system (IDS) containers, firewall (FW) containers, and encryption and decryption containers, and combines traffic feature extraction middleware with random forest detection models to achieve millisecond-level threat assessment and automated rule updates, significantly improving defense accuracy and response efficiency in complex attack scenarios.

[0031] The following detailed description of the various embodiments of the present application is provided in conjunction with the accompanying drawings. However, those skilled in the art will appreciate that many technical details are provided in the various embodiments of the present application to facilitate a better understanding of the present application. However, even without these technical details and the various variations and modifications based on the following embodiments, the technical solutions claimed in the present application can still be implemented.

[0032] See Figure 1 , the embodiment of the present application provides a method for dynamically orchestrating a cloud-native security service chain for the industrial Internet, comprising the following steps:

[0033] Step S101: deploy a containerized security function module in the virtualization platform of the industrial Internet; the security function module includes an intrusion detection system (IDS) container, a firewall (FW) container, and an encryption and decryption container.

[0034] Step S102: Construct a direct network communication channel between security function modules.

[0035] Step S103: deploy a dynamic reconfiguration controller, receive the orchestration instructions issued by the external network security analysis system, parse the instruction parameters and match the preset threat response policy library, and trigger the security service chain topology reconstruction operation.

[0036] Step S104: Capture network data streams in real time, use metadata parsing algorithms to generate standardized feature vectors containing protocol types, load characteristics, and session states, and input the standardized feature vectors into an intrusion detection system container.

[0037] Step S105: The intrusion detection system container performs threat assessment on the standardized feature vector based on the pre-trained machine learning model, and generates a detection report including attack type identification, threat confidence level, and source terminal location information.

[0038] Step S106: Transmit the detection report to the firewall container, triggering a rule update operation based on the dynamic policy engine; the rule update operation includes incremental update of the blocking list, traffic marking policy adjustment, and session state reset.

[0039] Specifically, in step S101, the pre-trained machine learning model integrated into the IDS container is a random forest model trained based on the CIC-IDS-2017 dataset, with an input feature dimension of 29 dimensions, including packet length distribution entropy, TCP flag combination pattern, and HTTP request method type.

[0040] In step S102, the direct network communication channel uses the Socket protocol to serialize and transmit multiple types of data. This data includes network traffic characteristics, threat detection results, attack type identifiers, and encrypted and decrypted binary files. A checksum is also appended to ensure data integrity. The data integrity protection mechanism for Socket communication specifically includes a ring buffer configured on the receiving end, which automatically retransmits frames that fail verification, with a maximum of three retransmissions.

[0041] In step S106, the rule update operation of the dynamic policy engine includes: when the threat confidence level is ≥0.85, immediately inserting the iptables DROP rule and resetting the relevant session state; when 0.6≤threat confidence level<0.85, adding a traffic marking policy and enabling bandwidth limiting measures.

[0042] It should be noted that in a non-Kubernetes virtualization environment, the secure container is deployed in host network mode and directly bound to the physical machine network interface. Containers use socket communication to achieve direct data interaction across virtual machines, completely bypassing the OpenStack Neutron virtual network component.

[0043] In the Kubernetes environment, the security policy synchronization is achieved by mounting the ConfigMap object to the FW container. The trigger condition for ConfigMap content update is a change in the content hash value or a change in the detection report confidence level exceeding ±0.2.

[0044] Specifically, the ConfigMap object is injected into the FW container as an environment variable. By monitoring changes in the hash value of the ConfigMap object content, the rule generation script is triggered and periodically executed. The execution interval is configured to 5 seconds and supports dynamic adjustment.

[0045] The method of this application supports the hybrid deployment mode of OpenStack and Kubernetes. The security service chain topology reconstruction strategy automatically switches according to the type of virtualization environment, including: disabling the Neutron routing component in the OpenStack scenario and directly binding the container to the physical network card; retaining the Calico network plug-in in the Kubernetes scenario but bypassing its policy control plane.

[0046] In some embodiments, before deploying the containerized security function module in the virtualization platform of the industrial Internet in step S101, it also includes: creating multiple dedicated virtual machines in the OpenStack cloud platform; each virtual machine is configured with an independent operating environment to provide an isolated virtualization infrastructure for secure container deployment.

[0047] Specifically, such as Figure 2 As shown, the dynamic orchestration method of cloud native security service chain for industrial Internet provided by this application includes the following steps:

[0048] Step S0: Initialize the security service chain construction task;

[0049] Step S1: Create multiple dedicated virtual machines in the OpenStack cloud platform, each with an independent operating environment, to provide an isolated virtualization infrastructure for secure container deployment;

[0050] Step S2: Develop containerized security functional components, including an IDS container that integrates a random forest model trained with the CIC-IDS-2017 dataset, a dynamic rule firewall container based on the netfilter / iptables interface, and a stateless encryption and decryption container that implements the AES-CBC encryption algorithm;

[0051] Step S3: Construct an inter-container hybrid communication module. Each security module container implements a dynamic container reassembly mechanism based on socket and REST API interfaces. A ring buffer is used to ensure data transmission integrity. Dynamic reassembly is performed at the network level to form a flexible and on-demand security service chain.

[0052] Step S4: Deploy traffic capture middleware in the virtualized environment, capture virtual network card traffic in real time through tcpdump, call the CICFlowMeter parsing engine to extract 29-dimensional network traffic features and convert them into standardized JSON format for input queue;

[0053] Step S5: Establish a dynamic firewall rule update mechanism in the FW container. Based on the real-time detection results received from the IDS, the FW container automatically modifies and updates the firewall rules, thereby enabling rapid response and interception of abnormal traffic or attack behavior;

[0054] Step S6: For non-Kubernetes environments, the socket communication mechanism is fully adopted to achieve direct data transmission and dynamic reorganization between the containers of each security module, ensuring that the constructed security service chain can also run efficiently in traditional virtualization environments;

[0055] Step S7: Deploy the security module container in the Kubernetes environment and leverage Kubernetes' native features to dynamically manage the configuration of the FW container by mounting a ConfigMap. As a lightweight dynamic configuration component, ConfigMap enables cross-container data sharing and automatic updates.

[0056] Step S8: Configure the IDS container to synchronously write detection results to the ConfigMap mounted on the FW container. When the ConfigMap content changes, the FW container automatically reads the updated information and dynamically adjusts the firewall rules accordingly, ensuring automated security policy updates in a cloud-native environment.

[0057] Step S9: After parsing the detection report, the firewall container dynamically modifies the iptables rule chain, immediately inserting a DROP rule for high-confidence threats (threshold ≥ 0.85) and enabling traffic marking and rate limiting policies for medium-confidence threats (0.6 ≤ threshold < 0.85);

[0058] Step S10: Develop a cross-platform security reorganization controller, connect to the OpenStack virtual machine through the SSH protocol, reorganize the security service chain according to the network attack situation, and realize the topology reconstruction of the containerized security service chain;

[0059] Step S11: Based on the experimental data, the actual application effect, response time, rule accuracy and system scalability of the solution based on the containerized security service chain are finally evaluated and output to verify the superiority of this solution in real-time network security protection and dynamic defense strategy.

[0060] Specifically, the process of creating multiple dedicated virtual machines in the OpenStack cloud platform in step S1 provides an isolated virtualized infrastructure for secure container deployment. Each virtual machine has independent network, storage, and computing resources, and a pre-installed Docker environment. IDS containers, firewall containers, and AES containers can be deployed on different virtual machines. Interoperability between these containers is achieved through physical network cards or virtual networks, ensuring bandwidth and security for cross-node communication and facilitating subsequent cross-platform secure reorganization control based on the SSH protocol.

[0061] The containerized security components in step S2 include an IDS container integrating a random forest model trained with the CIC-IDS-2017 dataset, a dynamic rule-based firewall container based on the netfilter / iptables interface, and a stateless encryption and decryption container implementing the AES-CBC encryption algorithm. By packaging these security functions into lightweight Docker images, they can be rapidly scheduled and deployed across different virtual machine nodes or Kubernetes workloads. The IDS container is responsible for real-time detection of multi-dimensional features extracted from network traffic and outputting threat reports. The FW container dynamically inserts or removes iptables rules based on threat confidence, and the AES container provides encryption and decryption of sensitive data, forming the foundation for a cross-container collaborative security service chain.

[0062] Constructing a hybrid communication module between containers in step S3 is the key to realizing dynamic reorganization of the security service chain at the network level in this application. Each security module container supports both socket-based binary frame transmission and REST API interface, and ensures data integrity and reliability through a ring buffer and CRC check. When a threat alert or network topology change is required, the dynamic reorganization controller can directly adjust the communication channel between containers to change the connection relationship between the IDS, FW, and AES containers, thereby reconstructing the service chain topology within milliseconds according to security policy requirements. The lightweight communication architecture diagram of the containerized security component provided in the embodiment of the present application is shown in Figure 3.

[0063] In step S4, traffic capture middleware is deployed within the virtualized environment to collect and analyze network data flows in real time. By installing tcpdump on the OpenStack virtual machine or Kubernetes node, data transmitted by the virtual network interface card (NIC) is captured and the CICFlowMeter parsing engine is invoked to extract up to 29 dimensions of network traffic features. These features, including information such as protocol type, payload size, and TCP flag bit distribution, are ultimately converted into a standardized JSON format and written to a message queue or cache for real-time detection by the IDS container, improving the accuracy and timeliness of threat assessment.

[0064] In step S5, a dynamic firewall rule update mechanism is established within the FW container, enabling rapid interception of abnormal traffic and attack behaviors. The FW container receives detection reports from the IDS container via a socket or message queue, analyzes the attack type, confidence level, and source terminal location information, and applies different levels of defense strategies (such as blocking, rate limiting, and marking) based on threshold differences. This mechanism reduces the latency from full-link detection to policy implementation to less than 100ms, significantly shortening the response time to high-risk threats compared to traditional solutions.

[0065] In step S6, for non-Kubernetes environments, a socket communication mechanism is fully adopted to enable direct data transmission and dynamic reorganization between the containers of each security module, ensuring the efficient operation of the security service chain even in traditional virtualization scenarios (such as OpenStack). By directly binding the container to the physical network card through the host network mode, bypassing the OpenStack Neutron virtual network component, the routing and forwarding burden at the network layer is significantly reduced. When the IDS detects a high-risk threat, it can immediately send a blocking instruction to the FW container, achieving low-latency communication and coordinated protection across virtual machines.

[0066] In step S7, the security module container is deployed in the Kubernetes environment. Kubernetes resource objects such as Deployment and Service are used to centrally schedule and elastically scale the IDS, Firewall, and AES containers. By mounting a ConfigMap to the Firewall container, lightweight management and automatic updates of dynamic rule configuration files are achieved. As a native Kubernetes configuration store, ConfigMap allows security policies to be shared across multiple container replicas, greatly simplifying the synchronization of firewall rules and encryption and decryption parameters.

[0067] Deploy the security module container in the Kubernetes environment and mount the ConfigMap to the FW container to achieve lightweight management and automatic update of dynamic rule configuration files. Figure 3A and Figure 3B As shown in the figure, ConfigMap, as the native configuration storage of Kubernetes, can share security policies across multiple container replicas, greatly simplifying the synchronization of firewall rules and encryption and decryption parameters.

[0068] The configured IDS container synchronously writes detection results to the ConfigMap, enabling real-time security policy linkage in a cloud-native environment. When the IDS container detects a new threat event and the threat confidence exceeds a specified threshold, it writes information such as the attack type, risk level, and source IP address to the ConfigMap. The FW container automatically loads and updates the ConfigMap by monitoring changes in the content hash value of the ConfigMap and dynamically modifies the iptables rules immediately. This process completes security policy switching without requiring a container restart, ensuring rapid response to high-frequency attacks.

[0069] In step S8, the IDS container is configured to synchronously write detection results to the ConfigMap, enabling real-time security policy linkage in a cloud-native environment. When the IDS container detects a new threat event and the threat confidence exceeds a specified threshold, it writes information such as the attack type, risk level, and source IP address to the ConfigMap. The FW container automatically loads and updates the ConfigMap by monitoring changes in the content hash value of the ConfigMap and dynamically modifies the iptables rules immediately. This process completes security policy switching without requiring a container restart, ensuring rapid response to high-frequency attacks.

[0070] After the firewall container analyzes the detection report in step S9, it can execute a multi-level protection strategy based on the threat confidence level to differentiate and deal with security threats of different degrees, such as Figure 4 If the confidence level is ≥0.85, a DROP rule is immediately inserted and the relevant session status is reset. If the confidence level is 0.6 ≤ or <0.85, a traffic marking strategy is implemented and bandwidth limiting measures are enabled to prevent potential attack traffic from causing a large-scale impact on the network. This tiered strategy ensures the continuity and stability of normal business traffic while ensuring high-precision protection.

[0071] The cross-platform security reorganization controller developed in step S10 is the core component of this application for achieving unified orchestration in a heterogeneous virtualized environment. When the external security analysis system detects a change in the attack situation or an adjustment in business needs, it can issue corresponding orchestration instructions to the controller. Based on the instruction parameters and the preset threat response policy library, the controller automatically adjusts the connection relationship between the IDS, FW, and AES containers, or migrates certain containers to nodes with lower loads, thereby quickly completing the reconstruction and upgrade of the security service chain and ensuring the continuity and dynamic adaptability of network security protection.

[0072] In step S11, the experimental data is synthesized to verify and evaluate indicators such as rule entry delay, threat interception accuracy, and system scalability. This application deploys a performance evaluation module and synthesizes experimental results to prove the technical advantages of the method of this application in reducing rule entry delay, improving threat interception efficiency, and adaptability to dynamic environments. Experiments show that this application can control the protection policy update delay to within 100ms. Through containerized deployment, socket communication mechanism, and ConfigMap dynamic update function, it is possible to build a flexible and efficient security service chain in different virtualization environments, effectively improving the real-time, dynamic, and scalability of network security protection.

[0073] Compared with the existing technology, this application realizes lightweight real-time reconstruction of the security service chain in a virtualized environment through a containerized security component direct communication architecture and a dynamic reorganization controller, and significantly reduces the resource consumption and policy delays caused by traditional solutions relying on SDN controllers or service grids. Through multimodal communication protocols (Socket+REST API) and cross-platform adaptation mechanisms (host network mode / ConfigMap mounting), it breaks through the dependency restrictions of OpenStack Neutron and Kubernetes Calico network components and supports seamless switching of heterogeneous virtualization environments; based on multi-dimensional feature intrusion detection models and multi-level dynamic defense strategies (blocking / speed limiting / marking), it can accurately respond to network threats within milliseconds. Figure 5 This is a comparison chart of the average response time of 8 independent repeated experiments provided in the examples of this application. Figure 5 As shown, the experimental results show that this application is 24.2% more efficient than the traditional deployment solution, providing high-precision, low-latency, and highly adaptable active security defense capabilities for cloud-native and multi-cloud environments.

[0074] Based on the above technical solution, the embodiment of the present application provides a cloud-native security service chain dynamic orchestration method and application for the industrial Internet, which includes the following steps: first, deploying a containerized security function module in the virtualization platform of the industrial Internet; the security function module includes an intrusion detection system container, a firewall container and an encryption and decryption container; then, building a direct network communication channel between the security function modules; next, deploying a dynamic reorganization controller to receive the orchestration instructions issued by the external network security analysis system, parsing the instruction parameters and matching the preset threat response policy library, triggering the security service chain topology reconstruction operation; then, capturing the network data flow in real time, using the metadata parsing algorithm to generate a standardized feature vector containing the protocol type, load characteristics and session status, and inputting the standardized feature vector into the intrusion detection system container; next, the intrusion detection system container performs threat judgment on the standardized feature vector based on the pre-trained machine learning model, and generates a detection report containing the attack type identification, threat confidence and source terminal location information; finally, transmitting the detection report to the firewall container, triggering the rule update operation based on the dynamic policy engine; the rule update operation includes incremental update of the blocking list, traffic marking policy adjustment and session status reset.

[0075] This application realizes lightweight real-time reconstruction of the security service chain in a virtualized environment by constructing a containerized security component direct communication architecture and a dynamic reorganization controller, significantly reducing the resource consumption and policy delay caused by traditional solutions relying on SDN controllers or service grids; at the same time, it adopts a hybrid communication protocol (binary Socket frame + REST API interface) and a cross-platform adaptation mechanism (host network mode / ConfigMap mounting) to break through the platform dependence of OpenStack Neutron and Kubernetes Calico network components, support seamless switching of heterogeneous virtualization environments, and greatly improve the response speed of security containers. Through multi-dimensional feature intrusion detection models and multi-level dynamic defense strategies (blocking / speed limiting / marking), a dynamic defense mechanism is implemented, which is 24.2% more efficient than traditional deployment solutions, providing cloud native environments with high-precision, low-latency, and highly adaptable active security defense capabilities.

[0076] Those skilled in the art will appreciate that the above-described embodiments are specific examples for implementing the present application, and that in actual applications, various changes in form and detail may be made thereto without departing from the spirit and scope of the present application. Any person skilled in the art may make changes and modifications without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application shall be subject to the scope defined in the claims.

Claims

1. A cloud-native security service chain dynamic orchestration method for the industrial Internet, characterized in that: The following steps are involved: Deploy containerized security function modules in the virtualization platform of the Industrial Internet; the security function modules include an intrusion detection system container, a firewall container, and an encryption and decryption container; Build direct network communication channels between security function modules; Deploy a dynamic reconfiguration controller to receive orchestration instructions from an external network security analysis system, parse instruction parameters, match them with the preset threat response policy library, and trigger the security service chain topology reconstruction operation; Capturing network data flows in real time, using metadata parsing algorithms to generate standardized feature vectors containing protocol types, payload characteristics, and session states, and inputting the standardized feature vectors into an intrusion detection system container; The intrusion detection system container performs threat assessment on the standardized feature vector based on a pre-trained machine learning model, and generates a detection report including an attack type identifier, a threat confidence level, and source terminal location information; The detection report is transmitted to the firewall container to trigger a rule update operation based on a dynamic policy engine; the rule update operation includes incremental update of the blocking list, traffic marking policy adjustment, and session state reset.

2. The method for dynamic orchestration of cloud-native security service chains for the industrial Internet according to claim 1 is characterized in that: Before deploying containerized security function modules in the virtualization platform of the Industrial Internet, the following are also required: Create multiple dedicated virtual machines in the OpenStack cloud platform; each virtual machine is configured with an independent operating environment, providing an isolated virtualization infrastructure for secure container deployment.

3. The method for dynamically arranging cloud-native security service chains for the industrial Internet according to claim 1 is characterized in that: In the process of building direct network communication channels between security components, standard network protocol interfaces are used to achieve real-time data interaction across containers, forming a dynamically reconfigurable security service chain topology. Each security function module implements a dynamic container reassembly mechanism based on socket and REST API interfaces, uses a ring buffer to ensure data transmission integrity, and performs dynamic reassembly at the network level to form a flexible and on-demand security service chain.

4. The method for dynamically arranging cloud-native security service chains for the industrial Internet according to claim 1 is characterized in that: In the process of capturing network data flow, the traffic feature extraction module deployed at the bottom layer of the virtualization platform is used to capture the network data flow in real time; The virtual network card traffic is captured in real time through tcpdump, and the CICFlowMeter parsing engine is called to extract 29-dimensional network traffic features and convert them into standardized JSON format for input queue.

5. The method for dynamically arranging cloud-native security service chains for the industrial Internet according to claim 1 is characterized in that: The firewall container is equipped with a dynamic firewall rule update mechanism; based on the real-time detection results received from the intrusion detection system, the firewall container automatically modifies and updates the firewall rules, thereby achieving rapid response and interception of abnormal traffic or attack behavior; For non-Kubernetes environments, the socket communication mechanism is fully adopted to achieve direct data transmission and dynamic reorganization between the containers of various security function modules, ensuring that the constructed security service chain can also run efficiently in traditional virtualization environments.

6. The method for dynamic orchestration of cloud-native security service chains for the industrial Internet according to claim 1 is characterized in that: After transmitting the detection report to the firewall container and triggering a rule update operation based on a dynamic policy engine, the method further includes: Deploy the security module container in the Kubernetes environment and leverage Kubernetes' native features to dynamically manage the firewall container's configuration by mounting a ConfigMap. Configure the intrusion detection system container to synchronously write detection results to the ConfigMap mounted on the firewall container; After the firewall container parses the detection report, it dynamically modifies the iptables rule chain; Develop a cross-platform security reorganization controller that connects to OpenStack virtual machines via the SSH protocol, reorganizes the security service chain based on network attack trends, and achieves topology reconstruction of the containerized security service chain; By integrating the experimental data, we finally evaluate and output the actual application effect, response time, rule accuracy and system scalability of the solution based on the containerized security service chain, and verify the superiority of the orchestration method in real-time network security protection and dynamic defense strategy.

7. The method for dynamic orchestration of cloud-native security service chains for the industrial Internet according to claim 6 is characterized in that: In the process of dynamically configuring and managing the firewall container by mounting ConfigMap, ConfigMap, as a lightweight dynamic configuration component, can achieve cross-container data sharing and automatic updates.

8. The method for dynamically arranging cloud-native security service chains for the industrial Internet according to claim 6 is characterized in that: When the detection results are synchronously written to the ConfigMap mounted on the firewall container, when the ConfigMap content changes, the firewall container automatically reads the updated information and dynamically adjusts the firewall rules to ensure automated security policy updates in a cloud-native environment.

9. The method for dynamic orchestration of cloud-native security service chains for the industrial Internet according to claim 6 is characterized in that: The process of dynamically modifying the iptables rule chain includes: Immediately insert DROP rules for high-confidence threats with a threshold ≥ 0.85; Enable traffic marking and rate limiting policies for medium-confidence threats with a threshold of 0.6 ≤ threshold < 0.

85.

10. An application of the dynamic orchestration method of cloud-native security service chain for industrial Internet as described in any one of claims 1 to 9 in the dynamic reorganization scenario of industrial Internet.

Images