A server network state evaluation method and system

Abstract

The application relates to a server network state evaluation method and system, and relates to the technical field of server operation and maintenance. The method comprises the following steps: at least one first server in a first server cluster acquires real-time running data; the real-time running data is encrypted once to generate first encrypted data; the first encrypted data is transmitted to a second server in a second server cluster based on a secure communication protocol, so that the second server determines a state evaluation result based on a trained evaluation model after performing integrity verification on the first encrypted data; wherein the training process of the evaluation model comprises the following steps: deploying the evaluation model on at least two first servers and initializing corresponding network parameters; based on a preset training data set, the initialized evaluation model is locally trained, and encrypted gradient information generated in the local training process is transmitted to the second server, so that the second server performs global updating on the evaluation model based on the aggregation result of the encrypted gradient information. Compared with the prior art, the application can guarantee the privacy and security of server network state evaluation.

Description

Technical Field

[0001] This application relates to the field of server operation and maintenance technology, and in particular to a method and system for assessing server network status. Background Technology

[0002] With the rapid development of information technology, servers play a core role in modern computing architectures. The stability, performance, and security of their network status directly affect business continuity, user experience, and data security.

[0003] On the one hand, traditional server network status assessment methods usually rely on manual monitoring and experience-based judgment. This approach has many limitations. For example, manual monitoring is difficult to cover complex network environments in real time and comprehensively, and it is easy to miss potential problems. On the other hand, experience-based judgment often lacks accuracy and is difficult to quickly locate and handle complex faults.

[0004] On the other hand, data security and privacy are paramount during server network status assessment. Because network status assessment involves processing large amounts of sensitive data, including server hardware configuration information, network traffic data, and user behavior data, data leakage or tampering could pose serious risks. Summary of the Invention

[0005] Therefore, it is necessary to provide a server network status assessment method and system to address the aforementioned data security issues.

[0006] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows:

[0007] Firstly, a method for assessing server network status includes:

[0008] Instruct at least one first server in the first server cluster to obtain real-time runtime data;

[0009] The real-time running data is encrypted once to generate the first encrypted data;

[0010] Based on a secure communication protocol, the first encrypted data is transmitted to the second server in the second server cluster, so that after the second server performs integrity verification on the first encrypted data, it determines the state evaluation result of the first server based on the trained evaluation model.

[0011] The training process of the evaluation model includes:

[0012] The evaluation model is deployed on at least two of the first servers, and the corresponding network parameters are initialized.

[0013] The initialized evaluation model is locally trained based on a preset training data set, and encrypted gradient information generated in the local training process is transmitted to the second server, so that the second server updates the evaluation model globally based on an aggregation result of the encrypted gradient information after aggregating the encrypted gradient information from at least two first servers; wherein the training data set includes second encrypted data generated based on historical running data of the corresponding first server.

[0014] In a second aspect, a server network state evaluation system applies the method of the first aspect, and includes:

[0015] A data collection module is configured to enable at least one first server in a first server cluster to obtain real-time running data.

[0016] A data encryption module is configured to encrypt the real-time running data once to generate first encrypted data.

[0017] A state evaluation module is configured to transmit the first encrypted data to a second server in a second server cluster based on a secure communication protocol, so that the second server determines a state evaluation result about the first server based on a trained evaluation model after integrity verification of the first encrypted data.

[0018] The training process of the evaluation model includes:

[0019] The evaluation model is deployed on at least two first servers, and the corresponding network parameters are initialized.

[0020] The initialized evaluation model is locally trained based on a preset training data set, and encrypted gradient information generated in the local training process is transmitted to the second server, so that the second server updates the evaluation model globally based on an aggregation result of the encrypted gradient information after aggregating the encrypted gradient information from at least two first servers; wherein the training data set includes second encrypted data generated based on historical running data of the corresponding first server.

[0021] In a third aspect, an electronic device includes:

[0022] A memory is configured to store computer executable instructions or computer programs.

[0023] A processor is configured to execute the computer executable instructions or computer programs stored in the memory to implement the method of the first aspect.

[0024] In a fourth aspect, a computer readable storage medium, having stored thereon at least one instruction, at least one program, a set of codes or instructions, which are loaded and executed by a processor to implement the method according to the first aspect.

[0025] In a fifth aspect, a computer program product, comprising a computer program or computer executable instructions, which, when executed by a processor, implement the method according to the first aspect.

[0026] Compared with the prior art, the technical scheme of the present application has the beneficial effects that:

[0027] The present application discloses a server network state evaluation method, which encrypts the real-time running data of a first server and transmits it to a second server based on a secure communication protocol, so that a trained evaluation model performs state evaluation based on the first encrypted data, ensuring the security and privacy of the original data and improving the security of the server network state online evaluation method. At the same time, the present application applies a federated learning mechanism to the training of the evaluation model. During the training process, the first server only shares encrypted gradient information with the second server, and the second server side does not come into contact with the original data during the training process of the evaluation model, and ensures that the trained evaluation model can effectively capture the data features in the first encrypted data, improving the generalization ability and evaluation accuracy of the model. BRIEF DESCRIPTION OF DRAWINGS

[0028] Figure 1 The figure is a flowchart of the server network state evaluation method in some embodiments of the present application.

[0029] Figure 2 The figure is a flowchart of the training process of the evaluation model in some embodiments of the present application.

[0030] Figure 3 The figure is a structural diagram of the server network state evaluation system in some embodiments of the present application.

[0031] Figure 4 The figure is a hardware entity diagram of the electronic device in some embodiments of the present application. DETAILED DESCRIPTION

[0032] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms are interchangeable where appropriate; this is merely a way of distinguishing objects with the same attributes in the description of embodiments of this application. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion, so that a process, method, system, product, or apparatus that comprises a series of units is not necessarily limited to those units, but may include other units not explicitly listed or inherent to those processes, methods, products, or apparatuses. The term "determine" broadly covers a wide variety of actions, including acquiring, calculating, processing, deriving, investigating, searching (e.g., searching in a table, database, or other data structure), probing, and similar actions; it may also include receiving (e.g., receiving information), accessing (e.g., accessing data in memory), and similar actions; it may also include generating, creating, establishing, and similar actions; and parsing, selecting, choosing, and similar actions, etc. Definitions of other terms will be given in the following description.

[0033] It should be noted that when one element is considered to be "connected" to another element, it can be directly connected to the other element or connected to the other element through an intermediary element. Furthermore, in the following embodiments, "connection" should be understood as "electrical connection," "communication connection," etc., if there is transmission of electrical signals or data between the connected objects.

[0034] It should be emphasized that the acquisition, transmission, storage, use, and processing of data in the technical solutions of this application all comply with the relevant provisions of national laws and regulations.

[0035] In the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, they do not mean that the applicant has used or necessarily used the solution.

[0036] The accompanying drawings are for illustrative purposes only and should not be construed as limiting the scope of this patent.

[0037] To better illustrate this embodiment, some parts in the accompanying drawings may be omitted, enlarged, or reduced, and do not represent the actual product dimensions;

[0038] It will be understood by those skilled in the art that certain well-known structures and their descriptions may be omitted in the accompanying drawings.

[0039] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0040] Figure 1 shows a flowchart illustrating a server network status assessment method provided by some embodiments of this application, including:

[0041] S110. Instruct at least one first server in the first server cluster to obtain real-time running data;

[0042] S120. Encrypt the real-time running data once to generate the first encrypted data;

[0043] S130. Based on a secure communication protocol, the first encrypted data is transmitted to the second server in the second server cluster, so that after the second server performs integrity verification on the first encrypted data, it determines the state evaluation result of the first server based on the trained evaluation model.

[0044] Referring to Figure 2, the training process of the evaluation model includes:

[0045] S210. Deploy the evaluation model (denoted as "local model") on at least two of the first servers and initialize the corresponding network parameters;

[0046] S220. Based on a preset training dataset, the initialized evaluation model is trained locally, and the encrypted gradient information generated during the local training process is transmitted to the second server; wherein, the training dataset includes second encrypted data generated based on the historical running data of the corresponding first server;

[0047] S230. After aggregating the encrypted gradient information from at least two of the first servers, the second server globally updates the evaluation model based on the aggregation result of the encrypted gradient information.

[0048] Therefore, by applying the federated learning mechanism to server network state assessment, combined with data encryption methods and secure communication protocols, each first server only shares encrypted data (first encrypted data and encrypted gradient information) with the second server. This approach can fully leverage the advantages of distributed data while protecting data privacy, effectively safeguarding the security and privacy of server network state data. During the training and application of the assessment model, the second server will never access the original running data, and the original data remains invisible to the second server. This improves the security of the online server network state assessment method and enhances the generalization ability and accuracy of the assessment model. It is particularly suitable for data privacy-sensitive scenarios, such as medical data, financial data, or user personal information.

[0049] Federated learning is a distributed learning method aiming to train a shared machine learning model or neural network model on multiple clients (i.e., the first server in the present application). In the embodiments of the present application, each client only uses local data for model training without sharing data with other clients or a central server (i.e., the second server in the present application). It is emphasized that in traditional centralized learning, all data is usually centralized on a central server, and then model training is performed on the server. However, in federated learning, data remains on the respective clients, and each client only calculates the update information related to model training, rather than directly sharing data.

[0050] Firstly, referring to step S110, the real-time running data can be hardware performance data (such as CPU utilization, memory occupancy), energy consumption temperature data (such as core temperature, overall power consumption), network load data (such as data packet throughput, network delay, transmission error rate) or task load data collected in real time from the first server, or a collection of these data, so that the evaluation model can evaluate the current state and future trend of the first server based on multi-dimensional information. Exemplarily, the hardware performance data includes CPU utilization and memory occupancy.

[0051] Exemplarily, the running state on the first server side can be continuously monitored by deploying a real-time monitoring service, such as Prometheus, Nagios, and the latest data can be collected in real time.

[0052] In some implementations, the collected real-time running data needs to be preprocessed, including removing invalid / abnormal data, data standardization, statistical feature extraction, etc.

[0053] Exemplarily, for the operation of removing invalid / abnormal data, for example, data with CPU utilization exceeding 100% or less than 0%, and data with negative network delay are filtered out. If some data points are missing, interpolation method or average value based on adjacent data points can be used for filling.

[0054] For the operation of data standardization, for example, CPU utilization, memory occupancy and other data are normalized to the interval [0, 1], and the process can be represented as:

[0055]

[0056] For the operation of statistical feature extraction, for example, statistical features such as average value, standard deviation, maximum value and minimum value of the sliding window are extracted from the time series data.

[0057] Further, the preprocessed data is converted into a consistent feature matrix for training of the evaluation model.

[0058] Secondly, the state evaluation result can include not only the current performance indicators such as CPU utilization, memory occupancy and network delay, but also fault risk prediction and resource demand prediction, etc., providing comprehensive and accurate decision basis for operation and maintenance personnel. The evaluation model is implemented by using a neural network model, especially a neural network capable of capturing time series characteristics.

[0059] Exemplarily, the state evaluation result can include performance indicators such as CPU utilization, memory occupancy, network delay, etc.; can also include fault risk prediction results such as hardware failure probability, network anomaly risk, etc.; and can also include resource demand prediction results such as resource demand prediction for CPU, memory, network bandwidth, etc. in the future period of time.

[0060] Exemplarily, the first server can be evaluated by using an LSTM (Long Short-Term Memory) model. LSTM is a special recurrent neural network (RNN) that can effectively handle long-term dependencies in time series data, and is very suitable for evaluating the state of the server network. The output layer is used to output the evaluation result, such as the performance score or failure probability of the server, etc.

[0061] Next, the above LSTM model is described.

[0062] The LSTM model usually includes an input layer, an LSTM layer, a fully connected layer and an output layer.

[0063] The input dimension of the input layer is the dimension of the first encrypted data. The LSTM layer includes multiple LSTM units for capturing dynamic changes in time series data. The fully connected layer is used to map the output of the LSTM layer to the dimension of the evaluation indicators (such as performance indicators, fault risks, etc.). The output layer is used to output the state evaluation result, such as the performance score or failure probability of the first server, etc.

[0064] As a non-limiting example, the local training process of LSTM as an evaluation model is as follows:

[0065] Initialize model parameters: randomly initialize the weights and biases of the LSTM layer. Forward propagation: pass the first encrypted data through the LSTM layer and the fully connected layer to calculate the output result. Loss calculation: use mean square error (MSE) or cross-entropy loss function to calculate the difference between the model output and the true label. Backpropagation: calculate the gradient by backpropagation algorithm and update the model parameters using the optimizer (such as Adam). Cross-validation: use cross-validation method to evaluate the performance of the model to avoid overfitting.

[0066] In addition, in the embodiments of the present application, the security communication protocol refers to a protocol used to ensure the security of network communication, which aims to prevent unauthorized access, eavesdropping, tampering and data leakage, and is used to provide data integrity protection and ensure that data is not tampered with during transmission, such as the TLS / SSL protocol.

[0067] Furthermore, in step S220, the second encrypted data should use the same encryption method as the first encrypted data, so that the evaluation model can learn effective data features.

[0068] In some embodiments of the present application, step S120 can include steps S1201 to S1202.

[0069] S1201, the first server obtains a symmetric encryption key from a trusted HSM (Hardware Security Module); wherein the symmetric encryption key is generated by KMS (Key Management Service).

[0070] S1202, based on a symmetric encryption algorithm, the first server uses the symmetric encryption key to encrypt the real-time running data to generate the first encrypted data.

[0071] For example, the real-time running data is encrypted using AES-256 to ensure the confidentiality of the real-time running data during transmission. AES-256 is a symmetric encryption algorithm that uses a 256-bit key length, and the same key is used for encryption and decryption.

[0072] It can be understood that in the embodiments of the present application, the symmetric encryption algorithm can also use any one of DES, 3DES, TDEA, Blowfish, RC2, RC4 and RC5.

[0073] In the embodiments of the present application, KMS is a service for managing and protecting encryption keys, which is usually an independent security service that provides key generation, storage, distribution, rotation and destruction functions to ensure the security and availability of keys, and can be used to protect data and applications; KMS can use HSM to store keys to ensure the security of the keys. HSM is a physical device that can provide high-strength encryption and key management functions.

[0074] In some embodiments of the present application, the first server is deployed with a first digital certificate, and the second server is deployed with a second digital certificate; in step S130, the first encrypted data is transmitted to the second server in the second server cluster, which includes steps S1311 to S1313. In some embodiments of the present application, the first server is deployed with a first digital certificate, and the second server is deployed with a second digital certificate; in step S130, the first encrypted data is transmitted to the second server in the second server cluster, which includes steps S1311 to S1313.

[0075] S1311, based on the two-way authentication mechanism, when the first server verifies the second digital certificate of the second server and passes, and the second server verifies the first digital certificate of the first server and passes, a session key is generated.

[0076] Exemplarily, the verification process includes checking the validity period of the certificate, the signature of the certificate authority, and whether the server identity information in the certificate matches the target server. The certificate verification ensures the legal identity of the communication parties and prevents man-in-the-middle attacks.

[0077] S1312, the first server re-encrypts the first encrypted data using the session key to generate second encrypted data.

[0078] S1313, the second encrypted data is transmitted to the second server based on a secure communication protocol, so that the second server decrypts the second encrypted data based on the session key to obtain the first encrypted data.

[0079] In some implementations, the first server acts as a client and initiates a TLS / SSL connection request to the second server. After receiving the connection request, the second server sends its own second digital certificate to the client, and the first server verifies the authenticity of the second digital certificate of the second server using the public key of the CA. After verification, the first server sends its own first digital certificate to the second server. The second server verifies the authenticity of the first digital certificate of the first server using the public key of the CA to ensure the legal identity of the client. After the verification of the certificates of both parties, the first server and the second server negotiate a session key through the TLS / SSL protocol, which is used to encrypt and decrypt data in this connection. The negotiation process of the session key is based on asymmetric encryption algorithm, which ensures the security of the key exchange. The first server uses the negotiated session key to re-encrypt the encrypted data (i.e. the first encrypted data) and transmits it to the second server through the TLS / SSL channel. The second server uses the same session key to decrypt the received data to restore the original first encrypted data.

[0080] Further, the transmission of the encrypted gradient information in step S220 can also use a similar method. The first server encrypts the encrypted gradient information (denoted as "second encrypted gradient information") using the session key and then transmits it to the second server. The second server decrypts the second encrypted gradient information using the session key to restore the original encrypted gradient information.

[0081] In some embodiments of the present application, in order to ensure the reliability and integrity of the first encrypted data received by the second server, the integrity verification process in step S130 can include steps S1321-S1323.

[0082] S1321, generating a first digest value about the received first encrypted data at the second server based on a hash algorithm.

[0083] The hash algorithm (Hash) is also called digest algorithm. It can perform hash operation on any set of input data to obtain a fixed-length output digest. For the hash algorithm, the same input will always produce the same output, while different inputs will probably produce different outputs.

[0084] As a non-limiting example, SHA-256 is used in step S1321 to generate a first digest value based on the first encrypted data. SHA-256 is a one-way encryption algorithm that can convert data of any length into a fixed-length (256-bit) digest value. The generated digest value has a high degree of uniqueness. Even if one byte of data is changed, the generated digest value will be completely different.

[0085] S1322, comparing the first digest value with a second digest value received from the first server to generate a comparison result; wherein the second digest value is generated by the first server based on hash operation on the first encrypted data.

[0086] In some specific implementations, the first server divides the first encrypted data to be sent into data blocks of a fixed size (e.g., 512 bytes) Each data block is processed using the SHA-256 algorithm to generate a second digest value which is then sent to the second server together with the data block .

[0087] S1323, when the comparison result reflects that the first digest value is consistent with the second digest value, it is considered that the first encrypted data received by the second server passes the integrity verification.

[0088] Specifically, the digest values generated based on the SHA-256 algorithm (256-bit binary numbers) are compared bit by bit. If the two digest values are consistent, it can be highly confident that the data has not been tampered with during transmission; if the digest values are not consistent, the second server will discard the data and send an error notification to the first server, requiring the data to be re-collected and transmitted. By comparing the digest values bit by bit, the reliability of the comparison result can be ensured.

[0089] Thus, by comparing the first digest value and the second digest value received from the first server, if the two digest values are consistent, it indicates that the data has not been tampered with during transmission, and the integrity of the data is guaranteed; if the digest is inconsistent, an error handling mechanism can be triggered, such as discarding the data and re-requesting data transmission, thereby ensuring the reliability, security and integrity of the data. On the basis of ensuring the integrity and security of the data, the evaluation model determines the state evaluation result of the first server according to the data that passes the verification, which is more accurate.

[0090] In some embodiments of the present application, step S230 can include steps S2310-S2330.

[0091] S2310, the second server receives the encrypted gradient information and decrypts it using KMS to obtain decrypted first gradient information; the encrypted gradient information is obtained by encrypting the first gradient information calculated in the local training process by the first server.

[0092] It should be understood that the gradient information is the derivative of the model parameters, indicating the direction and amplitude of the model parameters that need to be adjusted during the training process.

[0093] S2320, the first gradient information from at least two first servers is aggregated to generate an aggregation result.

[0094] Illustratively, the aggregation process can use weighted average or other optimization algorithms to ensure that the global model can integrate the training results of each local model.

[0095] S2330, the evaluation model is globally updated according to the aggregation result, and the global network parameters of the evaluation model are transmitted to the first server to initialize the evaluation model deployed on the first server in the next round of local training.

[0096] Illustratively, the second server performs weighted average on the gradient information (denoted as and ) passed by the first server A and another first server B to generate an aggregation result, and the update process of the global network parameters can be represented as:

[0097]

[0098] In the formula, denotes the learning rate. denotes the global network parameters before updating. is calculated by the first server A based on its local data, is calculated by the first server B based on its local data.

[0099] It should be noted that the original data usually contains sensitive information, and direct sharing of these data may lead to privacy leakage. By sharing only gradient information, direct transmission of original data can be avoided, thereby protecting data privacy.

[0100] It should also be noted that, similar to the transmission process of encrypted gradient information, the network parameters updated globally in step S2303 are transmitted to the first server participating in the next round of local training by the second server after establishing a session key through mutual authentication and negotiation at the beginning of the next round of local training.

[0101] Thus, even if the encrypted gradient information or parameter information is intercepted during transmission, it is difficult for an attacker to restore the original data from these information, because the encrypted gradient information or updated parameter information is calculated and encrypted.

[0102] It should be noted that, by transmitting the globally updated network parameters to the first server for initializing the network parameters of the evaluation model deployed on the first server in step S2330, the convergence speed of the local model during local training can be improved.

[0103] In some implementations, the performance of the evaluation model is periodically evaluated to check the accuracy and reliability of the state evaluation results. If the model performance is found to be declining, the retraining or optimization process of the model is triggered. Automatic hyperparameter tuning techniques such as Bayesian optimization are used to dynamically adjust the hyperparameters according to the performance of the model to improve the performance and generalization ability of the model.

[0104] In some embodiments of the present application, the method can further include the following steps:

[0105] S140, adjusting the resource allocation strategy of the first server according to the state evaluation result; wherein the resource allocation strategy includes adjusting at least one of CPU, GPU, memory, storage, network and task load of the first server.

[0106] Illustratively, when the state evaluation result shows that the task load of a certain first server is too high, such as CPU-intensive tasks (which can be manifested as CPU utilization continuously exceeding 80%), part of the CPU-intensive tasks are migrated to other servers with lower CPU utilization, for example, through a load balancing algorithm, the tasks are distributed to servers with CPU utilization lower than 50%. If it is a memory-intensive task (which can be manifested as memory occupancy continuously exceeding 90%), the memory allocation strategy is adjusted, for example, part of the memory-intensive tasks are migrated to the first server with lower memory utilization, or part of the memory is released through memory compression technology.

[0107] Exemplarily, when the state evaluation result shows that the storage capacity of a first server is insufficient, an elastic scaling strategy is performed on the first server to provide server performance.

[0108] Exemplarily, when the state evaluation result shows that a first server has a hardware failure risk (such as a hard disk failure probability exceeding 10%), the system selects to migrate the key tasks on the first server to other healthy first servers in the cluster in advance to prevent data loss or service interruption. If the state evaluation result shows that the network delay of a server is too high or there is a network abnormal risk (such as a network packet loss rate exceeding 5%), the network configuration is adjusted, such as reallocating network bandwidth or switching to a backup network path.

[0109] Exemplarily, when the state evaluation result shows that a server will face high load in the future, the system will allocate more CPU and memory resources to it in advance to ensure the stable operation of the service. If the state evaluation result shows that the load of a first server is low (such as CPU utilization being less than 20%), the system will automatically reduce its resource allocation, such as reducing the number of CPU cores or reducing the amount of memory allocation, to save energy.

[0110] Some embodiments of the present application also provide a server network state evaluation system, referring to FIG. 3, comprising:

[0111] The data acquisition module 601 is configured to enable at least one first server in the first server cluster to obtain real-time running data;

[0112] The data encryption module 602 is configured to encrypt the real-time running data once to generate first encrypted data;

[0113] The state evaluation module 603 is configured to transmit the first encrypted data to a second server in a second server cluster based on a secure communication protocol, so that the second server determines a state evaluation result about the first server based on a trained evaluation model after performing integrity verification on the first encrypted data;

[0114] The training process of the evaluation model comprises:

[0115] The evaluation model is deployed on at least two first servers, and the corresponding network parameters are initialized;

[0116] The initialized evaluation model is locally trained based on a preset training data set, and the encrypted gradient information generated in the local training process is transmitted to the second server, so that the second server updates the evaluation model globally based on the aggregation result of the encrypted gradient information after aggregating the encrypted gradient information from at least two first servers; wherein the training data set includes second encrypted data generated based on historical running data of the corresponding first server.

[0117] Some embodiments of the present application also provide a computer readable storage medium, wherein at least one instruction, at least one program, a code set or an instruction set is stored on the storage medium, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor, so that the processor executes part or all steps of the method provided in other embodiments of the present application.

[0118] It can be understood that the storage medium can be transitory or non-transitory. Exemplarily, the storage medium includes but is not limited to a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0119] Exemplarily, the processor can be a central processing unit (CPU), a microprocessor unit (MPU), a digital signal processor (DSP), an application-specific integrated circuit (ASIC) or a field programmable gate array (FPGA).

[0120] Exemplarily, the read-only memory includes but is not limited to a mask ROM, a PROM (programmable ROM), an EPROM (erasable programmable ROM), an EEPROM (electrically erasable programmable ROM), a flash memory and the like.

[0121] Exemplarily, the random access memory includes, but is not limited to, DRAM (Dynamic Random Access Memory), SRAM (Static Random Access Memory), SDRAM (Synchronous Dynamic Random Access Memory), DDR SDRAM (Double Data Rate Synchronous Dynamic Random Access Memory), ESDRAM (Enhanced SDRAM), SLDRAM (Synchronous-Link DRAM), RDRAM (Rambus Dynamic Random Access Memory), etc.

[0122] In some examples, a computer program product is provided, which can be implemented by hardware, software or a combination thereof. As a non-limiting example, the computer program product can be embodied as the storage medium, and can also be embodied as a software product, such as an SDK (Software Development Kit) or the like.

[0123] As a non-limiting example, a computer program product is provided, which includes a computer program or computer executable instructions stored in a computer readable storage medium. A processor of an electronic device reads the computer program or computer executable instructions from the computer readable storage medium, and the processor executes the computer executable instructions, so that the electronic device performs part or all of the steps of the method described in the embodiments of the present application.

[0124] In some examples, a computer program is provided, which includes computer readable code, and in the case where the computer readable code runs in a computer device, a processor in the computer device performs part or all of the steps of the method.

[0125] In some embodiments of the present application, an electronic device is also provided, which includes a memory and a processor, the memory stores at least one instruction, at least one program, a code set or an instruction set, and the processor executes the at least one instruction, at least one program, code set or instruction set to implement part or all of the steps of the method described in another embodiment of the present application.

[0126] In some examples, a hardware entity of the electronic device is provided, referring to FIG. 4, including: a processor, a memory and a communication interface; wherein the processor generally controls the overall operation of the electronic device; the communication interface is used for the electronic device to communicate with other terminals or servers through a network; the memory is configured to store instructions and applications executable by the processor, and can also cache data to be processed by the processor and data to be processed or having been processed by each module in the electronic device (including but not limited to image data, audio data, voice communication data and video communication data), which can be realized by FLASH, EPROM (Erasable Programmable Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory) or RAM (Random Access Memory).

[0127] The processor can include one or more processing elements. Thus, the processor can include one or more integrated circuits (ICs) that are configured to perform the functions of the processor. In addition, each integrated circuit can include circuitry (e.g., first circuitry, second circuitry, and other circuitry, etc.) that is configured to perform the functions of the processor.

[0128] Further, the processor, the communication interface and the memory can transmit data through a bus, which can include any number of interconnected buses and bridges, connecting the various circuitries of the one or more processors and the memory together.

[0129] The same or similar reference numerals can correspond to the same or similar components;

[0130] The terms describing the positional relationship in the drawings are only used for exemplary illustration, and cannot be understood as a limitation to the present application;

[0131] It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0132] In different specific implementations, the methods or systems described in the present application can be implemented in software, hardware or their combination. In addition, the order of the steps of the method can be changed, and various elements can be added, reordered, combined, omitted, modified, etc.

[0133] Obviously, the above embodiments of the present application are only examples for clearly illustrating the present application, and are not intended to limit the implementation of the present application, and are not used to limit the present application. Based on the above description, other different forms of changes or variations can be made by those skilled in the art, and each separate structure / function module or unit can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part, and the structure and function of the separate components can be realized as a combined structure or component. Here, all the implementations are not required or possible to be exhausted. Any modification, equivalent replacement and improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the claims of the present application.

Claims

1. A method for server network state evaluation, characterized by, The method comprises: acquiring real-time running data by at least one first server in a first server cluster; encrypting the real-time running data once to generate first encrypted data; transmitting the first encrypted data to a second server in a second server cluster based on a secure communication protocol, so that the second server determines a state evaluation result about the first server based on a trained evaluation model after performing integrity verification on the first encrypted data; wherein the training process of the evaluation model comprises: deploying the evaluation model on at least two first servers and initializing corresponding network parameters; based on a preset training data set, locally training the initialized evaluation model, and transmitting encrypted gradient information generated in the local training process to the second server, so that the second server updates the evaluation model globally based on the aggregation result of the encrypted gradient information after aggregating the encrypted gradient information from at least two first servers; wherein the training data set comprises second encrypted data generated based on historical running data of the corresponding first server.

2. The method of claim 1, wherein, The encryption of the real-time running data once comprises: the first server acquires a symmetric encryption key from a trusted hardware security module; wherein the symmetric encryption key is generated by a key management service; based on a symmetric encryption algorithm, the first server encrypts the real-time running data using the symmetric encryption key to generate the first encrypted data.

3. The method of claim 2, wherein, Global updating of the evaluation model based on the aggregation result of the encrypted gradient information comprises: the second server receives the encrypted gradient information and decrypts it using a key management service to obtain decrypted first gradient information; the encrypted gradient information is obtained by encrypting the first gradient information calculated in the local training process by the first server; aggregating the first gradient information from at least two first servers to generate an aggregation result; updating the evaluation model globally according to the aggregation result, and transmitting the global network parameters of the evaluation model to the first server in the next round of local training to initialize the evaluation model deployed on the first server.

4. The method of claim 2, wherein, The integrity verification process of the second server on the first encrypted data comprises: based on a hash algorithm, generating a first digest value about the received first encrypted data on the second server; comparing the first digest value with a second digest value received from the first server to generate a comparison result; wherein the second digest value is generated by the first server based on a hash operation on the first encrypted data; when the comparison result reflects that the first digest value is consistent with the second digest value, it is considered that the first encrypted data received by the second server passes the integrity verification.

5. The method of claim 1-4, wherein, The first server is deployed with a first digital certificate, and the second server is deployed with a second digital certificate; the first encrypted data is transmitted to the second server in the second server cluster, comprising: Based on the bidirectional authentication mechanism, when the first server verifies the second digital certificate of the second server and passes, and the second server verifies the first digital certificate of the first server and passes, a session key is generated; The first server uses the session key to encrypt the first encrypted data again to generate second encrypted data; The second encrypted data is transmitted to the second server based on a secure communication protocol, so that the second server decrypts the second encrypted data based on the session key to obtain the first encrypted data.

6. The method of claim 1, wherein, Also includes: According to the state evaluation result, the resource allocation strategy of the first server is adjusted; wherein the resource allocation strategy includes adjusting at least one of CPU, GPU, memory, storage, network and task load of the first server.

7. A server network state evaluation system, applying the method of any one of claims 1 to 6, characterized by Including: The data acquisition module is used for at least one first server in the first server cluster to acquire real-time running data; The data encryption module is used for encrypting the real-time running data once to generate first encrypted data; The state evaluation module is used for transmitting the first encrypted data to the second server in the second server cluster based on a secure communication protocol, so that the second server determines the state evaluation result of the first server based on the trained evaluation model after integrity verification of the first encrypted data; Wherein, the training process of the evaluation model includes: Deploy the evaluation model on at least two first servers and initialize the corresponding network parameters; Based on the preset training data set, the initialized evaluation model is locally trained, and the encrypted gradient information generated in the local training process is transmitted to the second server, so that the second server aggregates the encrypted gradient information from at least two first servers, and updates the evaluation model based on the aggregation result of the encrypted gradient information; wherein, the training data set includes second encrypted data generated based on the historical running data of the corresponding first server.

Images