Target node processing method, apparatus, computer program product, and electronic device

Abstract

The application discloses a target node processing method and device, a computer program product and an electronic device. It relates to the field of network security or other related fields. The method comprises: obtaining network simulation data, and deploying a simulation cluster according to the network simulation data, wherein the simulation cluster is used for network simulation; in the case of network simulation of the simulation cluster, assigning simulation requests in the network simulation process to M target nodes of the simulation cluster, and detecting the M target nodes, wherein the detection type at least includes one of the following: target node running state detection and target node resource state detection; if there are N target nodes in an abnormal state, the N target nodes are adjusted and processed, and an alarm information is generated, wherein the alarm information is used to prompt the attention of the target node. Through the application, the problem of relying on a single target node and the unbalanced load between target nodes in the network target range in the related art is solved.

Description

Technical Field

[0001] This application relates to the field of network security or other related fields, and more specifically, to a method, apparatus, computer program product, and electronic device for processing target nodes. Background Technology

[0002] In the field of cybersecurity, network ranges, as highly simulated network environments, play a crucial role and are widely used for cybersecurity attack and defense drills, technical research, and education and training. Network ranges contain various targets that simulate real-world network scenarios, capable of simulating different types of services, applications, and network devices. However, with the continuous evolution and increasing complexity of network technologies, higher demands are being placed on the stability and availability of network ranges.

[0003] Traditional network range architectures often employ single or small-scale target deployments. When facing high concurrency or sustained network attacks, these single or small target instances are prone to overload, leading to target service crashes, response delays, or service failures, severely impacting the range's availability and efficiency. Current network range architectures often lack automated, real-time fault detection and recovery mechanisms. Once a target instance fails, manual intervention is required, affecting service continuity and user experience. The lack of effective redundancy mechanisms can cause the entire range to become unavailable, interrupting ongoing drills or research activities. Simple round-robin algorithms ignore performance differences between nodes, easily causing high-load nodes to fatigue prematurely while low-load nodes waste resources. While least-connection algorithms can distribute connections, their response speed and adjustment capabilities are limited when facing dynamically changing loads. Furthermore, traditional solutions are typically statically configured, often lacking automated fault detection and recovery mechanisms. They struggle to dynamically adjust the number of nodes and resource allocation based on the actual load of the network range, failing to effectively handle sudden traffic surges or other special scenarios, requiring manual intervention, increasing operational costs and response time. In an environment where multiple target instances coexist, the lack of effective security isolation measures means that the failure or attack of one target may affect the normal operation of the entire range.

[0004] There is currently no effective solution to the problem that network test ranges in related technologies rely on a single target node and have unbalanced loads among the target nodes. Summary of the Invention

[0005] The main objective of this application is to provide a method, apparatus, computer program product, and electronic device for processing target nodes, in order to solve the problem in related technologies where network test ranges rely on a single target node and the load is unbalanced among target nodes.

[0006] To achieve the above objectives, according to one aspect of this application, a method for processing target nodes is provided. The method includes: acquiring network exercise data; deploying an exercise cluster based on the network exercise data, wherein the exercise cluster is used for network exercises; when conducting network exercises on the exercise cluster, allocating exercise requests during the network exercise process to M target nodes of the exercise cluster, and detecting the M target nodes, wherein the detection type includes at least one of the following: target node running status detection and target node resource status detection, where M is a positive integer; if N target nodes exhibit abnormal states, adjusting and processing the N target nodes and generating alarm information, wherein the alarm information is used to alert attention to the N target nodes, where N is less than or equal to M, and N is a positive integer.

[0007] Furthermore, deploying the exercise cluster based on network exercise data includes: extracting the business requirements of the network exercise from the network exercise data, wherein the business requirements are used to indicate the target type of each target node; determining M target nodes using the business requirements, and determining Y target instances based on the M target nodes, wherein Y is greater than or equal to M and Y is a positive integer; encapsulating the Y target instances to obtain Y processed target instances; and deploying the Y processed target instances in different locations across multiple networks to obtain the exercise cluster, wherein the multiple networks include at least: physical servers and virtual machines.

[0008] Furthermore, allocating network exercise requests to the M target nodes of the exercise cluster includes: obtaining a preset load balancer, configuring the preset load balancer according to the network exercise data to obtain the load balancer, wherein the load balancer is associated with an initial distribution strategy, which refers to distributing exercise requests evenly; using the load balancer to monitor the node load data of the M target nodes, and if there are target nodes among the M target nodes whose node load data is greater than a preset load threshold, adjusting the initial distribution strategy to obtain an updated distribution strategy; and allocating exercise requests to the M target nodes based on the updated distribution strategy.

[0009] Furthermore, allocating exercise requests to the M target nodes based on the update distribution strategy includes: obtaining historical request data for network exercises, determining predicted load data based on the historical request data, wherein the predicted load data is used to indicate the load change trend; obtaining the node resource thresholds of the M target nodes, adjusting the M node resource thresholds based on the predicted load data to obtain M updated resource thresholds; and, in the case of conducting network exercises on the exercise cluster, prioritizing the distribution of exercise requests to target nodes whose updated resource thresholds are less than or equal to the preset load thresholds.

[0010] Furthermore, allocating exercise requests to the M target nodes based on the updated distribution strategy includes: obtaining node allocation data for the M target nodes, wherein each node allocation data is used to indicate the resource data available to each target node; determining the weight value of each target node based on the M node allocation data, thus obtaining M weight values; and, in the case of conducting network exercises on the exercise cluster, obtaining request processing data for the M target nodes, and allocating exercise requests to the M target nodes in a round-robin manner based on the M weight values ​​and the M request processing data.

[0011] Further, the adjustment process for the N target nodes includes: obtaining K candidate target nodes from the target library and acquiring the target features of each candidate target node to obtain K sets of target features, wherein each target feature includes at least one of the following: the physical location of the node, the node's computing speed, and the applicable type, where K is greater than or equal to N and K is a positive integer; performing data transformation on each set of target features to obtain K sets of transformed target features, and calculating the score of each candidate target node based on the weight of the target features in each set of target features and the transformed target features in each set to obtain K target scores; and selecting N candidate target nodes from the K candidate target nodes based on the K target scores, and replacing the N target nodes with the N candidate target nodes.

[0012] Furthermore, the adjustment process for the N target nodes includes: backing up the traffic of the N target nodes and switching the traffic of the N target nodes to the MN target nodes.

[0013] To achieve the above objectives, according to another aspect of this application, a target node processing apparatus is provided. The apparatus includes: an acquisition unit, configured to acquire network exercise data and deploy an exercise cluster based on the network exercise data, wherein the exercise cluster is used for network exercises; an allocation unit, configured to allocate exercise requests during the network exercise process to M target nodes of the exercise cluster during network exercises, and to detect the M target nodes, wherein the detection type includes at least one of the following: target node running status detection and target node resource status detection, where M is a positive integer; and an adjustment unit, configured to adjust N target nodes and generate alarm information if N target nodes exhibit abnormal states, wherein the alarm information is used to alert attention to the N target nodes, where N is less than or equal to M, and N is a positive integer.

[0014] According to another aspect of the present invention, a computer storage medium is also provided for storing a program, wherein the program, when running, controls the device where the computer storage medium is located to execute a target node processing method.

[0015] According to another aspect of the present invention, an electronic device is also provided, comprising one or more processors and a memory; the memory stores computer-readable instructions, and the processor is configured to execute the computer-readable instructions, wherein the computer-readable instructions, when executed, perform a target node processing method.

[0016] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, performs a method for processing a target node.

[0017] This application employs the following steps: acquiring network drill data; deploying a drill cluster based on the network drill data, wherein the drill cluster is used for network drills; during network drills on the drill cluster, allocating drill requests to M target nodes of the drill cluster, and detecting the M target nodes, wherein the detection type includes at least one of the following: target node running status detection and target node resource status detection, where M is a positive integer; if N target nodes exhibit abnormal states, adjusting and processing the N target nodes and generating alarm information, wherein the alarm information is used to alert attention to the N target nodes, where N is less than or equal to M, and N is a positive integer. This addresses the problem in related technologies where network ranges rely on a single target node and the load is unbalanced among target nodes. By deploying a drill cluster based on network drill data, detecting the target nodes of the drill cluster during the drill process, and adjusting target nodes with abnormal states, the application achieves the effects of avoiding single points of failure, preventing local overload of target nodes, and improving the processing efficiency of target nodes. Attached Figure Description

[0018] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0019] Figure 1 This is a flowchart of a target node processing method provided according to an embodiment of this application;

[0020] Figure 2 This is a schematic diagram of a target node determination method provided according to an embodiment of this application;

[0021] Figure 3 This is a schematic diagram of a target node screening method provided according to an embodiment of this application;

[0022] Figure 4 This is a schematic diagram of a target node processing device provided according to an embodiment of this application;

[0023] Figure 5This is a schematic diagram of an electronic device provided according to an embodiment of this application. Detailed Implementation

[0024] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0025] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0026] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0027] It should be noted that all information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this disclosure are information and data authorized by the user or fully authorized by all parties. For example, this system has an interface with the relevant user or organization. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain the relevant information after receiving consent from the aforementioned user or organization.

[0028] It should be noted that the information collected in this application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data all comply with the relevant laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation access points for users to choose to authorize use or refuse use.

[0029] The present invention will now be described in conjunction with preferred implementation steps. Figure 1 This is a flowchart of a target node processing method provided according to an embodiment of this application, such as... Figure 1 As shown, the method includes the following steps:

[0030] Step S101: Obtain network drill data and deploy a drill cluster based on the network drill data, wherein the drill cluster is used to conduct network drills.

[0031] Specifically, network drills can be simulated using a network range. To ensure the network range can adapt to the needs of network security drills, relevant data for the drills must first be collected, i.e., network drill data. This data can include attack types, frequencies, intensities, target system configurations, network traffic patterns, etc. Then, based on the collected network drill data, the expected goals, requirements, and scale of the drills are analyzed to plan the architecture of the drill cluster, determining the number, type, and configuration of the required target nodes, as well as the network topology. Furthermore, necessary computing resources, including CPUs (Central Processing Units), memory, storage, and network bandwidth, can be pre-allocated according to the drill requirements to ensure the target nodes can operate stably and without resource constraints during the drills. Subsequently, the target service environment is built and configured on the determined target nodes, i.e., the drill cluster is obtained. The drill cluster is associated with an operating system, network services, application software, security protection mechanisms, etc., ensuring that the environment of each node is consistent to facilitate load balancing and failover.

[0032] It should be noted that when deploying the training cluster, target instances can also be deployed, that is, appropriate target instances such as servers, database systems, network device simulators, etc. can be deployed according to the training scenario.

[0033] Step S102: In the case of network drills on the drill cluster, drill requests during the network drill process are allocated to the M target nodes of the drill cluster, and the M target nodes are detected. The detection type includes at least one of the following: target node running status detection and target node resource status detection, where M is a positive integer.

[0034] Specifically, after determining the training cluster to be used during the network drill, the network drill can be conducted based on that cluster. First, a suitable load balancing strategy can be selected according to the scale and expected goals of the network drill. For example, a weighted round-robin algorithm or a least-connections algorithm can be selected, that is, the request allocation can be dynamically adjusted according to the performance differences of the target nodes and the current number of connections.

[0035] Furthermore, during the exercise, it is necessary to continuously monitor network traffic and the real-time load of target nodes, dynamically adjust load balancing parameters, and ensure that requests are reasonably distributed to each node to avoid overloading any node and ensure the normal operation of the target service. This requires monitoring the operational status of multiple target nodes in the exercise cluster. Specifically, heartbeat requests can be sent to each target node periodically to check if the node can respond. If a node does not respond for an extended period, the load balancer marks it as offline. Services running on target nodes can be monitored to check if they are operating normally and can handle external requests. Error logs on target nodes can also be analyzed to identify potential service anomalies or system errors, allowing for timely remedial measures.

[0036] It should be noted that, to ensure the effective utilization of the target node's computing and network resources, the resource status of the target node can be monitored. For example, the CPU and memory usage of the target node can be monitored to ensure that resource usage does not reach saturation, affecting service response speed and stability; the disk space usage of the target node can be checked to prevent service abnormalities or data loss due to insufficient disk space; network bandwidth consumption and network latency between target nodes can be monitored to ensure that network resources can meet the needs of request processing, especially in high-concurrency or remote access scenarios; for physical servers, server temperature and hardware health status can be monitored to prevent service interruptions due to overheating or hardware failure.

[0037] Step S103: If N target nodes are in an abnormal state, adjust the N target nodes and generate alarm information. The alarm information is used to prompt attention to the N target nodes, where N is less than or equal to M and N is a positive integer.

[0038] Specifically, once an abnormal running or resource status of one or more target nodes is detected, adjustments need to be made to the abnormal target nodes. For example, traffic can be switched to healthy target nodes, and backup nodes or instances can be activated to ensure service continuity. The computing resources of the nodes can also be dynamically adjusted based on their real-time resource status, such as increasing CPU and memory, or increasing the number of nodes through the cloud platform's elastic scaling function to cope with high load conditions. Simultaneously, alarm information needs to be generated for these abnormal target nodes. This alarm information can include key information such as the identifier of the abnormal node (e.g., service name, node name), the type of abnormality (e.g., resource exhaustion, service crash, network interruption), the timestamp of the abnormality, and the severity of the abnormality (minor, severe, fatal).

[0039] It should be noted that when generating alarm information, alarm information can be classified according to the severity of the anomaly. For example, a minor anomaly may simply be a high resource utilization rate, which can be notified via email; while for a serious anomaly (such as a complete service unavailability), a notification should be sent immediately via telephone, SMS or emergency notification system.

[0040] also, Figure 2 This is a schematic diagram of the target node determination method provided in the embodiments of this application, as shown below. Figure 2 As shown, in order to achieve dynamic switching and load balancing of target nodes in the network range to ensure high availability and stability, after a user terminal sends a network exercise request, these requests are first routed to the range control center. Then, the range control center identifies the request and determines whether a target cluster needs to be built. The range control center is responsible for the management and scheduling of the entire network range. In the initial state, it can evenly distribute exercise requests to multiple active main targets.

[0041] When a network exercise request indicates that only one target is needed for the exercise, a backup target must be selected in addition to the primary target to ensure that the user's network exercise request can be continuously responded to without interruption due to the failure of the primary target. When a network exercise request indicates that multiple physical servers or virtual machines need to be used for the network exercise, the range control center can select multiple targets to build a target cluster. During the network exercise, the range control center continuously monitors the status of the primary target. When it is detected that the resource utilization of one of the primary target nodes exceeds a preset threshold, it indicates that the node may have performance problems due to high load. At this time, an automatic failover mechanism can be activated to back up the traffic of the node, and at the same time, newly incoming requests and backed-up data are redistributed to the backup target to ensure that the user's network exercise request can be continuously responded to without interruption due to the failure of the node.

[0042] The target node processing method provided in this application embodiment acquires network exercise data and deploys an exercise cluster based on the network exercise data, wherein the exercise cluster is used for network exercises; when performing network exercises on the exercise cluster, exercise requests during the network exercise process are allocated to M target nodes of the exercise cluster, and the M target nodes are detected, wherein the detection type includes at least one of the following: target node running status detection and target node resource status detection, where M is a positive integer; if N target nodes are in an abnormal state, the N target nodes are... The system adjusts and generates alarm information for each target node. This alarm information alerts users to pay attention to N target nodes, where N is less than or equal to M and is a positive integer. This addresses the problem in related technologies where network test ranges rely on a single target node and experience uneven load distribution among them. By deploying a test cluster based on network test data and monitoring the target nodes during the test, the system adjusts any abnormal target nodes. This avoids single points of failure, prevents localized overload of target nodes, and improves the processing efficiency of target nodes.

[0043] Optionally, in the target node processing method provided in this application embodiment, deploying the exercise cluster based on network exercise data includes: extracting the service requirements of the network exercise from the network exercise data, wherein the service requirements are used to indicate the target type of each target node; determining M target nodes using the service requirements, and determining Y target instances based on the M target nodes, wherein Y is greater than or equal to M and Y is a positive integer; encapsulating the Y target instances to obtain Y processed target instances; and deploying the Y processed target instances at different locations in multiple networks to obtain the exercise cluster, wherein the multiple networks include at least: physical servers and virtual machines.

[0044] Specifically, in the preliminary preparation phase of a network range exercise, it is necessary to extract business requirements from the network exercise data and deploy target nodes and create target instances based on these requirements. First, the extracted business requirements can be used, such as simulating specific types of network attacks, testing the security capabilities of specific systems (e.g., servers, databases), and evaluating the effectiveness of security measures. Then, based on these business requirements, the type of target each target node should simulate is determined, such as operating system servers, firewalls, database management systems, and applications, ensuring that each node meets the specific requirements of the exercise.

[0045] Furthermore, based on the scale and complexity of the network drills, target nodes and target instances are identified. A target node is the physical or virtual location that actually hosts the target; it refers to the server or virtual machine in the network range that actually runs the target service. A target instance is the specific running entity or copy of the target. When a target is deployed in the network range, it can be replicated into multiple instances to diversify risk, improve availability, or meet the needs of concurrent testing. When deploying target instances, a reasonable network architecture needs to be planned to ensure smooth communication between different locations.

[0046] Furthermore, container technology is used to encapsulate the identified target instances, ensuring that each target instance can run normally on different physical servers or virtual machines, thereby obtaining the corresponding processed target examples.

[0047] Furthermore, multiple identical target instances can be deployed in different locations within the network. When one instance becomes unavailable, other instances can continue to provide services. Simultaneously, load balancing technology is used to distribute requests reasonably among the target instances, avoiding single points of failure. In other words, through multi-instance deployment and failover mechanisms, stability and availability are enhanced, resulting in a training cluster. This embodiment utilizes business needs to determine target instances, ensuring the network range can highly simulate various network environments and attack scenarios. Furthermore, by employing multi-instance deployment and load balancing strategies, even under high concurrency access or continuous network attacks, target nodes and services can still operate stably and unaffected, guaranteeing high availability and a good user experience for the network range.

[0048] Optionally, in the target node processing method provided in this application embodiment, allocating exercise requests during the network exercise process to the M target nodes of the exercise cluster includes: obtaining a preset load balancer, configuring the preset load balancer according to the network exercise data to obtain the load balancer, wherein the load balancer is associated with an initial distribution strategy, the initial distribution strategy being to distribute the exercise requests evenly; using the load balancer to monitor the node load data of the M target nodes, and if there is a target node among the M target nodes whose node load data is greater than a preset load threshold, adjusting the initial distribution strategy to obtain an updated distribution strategy; and allocating exercise requests to the M target nodes based on the updated distribution strategy.

[0049] Specifically, during network drills in a network range, in order to improve the response speed and stability of target services while ensuring efficient resource utilization, a suitable preset load balancer can be selected based on the scale of the network range, drill requirements, and expected concurrency. At the same time, the preset load balancer is configured with an average distribution strategy to obtain a load balancer, which means that drill requests are evenly distributed to target nodes, ensuring that under normal load, all nodes can obtain roughly the same workload, thereby achieving initial resource balancing.

[0050] During network drills, a node health check mechanism can be configured on the load balancer to periodically send heartbeat requests to the target nodes to verify their service status. Real-time load data of the nodes can be obtained through load monitoring tools, such as key indicators like CPU utilization, memory utilization, and network traffic.

[0051] When the load data of one or more target nodes exceeds a preset load threshold, a strategy adjustment mechanism is immediately triggered. This involves adjusting the initial distribution strategy to obtain an updated distribution strategy, and then allocating exercise requests based on the updated strategy. For example, when an overloaded node is detected, the initial distribution strategy is adjusted to the minimum connection number algorithm, forwarding new exercise requests to the node with the fewest current connections. Furthermore, the weights of nodes can be dynamically adjusted based on their real-time performance. For instance, nodes with sufficient resources have their weight increased, allowing them to receive more requests; nodes with limited resources or experiencing failures have their weight reduced, alleviating their load. This embodiment, by dynamically adjusting the distribution strategy, avoids node overload, significantly improves the stability of the target service, reduces service interruptions or delays caused by resource bottlenecks, and simultaneously improves the resource utilization efficiency of target nodes.

[0052] Optionally, in the target node processing method provided in this application embodiment, allocating exercise requests to M target nodes based on the update distribution strategy includes: obtaining historical request data for network exercises, determining predicted load data based on the historical request data, wherein the predicted load data is used to indicate the load change trend; obtaining node resource thresholds for M target nodes, adjusting the M node resource thresholds based on the predicted load data to obtain M updated resource thresholds; and, in the case of conducting network exercises on the exercise cluster, preferentially distributing exercise requests to target nodes whose updated resource thresholds are less than or equal to a preset load threshold.

[0053] When distributing exercise requests using an updated distribution strategy, dynamic adjustments can be made based on historical data. Specifically, historical request data from past network exercises is first collected. This historical request data can include key information such as request type, frequency, size, source, and response time. Then, data indicating load change trends is extracted from the preprocessed data to obtain predicted load data. This predicted load data can include time series data (peak and trough times of the exercise) and request data (frequency and size of specific request types).

[0054] Furthermore, a resource threshold reflecting the maximum load that the current target node can withstand is obtained. The predicted load data is compared with the node resource threshold to identify time periods and nodes that may exceed the threshold. Then, based on the comparison results, the resource threshold is dynamically adjusted, that is, the node resource threshold is adjusted according to the predicted load data, for example, by increasing memory quota, expanding disk space, or increasing network bandwidth.

[0055] After adjusting the node resource thresholds, the update resource threshold of each node is reassessed to see if it is lower than the preset load threshold. If the update resource threshold of a node is less than or equal to the preset load threshold, it indicates that the node is currently in a "safe" state and can receive more exercise requests. In this case, requests can be preferentially distributed to target nodes whose update resource thresholds are lower than the preset load threshold. This embodiment ensures that the resources of target nodes are fully utilized during the exercise by dynamically adjusting the resource thresholds, while avoiding service instability caused by overuse. This improves the overall resource utilization and cost-effectiveness, ensuring high availability and stability of the target service, and maintaining good response speed even during high-concurrency access or large-scale exercises.

[0056] Optionally, in the target node processing method provided in this application embodiment, allocating exercise requests to M target nodes based on the update distribution strategy includes: obtaining node allocation data of M target nodes, wherein each node allocation data is used to indicate the resource data available to each target node; determining the weight value of each target node based on the M node allocation data to obtain M weight values; and, in the case of conducting network exercises on the exercise cluster, obtaining request processing data of M target nodes, and allocating exercise requests to the M target nodes in a round-robin manner based on the M weight values ​​and the M request processing data.

[0057] Specifically, when allocating exercise requests to target nodes, in addition to allocation based on resource thresholds, allocation can also be based on the weight value of each target node. First, node allocation data representing the hardware resources of each target node can be obtained to evaluate its performance in handling specific types of network requests, including response time and load capacity. Further, a resource allocation weight is assigned to each node based on its allocation data; for example, nodes with more CPU cores are assigned higher weights, while nodes with greater resource constraints are assigned lower weights. It should be noted that the impact of different software environments and configurations on node performance can also be considered, assigning weights to node environment configuration information. For example, if a node's configuration is more suitable for handling the current exercise's network requests, its weight can be appropriately increased. Finally, considering resource allocation, environment configuration, and performance testing weights comprehensively, an appropriate algorithm (such as weighted average, linear combination, etc.) is used to calculate the comprehensive weight value (i.e., the weight value) of each target node.

[0058] Furthermore, during the exercise, the request processing status of target nodes is monitored in real time, including key indicators such as the number of requests received, response time, and processing failure rate. Then, the processing capacity of each node is determined by its actual load, and performance feedback on the nodes' handling of specific types of requests is collected, including response speed, stability, and resource consumption. Based on the node's weight value and current load, requests are preferentially allocated to nodes with high weight and low load to fully utilize their processing capacity and avoid overload. This is achieved using a weighted round-robin algorithm, where requests are allocated according to the node's current weight value and load. Nodes with higher weights are more likely to be selected in the round-robin. Once a node's load reaches a preset threshold, its weight is adjusted to reduce its selection probability. If a node's performance degrades or processing capacity becomes abnormal, its weight value is reduced or reset to zero to prevent further request allocation and trigger a fault recovery process to ensure service continuity and stability. This embodiment achieves optimized utilization of target node resources through dynamic adjustment of node weight values, avoiding resource waste and node overload, ensuring that requests are processed quickly, and maintaining stable operation of the exercise.

[0059] Optionally, in the target node processing method provided in this application embodiment, adjusting N target nodes includes: obtaining K candidate target nodes from the target library, and obtaining target features of each candidate target node to obtain K sets of target features, wherein each target feature includes at least one of the following: the physical location of the node, the node's computing speed, and the applicable type, where K is greater than or equal to N and K is a positive integer; performing data transformation on each set of target features to obtain K sets of transformed target features, and calculating the score of each candidate target node based on the weight of the target features in each set of target features and the transformed target features in each set to obtain K target scores; selecting N candidate target nodes from the K candidate target nodes based on the K target scores, and replacing N target nodes with the N candidate target nodes.

[0060] Specifically, after identifying multiple target nodes exhibiting anomalies during network range drills, these target nodes can be replaced to maintain the stability and realism of the drill environment. First, multiple candidate target nodes and their corresponding target characteristics can be obtained, such as the node's physical location information (used to assess network latency and access speed), the node's processing speed or processor type, and the node's applicable type (ensuring the node can support the required target services or functions).

[0061] Furthermore, the collected target features are transformed into a unified numerical or vector representation. Then, based on the actual needs and objectives of the network drills, weights are assigned to each target feature. For example, if the drill focuses on evaluating the effectiveness of network attacks in different geographical locations, the weight of physical location is higher; if the drill requires significant computing resources, the weight of computing speed is more critical. A weighted average formula is then used to calculate the score for each candidate target node, resulting in multiple target scores. Finally, based on the calculated target scores, they are sorted from highest to lowest, and the candidate target node with the highest score is selected. This selected candidate target node is then used to replace the original target nodes that exhibited anomalies or were overloaded in the network range's drill cluster.

[0062] It should be noted that, Figure 3 This is a schematic diagram of the target node screening method provided in the embodiments of this application, as shown below. Figure 3 As shown, before determining the weight of each target feature, a feature library can be constructed based on the target features of target nodes within multiple historical time periods. This feature library includes multiple target features and their corresponding weights. After obtaining the target features of each candidate target node, these features are preprocessed and feature matching is performed using the feature library to obtain matching results including target features and their corresponding weights. The results are then processed, i.e., the weights are adjusted through performance optimization and monitoring, to obtain the weight of the target feature for each candidate target node. This embodiment calculates the target score for each candidate target node to ensure that new nodes added to the exercise cluster accurately match current business needs, maximizing the fulfillment of the exercise's target scenario, significantly improving the stability and availability of the entire network range, and reducing the risk of service interruptions and performance fluctuations.

[0063] Optionally, in the target node processing method provided in the embodiments of this application, the adjustment processing of N target nodes includes: backing up the traffic of N target nodes and switching the traffic of N target nodes to MN target nodes.

[0064] Specifically, handling abnormal target nodes can also involve initiating a traffic backup mechanism after detecting an anomaly. This means copying the request data currently flowing through the abnormal node, ensuring that this data is completely preserved. Simultaneously, the backed-up traffic data is stored in a secure and reliable storage system, such as a high-performance disk array or cloud storage service. Properly planning the data lifecycle and regularly archiving old data ensures effective utilization of storage space.

[0065] Furthermore, the load balancer should be used to enable an automatic traffic redirection mechanism to switch requests that were originally destined for these nodes to other healthy target nodes, ensuring that exercise requests can be processed in a timely manner and avoiding exercise interruption.

[0066] It should be noted that after the traffic switch is completed, a secondary verification is required to ensure that healthy target nodes have correctly received and processed the switched-over traffic without any additional anomalies or performance issues. Abnormal nodes should be isolated from the traffic path to prevent subsequent requests from being reassigned to them. This embodiment ensures that the continuity of network range exercises is not affected even if target nodes malfunction by switching traffic to healthy nodes, improving the availability and user satisfaction of the range, guaranteeing the integrity and reliability of exercise data, and enhancing the overall security of the network range.

[0067] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0068] This application also provides a target node processing apparatus. It should be noted that the target node processing apparatus of this application can be used to execute the target node processing method provided in this application. The target node processing apparatus provided in this application will be described below.

[0069] Figure 4 This is a schematic diagram of a target node processing device provided according to an embodiment of this application, as shown below. Figure 4 As shown, the device includes: an acquisition unit 40, an allocation unit 41, and an adjustment unit 42.

[0070] Acquisition unit 40 is used to acquire network exercise data and deploy an exercise cluster based on the network exercise data, wherein the exercise cluster is used to conduct network exercises;

[0071] The allocation unit 41 is used to allocate exercise requests during the network exercise process to M target nodes of the exercise cluster when conducting network exercises on the exercise cluster, and to detect the M target nodes. The detection type includes at least one of the following: target node running status detection and target node resource status detection, where M is a positive integer.

[0072] The adjustment unit 42 is used to adjust N target nodes and generate alarm information if N target nodes are in an abnormal state. The alarm information is used to prompt attention to N target nodes, where N is less than or equal to M and N is a positive integer.

[0073] The target node processing device provided in this application embodiment acquires network exercise data through the acquisition unit 40, and deploys an exercise cluster based on the network exercise data, wherein the exercise cluster is used for network exercises; when performing network exercises on the exercise cluster, the allocation unit 41 allocates exercise requests during the network exercise process to the M target nodes of the exercise cluster, and detects the M target nodes, wherein the detection type includes at least one of the following: target node running status detection and target node resource status detection, where M is a positive integer; if N target nodes have abnormal states, the adjustment unit 42 adjusts the device if... In this scenario, adjustments are made to N target nodes, and alarm information is generated. The alarm information is used to alert attention to N target nodes, where N is less than or equal to M and N is a positive integer. This solves the problem in related technologies where network ranges rely on a single target node and the load is unbalanced among target nodes. By deploying a training cluster based on network training data, the target nodes of the training cluster are detected during the training process, and target nodes with abnormal states are adjusted. This achieves the effects of avoiding single points of failure, preventing local overload of target nodes, and improving the processing efficiency of target nodes.

[0074] Optionally, in the target node processing apparatus provided in this application embodiment, the acquisition unit 40 includes: an extraction module, used to extract the service requirements of the network exercise from the network exercise data, wherein the service requirements are used to indicate the target type of each target node; a first determination module, used to determine M target nodes using the service requirements, and determine Y target instances based on the M target nodes, wherein Y is greater than or equal to M, and Y is a positive integer; a processing module, used to encapsulate the Y target instances to obtain Y processed target instances; and a deployment module, used to deploy the Y processed target instances in different locations of multiple networks to obtain an exercise cluster, wherein the multiple networks include at least: physical servers and virtual machines.

[0075] Optionally, in the target node processing device provided in this application embodiment, the allocation unit 41 includes: a first acquisition module, used to acquire a preset load balancer, configure the preset load balancer according to network exercise data, and obtain a load balancer, wherein the load balancer is associated with an initial distribution strategy, the initial distribution strategy being to distribute exercise requests evenly; a monitoring module, used to monitor the node load data of M target nodes using the load balancer, and adjust the initial distribution strategy to obtain an updated distribution strategy if there is a target node among the M target nodes whose node load data is greater than a preset load threshold; and an allocation module, used to allocate exercise requests to the M target nodes based on the updated distribution strategy.

[0076] Optionally, in the target node processing device provided in this application embodiment, the allocation unit 41 includes: a second acquisition module, used to acquire historical request data of network drills and determine predicted load data based on the historical request data, wherein the predicted load data is used to indicate the load change trend; a third acquisition module, used to acquire node resource thresholds of M target nodes and adjust the M node resource thresholds based on the predicted load data to obtain M updated resource thresholds; and a distribution module, used to preferentially distribute drill requests to target nodes whose updated resource thresholds are less than or equal to preset load thresholds when conducting network drills on the drill cluster.

[0077] Optionally, in the target node processing device provided in this application embodiment, the allocation unit 41 includes: a fourth acquisition module, used to acquire node allocation data of M target nodes, wherein each node allocation data is used to indicate the resource data available to each target node; a second determination module, used to determine the weight value of each target node based on the M node allocation data, to obtain M weight values; and a fifth acquisition module, used to acquire request processing data of M target nodes in the case of network drills on the drill cluster, and to allocate drill requests to the M target nodes in a round-robin manner based on the M weight values ​​and the M request processing data.

[0078] Optionally, in the target node processing device provided in this application embodiment, the adjustment unit 42 includes: a sixth acquisition module, used to acquire K candidate target nodes from the target library, and acquire the target features of each candidate target node to obtain K sets of target features, wherein each target feature includes at least one of the following: the physical location of the node, the node's computing speed, and the applicable type, K is greater than or equal to N, and K is a positive integer; a conversion module, used to perform data conversion on each set of target features to obtain K sets of converted target features, and calculate the score of each candidate target node according to the weight of the target features in each set of target features and the converted target features in each set of target features to obtain K target scores; and a screening module, used to screen out N candidate target nodes from the K candidate target nodes according to the K target scores, and replace N target nodes with N candidate target nodes.

[0079] Optionally, in the target node processing device provided in the embodiments of this application, the adjustment unit 42 includes: a backup module, used to back up the traffic of N target nodes and switch the traffic of N target nodes to MN target nodes.

[0080] The target node processing device includes a processor and a memory. The acquisition unit 40, allocation unit 41, adjustment unit 42, etc. are all stored in the memory as program units. The processor executes the program units stored in the memory to realize the corresponding functions.

[0081] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and adjusting kernel parameters can address the issues in related technologies, such as reliance on a single target node and uneven load distribution among target nodes in network test ranges.

[0082] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0083] This invention provides a computer storage medium for storing a program, wherein the program, when running, controls the device where the computer storage medium is located to execute a target node processing method.

[0084] Figure 5 This is a schematic diagram of an electronic device provided according to an embodiment of this application, such as... Figure 5 As shown, this embodiment of the invention provides an electronic device 50, which includes a processor, a memory, and a program stored in the memory and executable on the processor. The processor is used to execute computer-readable instructions, wherein the computer-readable instructions execute a target node processing method. The device described herein may be a server, PC, PAD, mobile phone, etc.

[0085] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of a target node processing method in various embodiments of this application.

[0086] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0087] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0088] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0089] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0090] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0091] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0092] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0093] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0094] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for processing target nodes, characterized in that, include: Acquire network exercise data, and deploy an exercise cluster based on the network exercise data, wherein the exercise cluster is used to conduct network exercises; In the case of conducting network drills on the drill cluster, drill requests during the network drill process are allocated to M target nodes of the drill cluster, and the M target nodes are detected, wherein the detection type includes at least one of the following: target node running status detection and target node resource status detection, where M is a positive integer; If N target nodes are in an abnormal state, the N target nodes are adjusted and an alarm message is generated. The alarm message is used to prompt attention to the N target nodes, where N is less than or equal to M and N is a positive integer. Assigning exercise requests during the network exercise process to the M target nodes of the exercise cluster includes: obtaining a preset load balancer; configuring the preset load balancer according to the network exercise data to obtain a load balancer, wherein the load balancer is associated with an initial distribution strategy, the initial distribution strategy being to distribute the exercise requests evenly; using the load balancer to monitor the node load data of the M target nodes; if there are target nodes among the M target nodes whose node load data is greater than a preset load threshold, adjusting the initial distribution strategy to obtain an updated distribution strategy; and assigning the exercise requests to the M target nodes based on the updated distribution strategy. The adjustment process for the N target nodes includes: obtaining K candidate target nodes from the target library and acquiring target features for each candidate target node to obtain K sets of target features, wherein each target feature includes at least one of the following: the physical location of the node, the node's computing speed, and the applicable type, where K is greater than or equal to N and K is a positive integer; performing data transformation on each set of target features to obtain K sets of transformed target features, and calculating the score of each candidate target node based on the weight of the target features in each set of target features and the transformed target features in each set to obtain K target scores; and selecting N candidate target nodes from the K candidate target nodes based on the K target scores, and replacing the N target nodes with the N candidate target nodes.

2. The method according to claim 1, characterized in that, Deploying the exercise cluster based on the network exercise data includes: The service requirements of the network exercise are extracted from the network exercise data, wherein the service requirements are used to indicate the target type of each target node; The business requirements are used to determine the M target nodes, and Y target instances are determined based on the M target nodes, where Y is greater than or equal to M and Y is a positive integer; The Y target instances are encapsulated to obtain Y processed target instances; The Y processed target instances are deployed in different locations across multiple networks to form the training cluster, wherein the multiple networks include at least physical servers and virtual machines.

3. The method according to claim 1, characterized in that, Assigning the exercise request to the M target nodes based on the update distribution strategy includes: Obtain historical request data from the network exercise, and determine predicted load data based on the historical request data, wherein the predicted load data is used to indicate the load change trend; Obtain the node resource thresholds of the M target nodes, and adjust the M node resource thresholds according to the predicted load data to obtain M updated resource thresholds; When conducting network drills on the drill cluster, the drill requests are preferentially distributed to target nodes whose update resource threshold is less than or equal to the preset load threshold.

4. The method according to claim 1, characterized in that, Assigning the exercise request to the M target nodes based on the update distribution strategy includes: Obtain the node allocation data of the M target nodes, wherein each node allocation data is used to indicate the resource data available to each target node; The weight value of each target node is determined based on the allocation data of M nodes, resulting in M ​​weight values; In the case of network drills on the drill cluster, request processing data of the M target nodes is obtained, and the drill requests are allocated to the M target nodes in a round-robin manner according to the M weight values ​​and the M request processing data.

5. The method according to claim 1, characterized in that, The adjustment process for the N target nodes includes: The traffic of the N target nodes is backed up, and the traffic of the N target nodes is switched to the MN target nodes.

6. A target node processing device, characterized in that, include: An acquisition unit is used to acquire network exercise data and deploy an exercise cluster based on the network exercise data, wherein the exercise cluster is used to conduct network exercises. The allocation unit is used to allocate the exercise request during the network exercise process to M target nodes of the exercise cluster when the exercise cluster is being exercised, and to detect the M target nodes, wherein the detection type includes at least one of the following: target node running status detection and target node resource status detection, where M is a positive integer; An adjustment unit is used to adjust the N target nodes and generate alarm information if N target nodes are in an abnormal state. The alarm information is used to prompt attention to the N target nodes, where N is less than or equal to M and N is a positive integer. The allocation unit includes: a first acquisition module, configured to acquire a preset load balancer, configure the preset load balancer according to the network exercise data, and obtain a load balancer, wherein the load balancer is associated with an initial distribution strategy, the initial distribution strategy being to distribute the exercise requests evenly; a monitoring module, configured to use the load balancer to monitor the node load data of the M target nodes, and adjust the initial distribution strategy to obtain an updated distribution strategy if there is a target node among the M target nodes whose node load data is greater than a preset load threshold; and an allocation module, configured to allocate the exercise requests to the M target nodes based on the updated distribution strategy. The adjustment unit includes: a sixth acquisition module, used to acquire K candidate target nodes from the target library and acquire the target features of each candidate target node to obtain K sets of target features, wherein each target feature includes at least one of the following: the physical location of the node, the node's computing speed, and the applicable type, where K is greater than or equal to N and K is a positive integer; a conversion module, used to perform data conversion on each set of target features to obtain K sets of converted target features, and calculate the score of each candidate target node according to the weight of the target features in each set of target features and the converted target features in each set of target features to obtain K target scores; and a filtering module, used to filter N candidate target nodes from the K candidate target nodes according to the K target scores, and replace the N target nodes with the N candidate target nodes.

7. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the target node processing method according to any one of claims 1 to 5.

8. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the target node processing method according to any one of claims 1 to 5.

Images