Computer cluster security protection method and system

Abstract

The invention discloses a computer cluster security protection method and system. The method comprises the following steps: collecting multi-dimensional operation data in real time through an agent program deployed at each node; feature parameters are extracted from the data, and a safety evaluation model is adopted to calculate a safety score and map the safety score into a discrete safety level; gradient protection strategies including basic monitoring, enhanced protection and strict isolation strategies are automatically matched and loaded according to the security level; and monitoring a strategy execution effect, and performing closed-loop optimization on the model parameters based on feedback data. The system correspondingly comprises a data acquisition module, a safety evaluation module, a strategy management module, a strategy execution module and a feedback optimization module. According to the method, the problems of static strategy stiffness, inaccurate risk quantification, single response means and lack of self-learning are solved, dynamic self-adaptive protection is realized, the evaluation accuracy is improved, false alarms and missing alarms are reduced, and the cluster environment is ensured to be safe and reliable.

Description

Technical Field

[0001] This invention relates to the field of computer network security technology, specifically to a computer cluster security protection method and system. Background Technology

[0002] Computer clusters, with their powerful parallel computing capabilities and high availability, have become a critical infrastructure supporting cloud computing, big data analytics, and artificial intelligence computing. However, as cluster sizes continue to expand, node heterogeneity increases, and business dynamics become more frequent, traditional security solutions face severe challenges.

[0003] Currently, typical computer cluster security protection solutions mainly adopt the following technical approaches: 1. Static policy configuration: Deploy firewalls with fixed rules at the network boundary, and install and configure uniform antivirus software and intrusion detection systems on all nodes. Once these policies are set, they typically do not change with the cluster's operational status.

[0004] 2. Monitoring and alarms based on fixed thresholds: Set fixed thresholds for resources such as CPU utilization and memory usage. When a node's metrics exceed the threshold, an alarm is triggered, requiring manual intervention from the administrator.

[0005] 3. Unified isolation strategy: After discovering an abnormal node, a one-size-fits-all isolation method is usually adopted, such as directly disconnecting the node's network connection or shutting it down, lacking a tiered processing approach.

[0006] Through in-depth analysis and practical verification, the existing technology has the following inherent defects, which are precisely the technical problems that this invention aims to solve: First, existing technologies lack the ability to accurately quantify risks. This invention achieves risk quantification through multi-dimensional data collection and security assessment models. Existing technologies, however, rely on single indicator thresholds or simple rules, failing to comprehensively assess the true security status of nodes. For example, a node may have normal CPU usage but exhibit abnormal network connections; existing technologies struggle to accurately identify such complex threats.

[0007] Secondly, existing protection strategies are rigid and lack adaptive adjustment mechanisms. This invention adaptively matches protection strategies of different strengths based on dynamically assessed security levels. In contrast, existing protection strategies are typically statically preset and cannot dynamically adjust their strength according to risk levels. This leads to wasted resources during low-risk periods and potentially insufficient protection during high-risk periods.

[0008] Furthermore, existing technologies offer limited response methods and lack sophisticated management. This invention utilizes SDN technology to achieve dynamic micro-segmentation. Traditional solutions, upon detecting anomalies, typically employ simple network disconnection or node shutdown operations, lacking a tiered approach from monitoring and rate limiting to isolation, which can easily lead to service interruptions.

[0009] Finally, existing technologies lack closed-loop optimization capabilities. This invention continuously optimizes the security assessment model through feedback data. Traditional solutions often remain in a single process of detection-alarm-processing, unable to learn and evolve from historical events, leading to the possibility of the same type of attack succeeding multiple times.

[0010] In particular, when the number of cluster nodes reaches hundreds or even thousands, the management complexity and false alarm rate of existing static protection solutions increase dramatically, while the protection effectiveness decreases significantly. The dynamic and complex nature of the cluster environment makes static rules based on manual predictions ineffective in dealing with rapidly changing security threats.

[0011] Therefore, there is an urgent need in this field for a new computer cluster security protection solution that can accurately assess risks in real time, adaptively adjust protection strength, and has self-learning and evolution capabilities to solve the above-mentioned technical problems. Summary of the Invention

[0012] In view of the shortcomings of the prior art, the purpose of this invention is to provide a computer cluster security protection method and system to solve the problems mentioned in the background art.

[0013] To achieve the above objectives, a specific embodiment of the present invention provides a computer cluster security protection method, comprising the following steps: S1. Data collection steps: Through the agent program deployed on each node in the computer cluster, multi-dimensional operation data of the node is collected in real time. The multi-dimensional operation data includes resource consumption indicators, process behavior logs and network connection information. S2. Risk assessment steps: Extract multiple preset feature parameters from the multi-dimensional operational data, and use a security assessment model to calculate the feature parameters to generate a quantitative security score; map the security score to the corresponding discrete security level according to the preset score range, the discrete security level including low risk level, medium risk level and high risk level; S3. Policy execution steps: Based on the discrete security level, automatically match and load the corresponding protection policy from the preset protection policy library to the target node; wherein, for low-risk level, configure a basic monitoring policy with log recording as the main function; for medium-risk level, configure an enhanced protection policy that adds network traffic restriction and non-core port access control on top of the basic monitoring policy; and for high-risk level, configure a strict isolation policy that adds logical network isolation and non-critical process suspension on top of the enhanced protection policy. S4. Closed-loop optimization steps: Monitor the changes in the security status of nodes after the protection strategy is executed. When the monitoring data indicates that the strategy loading is judged to be overprotected, adjust the internal parameters of the security assessment model based on the feedback data.

[0014] According to an embodiment of this application, a computer cluster security protection method and system effectively solves the problem of static policy rigidity by adaptively matching real-time risk assessment and protection strategies, achieving a precise correspondence between protection strength and security risk, thus ensuring security while saving resources. It integrates multi-dimensional data and security assessment models to significantly improve the accuracy of node security status assessment and reduce false positives and false negatives. It provides a tiered protection strategy from basic monitoring to strict isolation, enabling precise handling of abnormal nodes and minimizing the impact on business operations. Through a closed-loop optimization mechanism, the system possesses continuous evolution capabilities, effectively responding to new and unknown threats. Combined with reliable node authentication and dynamic micro-segmentation technology, it ensures the security and trustworthiness of the cluster's basic environment and prevents the spread of threats.

[0015] In addition, the computer cluster security protection method and system proposed in this application may also have the following additional technical features: In one embodiment of this application, before the data acquisition step S1, a node authentication step S0 is also included: the node to be connected to the cluster and the cluster control node perform two-way identity authentication based on the credentials provided by the hardware trusted module; after successful authentication, the two parties negotiate to generate a session key and establish an encrypted communication channel.

[0016] In one embodiment of this application, the specific process of the two-way identity authentication in the node authentication step S0 includes: the node to be accessed requests an authentication request message containing hardware fingerprint information from its local trusted hardware module; the cluster control node receives and verifies the legality of the authentication request message; after successful verification, the cluster control node generates key negotiation parameters using an elliptic curve cryptography algorithm, encrypts them using the public key of the node to be accessed, and returns them; the node to be accessed uses its private key to decrypt the parameters, generates the same session key, and sends confirmation information to the cluster control node to complete the authentication.

[0017] In one embodiment of this application, the security assessment model is a weighted scoring model; the generation of a quantified security score is achieved by assigning specific weights to each feature parameter and calculating a weighted sum.

[0018] In one embodiment of this application, the security assessment model is a machine learning classification model trained on historical data; the generation of a quantified security score is achieved by inputting the feature parameters into the machine learning classification model and obtaining its output.

[0019] In one embodiment of this application, in the policy execution step S3, the loading of the protection policy is achieved by calling the application programming interface of the software-defined network controller to dynamically distribute access control rules to the underlying network switching device.

[0020] In one embodiment of this application, in the closed-loop optimization step S4, the internal parameters of the security assessment model are adjusted, specifically by dynamically reducing the weight value of the corresponding feature in the weighted scoring model based on the feature parameters involved in the false alarm event.

[0021] In one embodiment of this application, in the closed-loop optimization step S4, the internal parameters of the security assessment model are adjusted by: using data related to false alarm events as new negative samples to incrementally train the machine learning classification model in order to adjust its model parameters.

[0022] A computer cluster security protection system includes: The data acquisition module is configured to collect multi-dimensional operational data through agent programs deployed on each node; The security assessment module is configured to receive the operational data, extract feature parameters, and use a security assessment model to calculate a security score and determine a security level. The policy management module has an embedded protection policy library, which is configured to match and issue corresponding protection policies based on the determined security level. The policy execution module configures the protection policies that are loaded and run on the nodes. The feedback optimization module is configured to monitor the node security status after policy execution and adjust the internal parameters of the security assessment model based on the feedback data.

[0023] In one embodiment of this application, the system further includes a dynamic micro-segmentation control module, which is communicatively connected to a software-defined network controller and configured to convert protection policies into specific network flow table rules and distribute them to the data plane.

[0024] The advantages of this invention compared to existing technologies are: (1) By real-time risk assessment and adaptive matching of strategies, the rigidity of static strategies is solved, and the protection strength is accurately matched with the security risk, which not only ensures safety but also saves resources.

[0025] (2) By integrating multi-dimensional data and security assessment models, a comprehensive and accurate assessment of the security status of nodes is achieved, which significantly reduces the false alarm and false alarm rates.

[0026] (3) It provides a tiered protection strategy from basic monitoring to strict isolation, which enables precise handling of abnormal nodes and minimizes the impact on normal business.

[0027] (4) Through a closed-loop optimization mechanism, the security system can learn from historical events, continuously optimize the accuracy of assessments, and effectively respond to new and unknown threats.

[0028] (5) Through a reliable node authentication mechanism and dynamic micro-segmentation technology, the security and trustworthiness of the cluster's basic environment are ensured, and threats are prevented from spreading within the cluster.

[0029] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 This is a flowchart illustrating a computer cluster security protection method and system according to an embodiment of the present invention. Figure 2 This is a detailed flowchart of step 3 of a computer cluster security protection method and system according to an embodiment of the present invention, in which different strategies are executed according to different security levels; Figure 3 This is a flowchart of the main method of a computer cluster security protection method and system according to an embodiment of the present invention; Figure 4 This is a detailed flowchart of node authentication for a computer cluster security protection method and system according to an embodiment of the present invention; Figure 5 This is a flowchart of a security assessment model for a computer cluster security protection method and system according to an embodiment of the present invention; Figure 6 This is a flowchart illustrating the policy execution and closed-loop optimization of a computer cluster security protection method and system according to an embodiment of the present invention. Figure 7 This is a system architecture diagram of a computer cluster security protection method and system according to an embodiment of the present invention. Detailed Implementation

[0032] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0033] like Figures 1 to 7As shown, the computer cluster security protection system of the present invention is used to implement the above-mentioned security protection method. Its core architecture includes a data acquisition module, a security assessment module, a policy management module, a policy execution module, a feedback optimization module, and a dynamic micro-isolation control module. The modules work together to form a complete security protection closed loop.

[0034] The hardware deployment and software configuration of each module must meet the following requirements: Data acquisition module: This module achieves its function by deploying a lightweight agent program on each node of the computer cluster (including control nodes and compute nodes). The agent program can be pre-installed in the node's operating system or deployed remotely in batches through the cluster management platform. It supports mainstream operating systems (such as Linux, Windows Server, etc.).

[0035] Security assessment module: Deployed on the cluster control node or a standalone security server, it needs to have certain computing resources to support the real-time operation of the security assessment model. At the software level, it integrates a feature parameter extraction engine and two security assessment models (weighted scoring model and machine learning classification model).

[0036] Policy Management Module: Deployed on the same server as the security assessment module or independently, it has an embedded protection policy library. The policy library uses an extensible data structure for storage and supports adding, deleting, modifying, querying and maintaining protection policies of different security levels.

[0037] Policy execution module: It is integrated into the operating system of each node as a software plug-in, or the policy is loaded through the cluster management agent. It has the function of receiving and parsing policy instructions and executing protection operations.

[0038] Feedback optimization module: It communicates with the data acquisition module and the security assessment module, is deployed in the security server, and has the core functions of data monitoring, over-protection judgment and model parameter adjustment.

[0039] Dynamic micro-segmentation control module: Deployed on the server where the SDN (Software-Defined Networking) controller is located or on a standalone network control node, it establishes communication with the SDN controller through a standard network interface and supports the conversion of protection policies into network flow table rules that can be recognized by SDN.

[0040] The modules interact with each other through the internal communication network of the cluster. All data transmission is based on the encrypted communication channel established in step S0 to ensure the security and integrity of data transmission.

[0041] I. Detailed Implementation Process of Node Authentication Step S0 Before a node connects to the computer cluster and executes data collection step S1, node authentication step S0 must be completed first. Two-way authentication ensures the legitimacy of the accessing node and establishes a secure communication foundation. The specific implementation process is as follows: 1. Authentication Initialization: After the access node starts up, it automatically checks whether it has connected to the target computer cluster. If not, it triggers the node authentication process and sends an authentication request generation command to the locally deployed Trusted Hardware Module (TPM).

[0042] 2. Authentication Request Message Generation: After receiving the instruction, the hardware trusted module extracts the hardware fingerprint information of the node to be connected (including motherboard serial number, CPU unique identifier, hard disk physical address, and other inherent hardware information), integrates the hardware fingerprint information with the node's basic information (such as node name and preset node identifier), and generates an authentication request message. The hardware trusted module signs the message to ensure that the message cannot be tampered with.

[0043] 3. Authentication request sending: The node to be accessed sends the signed authentication request message to the cluster control node through the cluster's access network.

[0044] 4. Authentication Request Verification: After receiving the authentication request message, the cluster control node first verifies the signature validity of the hardware trusted module to confirm that the message has not been tampered with. Subsequently, the cluster control node queries the locally stored database of legitimate node hardware fingerprint information to compare whether the hardware fingerprint information in the message exists in the database, thereby verifying the identity and legitimacy of the node to be connected.

[0045] 5. Key Negotiation Parameter Generation and Transmission: If verification passes, the cluster control node uses Elliptic Curve Cryptography (ECC) to generate key negotiation parameters (core parameters based on the ECDH key exchange protocol). The cluster control node retrieves the public key of the node to be connected from its local storage, uses this public key to encrypt the key negotiation parameters, generates an encrypted parameter message, and returns it to the node to be connected. If verification fails, the node directly returns an authentication failure response to the node to be connected, terminating the authentication process.

[0046] In the key negotiation process of Elliptic Curve Cryptography (ECC), based on the ECDH protocol, supplementary mathematical foundations are added to ensure clarity: Elliptic curve dot product formula: Let the equation of the elliptic curve be... The cluster control node and the node to be connected each generate a private key. and (Random integer), and calculate the public key. ,in It is the base point of the curve.

[0047] Session key generation: After both parties exchange public keys, the session key is generated. Calculated by dot product: In actual use, The x-coordinate is hashed (e.g., SHA-256) and used as a symmetric key. This ensures forward security; even if the long-term key is compromised, the session key remains secure.

[0048] 6. Session Key Generation: After receiving the encrypted parameter message, the node to be accessed decrypts the message using its own private key to obtain the key negotiation parameters. Based on these parameters, the node to be accessed generates a session key via the ECDH protocol. This key is completely identical to the session key generated by the cluster control node.

[0049] 7. Authentication Confirmation: After generating a session key, the access node sends an confirmation message containing session key verification information to the cluster control node. Upon receiving the confirmation message, the cluster control node verifies whether the session key verification information matches its own generated session key.

[0050] 8. Encrypted Channel Establishment: If the information verification is successful, the cluster control node returns an authentication success response to the node to be connected. Both parties establish an encrypted communication channel based on the generated session key, and all subsequent data transmissions are conducted through this encrypted channel. If the information verification fails, an authentication failure response is returned, and the authentication process terminates.

[0051] II. Detailed Implementation Process of Data Acquisition Step S1 After node authentication is successful and an encrypted communication channel is established, data collection step S1 is initiated. The agent program collects multi-dimensional operational data from each node in real time to provide data support for subsequent risk assessment. 1. Agent program activation: The cluster control node sends an agent program activation command to the node to be connected through an encrypted communication channel. The agent program of the node to be connected starts and enters the data acquisition state. For nodes that have already been connected to the cluster, the agent program remains active and executes data acquisition tasks in real time.

[0052] 2. Multi-dimensional operational data collection: The agent program collects three types of core operational data from the nodes according to preset collection rules: Resource usage metrics: These include metrics that reflect the usage status of node hardware resources, such as CPU utilization, memory utilization, disk I / O read / write speed, and network bandwidth utilization. Process behavior logs include process running information such as start time, termination time, process ID (PID), parent process ID, file paths accessed by the process, and user permissions corresponding to the process for all processes on the node. Network connection information includes network interaction data such as the node's network connection status (established, disconnected, listening, etc.), source IP address, destination IP address, communication port number, data transmission volume, and connection duration.

[0053] 3. Real-time Data Acquisition Guarantee: The agent program employs a combination of event-driven and timed acquisition to ensure real-time data acquisition. For critical events such as process startup / termination and network connection establishment / disconnection, event-driven acquisition is used for immediate data collection; for periodic data such as resource usage indicators, timed acquisition is performed according to a preset acquisition cycle (which can be flexibly configured according to cluster business needs) to ensure that the data can reflect the node's operating status in a timely manner.

[0054] 4. Data Preprocessing and Transmission: The agent program performs simple preprocessing on the collected raw data, including data format standardization (converting different types of data into a unified structured format) and invalid data filtering (removing missing or outlier values ​​caused by acquisition anomalies). The preprocessed data is transmitted to the data acquisition module through an encrypted communication channel, where the data acquisition module temporarily stores and summarizes the received data.

[0055] III. Detailed Implementation Process of Risk Assessment Step S2 The data acquisition module transmits the aggregated multi-dimensional operational data to the security assessment module. The security assessment module completes the risk assessment through three core steps: extracting feature parameters, calculating security scores, and mapping security levels. 1. Feature Parameter Extraction: The security assessment module has a built-in feature extraction engine that extracts preset feature parameters from the received multi-dimensional runtime data. The feature parameters must cover the key dimensions of node security risks, for example: Extract the following from resource usage metrics: the sustained fluctuation range of CPU utilization, the abnormal growth rate of memory utilization, and sudden peaks in disk I / O read / write operations; Extract the following from the process behavior log: the startup frequency of unknown processes, abnormal access behavior of high-privilege processes, the number of times a process accesses sensitive files, and the number of processes that exit abnormally. Extract the following from network connection information: number of connections to suspicious IP addresses, communication frequency of non-standard ports, number of network connections that are in a half-connection state for a long time, and abnormal data transmission volume.

[0056] 2. Security Score Calculation: The security assessment module supports two security assessment models. Users can choose one or a combination of them according to the actual needs of the cluster. A quantitative security score is calculated based on the extracted feature parameters. If a weighted scoring model is used: First, a preset weight value is assigned to each feature parameter (the weight value is determined according to the degree of influence of the feature parameter on the safety risk; the greater the influence, the higher the weight, and the sum of the weights of all feature parameters is 1); then, the normalized value of each feature parameter is calculated (converting the actual value of the feature parameter into a value between 0 and 100); finally, the safety score is calculated using the weighted summation formula (safety score = Σ (normalized value of feature parameter × corresponding weight)), with a score range of 0-100.

[0057] If a machine learning classification model is used: This model is trained based on historical security event data. The training data includes the operational data characteristics of normal nodes and the operational data characteristics of abnormal nodes (those attacked, containing malicious programs, etc.). The extracted feature parameters are used as input to the model. The model uses a built-in classification algorithm (such as random forest, support vector machine, etc.) to process the input features and outputs a security score of 0-100. The higher the score, the lower the node's security risk; the lower the score, the higher the node's security risk.

[0058] In the calculation process of the security assessment model, to further clarify the scoring mechanism, the following mathematical formulas and algorithm details are added: For the weighted scoring model: the safety score is calculated using a weighted summation formula, specifically: Safety rating in, It is the first The weights of each feature parameter (satisfying) ), These are the normalized values ​​of the feature parameters, and the normalization formula is: here, These are the original eigenvalues. and These are the historical minimum and maximum values ​​of this feature parameter, which, after normalization, range from 0 to 100. Weights Based on the predefined degree of influence of features on security risks, for example, the weight of abnormal network connection features may be higher than that of CPU utilization.

[0059] For machine learning classification models: The model uses the random forest algorithm, and the training process includes the following steps: Feature input: Use the feature parameters (such as CPU usage fluctuations and process abnormal frequency) in the historical node running data as the input feature vector.

[0060] Model training: Multiple decision trees are constructed using Gini impurity as the splitting criterion; each tree randomly selects samples from the training set through a bootstrap sampling method, and finally outputs a safety score through a voting mechanism.

[0061] Score output: The model outputs a continuous value from 0 to 100, with a lower score indicating a higher risk; the cross-entropy loss function is minimized during training to optimize the parameters.

[0062] 3. Security Level Mapping: The security assessment module presets three discrete security levels (low-risk, medium-risk, and high-risk) and configures a corresponding scoring range for each level (the scoring range can be adjusted according to cluster security requirements). The calculated security score is compared with the preset scoring range to determine the security level corresponding to the node. When the safety score falls into the high score range, it is mapped to a low risk level; When the safety score falls into the medium score range, it is mapped to a medium risk level; When the safety score falls into the low score range, it is mapped to a high risk level.

[0063] The security assessment module transmits the determined security level and corresponding security score to the policy management module as the basis for policy matching.

[0064] IV. Detailed Implementation Process of Strategy Execution Step S3 After receiving the security level information, the policy management module matches the corresponding protection policy from the protection policy library, and completes the loading and execution of the policy through the policy execution module and the dynamic micro-segmentation control module. 1. Protection Policy Matching: The policy management module's protection policy library pre-stores three types of protection policies, each corresponding to one of the three security levels. The policy management module automatically matches the corresponding protection policy based on the received security level. Low-risk level matching basic monitoring strategy: mainly log recording. The strategy includes comprehensive recording of node resource usage indicators, process behavior logs, and network connection information. The logs must include key information such as timestamps, event types, and detailed descriptions to facilitate subsequent auditing and traceability. Enhanced protection strategy for medium-risk levels: In addition to basic monitoring strategies, network traffic limiting and non-core port access control are added. Network traffic limiting is achieved by setting a maximum network bandwidth usage threshold for nodes (configured according to node service priority) to prevent abnormal traffic from consuming excessive resources; non-core port access control is achieved by establishing a port whitelist, allowing only core service ports within the whitelist to receive external access, and prohibiting external connection requests from non-core ports; High-risk levels are matched with strict isolation strategies: In addition to enhanced protection strategies, logical network isolation and non-critical process suspension functions are added. Logical network isolation is achieved by dividing the network into independent logical network areas, isolating high-risk nodes from other normal nodes in the cluster and retaining only necessary management communication links; non-critical process suspension is performed by identifying non-core business processes on the nodes (based on preset identification rules according to process priority and business importance) and suspending them to prevent the risk of malicious process spread.

[0065] 2. Protection Policy Distribution: The policy management module converts the matched protection policy into standardized policy execution instructions and distributes them to the policy execution module of the target node through an encrypted communication channel. For policies involving network control (such as traffic restriction, port control, and logical isolation), the policy management module also sends the policy instructions to the dynamic micro-segmentation control module.

[0066] 3. Strategy Execution: Basic monitoring policy execution: After receiving the instruction, the policy execution module activates the node's logging function, configures the scope and format of logging according to the policy requirements, records the node's running data in real time and stores it in the local log file or the cluster log server; Enhanced protection policy execution: The policy execution module first executes the basic monitoring policy, then configures network traffic restriction rules (achieved by calling the network management interface of the node operating system), and updates the port access control list to block external access to non-core ports; After receiving the policy instructions, the dynamic micro-segmentation control module establishes communication with the SDN controller, converts the network traffic restriction and port control rules into specific network flow table rules, and distributes them to the underlying network switching devices (such as switches and routers) through the SDN controller's application programming interface (API) to achieve network-level policy enforcement. In the dynamic micro-segmentation control module, the logic for converting protection policies into SDN flow table rules is as follows: Rule generation algorithm: Based on security level, the dynamic micro-segmentation control module generates access control rules. Pseudocode example: Input: Security level, target node IP, policy type Output: SDN flow table rules step: 1. IF Security Level == "Medium Risk" THEN Generate rules: Deny access to ports not on the whitelist (e.g., the DROP action targets traffic on ports not in [80, 443]). 2. ELSE IF Security Level == "High Risk" THEN Generate rules: Add logical isolation rules (e.g., only allow the target node to communicate with the management IP, and redirect other traffic to the isolated network). 3. Flow table rules are issued through the SDN controller API (such as a RESTful interface), and the rule priority is dynamically set based on the risk level.

[0067] Strict isolation strategy execution: Based on the enhanced protection strategy, the strategy execution module identifies non-critical processes on the nodes and suspends them through the operating system's process management interface; the dynamic micro-segmentation control module converts logical network isolation rules into network flow table rules and distributes them to the underlying network switching devices to cut off unnecessary network connections between high-risk nodes and other nodes in the cluster, thereby achieving logical isolation.

[0068] V. Detailed Implementation Process of Closed-Loop Optimization Step S4 After the strategy is executed, the feedback optimization module continuously monitors the security status of the nodes and adjusts the parameters of the security assessment model based on the feedback data, thereby enabling the system to self-learn and evolve. 1. Node Security Status Monitoring: The feedback optimization module acquires multi-dimensional operational data of nodes after policy execution through the data acquisition module, while simultaneously monitoring the node's business operation status (such as business response time, service availability, etc.), and comprehensively evaluates the policy execution effect and changes in node security status. If the node's security score improves to a reasonable range corresponding to the security level, and the business is operating normally, it indicates that the policy is being implemented effectively. If the node security score does not improve significantly or continues to decline, it indicates that the strategy protection is insufficient. If a node's security score increases rapidly, but business operations are severely affected (e.g., response timeouts, service interruptions), and further verification confirms that the node poses no actual security threat, it is considered overprotection.

[0069] 2. Overprotection Detection: The feedback optimization module pre-sets overprotection detection rules. By comparing the node security status and business operation status before and after policy execution, combined with the manual verification interface (supporting administrator intervention confirmation), it determines whether overprotection exists. If it is determined to be overprotection, the model parameter adjustment process is initiated; if it is not determined to be overprotection, the current protection policy remains unchanged.

[0070] 3. Adjustment of safety assessment model parameters: The appropriate adjustment method will be adopted based on the type of safety assessment model. If a weighted scoring model is adopted: the feedback optimization module analyzes the characteristic parameters involved in overprotection events (i.e., the key characteristic parameters that lead to low security scores), dynamically reduces the weight values ​​of these characteristic parameters in the model, reduces their impact on security scores, and avoids the recurrence of similar overprotection situations in the future. If a machine learning classification model is used: the feedback optimization module marks the node operation data, feature parameters, security scores and other information related to overprotection events as new negative samples (i.e. normal samples that are misjudged as high risk), adds the negative samples to the model's training dataset, performs incremental training on the machine learning classification model, adjusts the model's internal parameters, and improves the model's judgment accuracy.

[0071] 4. Model parameter update: The adjusted model parameters are written into the model through the parameter update interface of the safety assessment module. The new parameters take effect immediately and are used in the subsequent risk assessment process, forming a closed-loop mechanism of "assessment-execution-feedback-optimization".

[0072] VI. Summary of System Module Interaction Process The computer cluster security protection system of the present invention has modules that work collaboratively, and the overall interaction process is as follows: 1. The node to be connected completes identity authentication through node authentication step S0 and establishes an encrypted communication channel; 2. The data acquisition module collects multi-dimensional operational data from nodes through an agent program and transmits it to the security assessment module; 3. The security assessment module extracts feature parameters, calculates security scores using the security assessment model, maps them to security levels, and transmits them to the policy management module; 4. The policy management module matches the corresponding protection policy and distributes it to the policy execution module and the dynamic micro-segmentation control module respectively; 5. The policy execution module loads the protection policy on the node, and the dynamic micro-segmentation control module issues network flow table rules through the SDN controller to jointly execute the protection policy; 6. The feedback optimization module monitors the node status after the strategy is executed, determines whether there is over-protection, and adjusts the security assessment model parameters based on the feedback data; 7. The adjusted model parameters are used for subsequent risk assessments to achieve continuous system optimization.

[0073] Through the detailed implementation process described above, the computer cluster security protection method and system of the present invention can achieve accurate risk assessment, adaptive matching of protection strategies, and self-learning evolution of the system. Combined with existing computer network security technologies and hardware devices, it effectively solves the defects of existing technologies and provides comprehensive, flexible, and efficient security protection for computer clusters.

[0074] It should be noted that the control method in the embodiments of this application can be automatically controlled by a controller. The control method of the controller can be implemented by simple programming by those skilled in the art, which is common knowledge in the field. Furthermore, this application is mainly used to protect mechanical structures, so the control method and circuit connection will not be explained in detail here.

[0075] The technical solutions described in the embodiments of this application effectively solve the problem of rigid static strategies by adaptively matching real-time risk assessment with protection strategies, achieving a precise correspondence between protection strength and security risk, thus ensuring security while saving resources. By integrating multi-dimensional data and security assessment models, the accuracy of node security status assessment is significantly improved, reducing false positives and false negatives. A tiered protection strategy, from basic monitoring to strict isolation, is provided to accurately handle abnormal nodes and minimize the impact on business operations. A closed-loop optimization mechanism enables the system to continuously evolve, effectively responding to new and unknown threats. Combined with reliable node authentication and dynamic micro-segmentation technology, the security and trustworthiness of the cluster's basic environment are ensured, preventing the spread of threats.

[0076] Obviously, the above-described embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention also intends to include these modifications and variations.

Claims

1. A method for protecting the security of a computer cluster, characterized in that, Includes the following steps: S1. Data collection steps: Through the agent program deployed on each node in the computer cluster, multi-dimensional operation data of the node is collected in real time. The multi-dimensional operation data includes resource consumption indicators, process behavior logs and network connection information. S2. Risk assessment steps: Extract multiple preset feature parameters from the multi-dimensional operational data, and use a security assessment model to calculate the feature parameters to generate a quantitative security score; map the security score to the corresponding discrete security level according to the preset score range, the discrete security level including low risk level, medium risk level and high risk level; S3. Policy execution steps: Based on the discrete security level, automatically match and load the corresponding protection policy from the preset protection policy library to the target node; wherein, for low-risk level, configure a basic monitoring policy with log recording as the main function; for medium-risk level, configure an enhanced protection policy that adds network traffic restriction and non-core port access control on top of the basic monitoring policy; and for high-risk level, configure a strict isolation policy that adds logical network isolation and non-critical process suspension on top of the enhanced protection policy. S4. Closed-loop optimization steps: Monitor the changes in the security status of nodes after the protection strategy is executed. When the monitoring data indicates that the strategy loading is judged to be overprotected, adjust the internal parameters of the security assessment model based on the feedback data.

2. The computer cluster security protection method according to claim 1, characterized in that, Before the data acquisition step S1, a node authentication step S0 is also included: The node to be connected to the cluster and the cluster control node perform two-way authentication based on the credentials provided by the hardware trusted module; after successful authentication, the two parties negotiate to generate a session key and establish an encrypted communication channel.

3. The computer cluster security protection method according to claim 2, characterized in that, In the node authentication step S0, the specific process of the two-way identity authentication includes: The node to be accessed requests an authentication request message containing hardware fingerprint information from its local trusted hardware module. The cluster control node receives and verifies the validity of the authentication request message; After successful verification, the cluster control node uses the elliptic curve cryptography algorithm to generate key negotiation parameters, encrypts them using the public key of the node to be connected, and returns them. The node to be accessed uses its private key to decrypt and obtain the parameters, generates the same session key, and sends an acknowledgment message to the cluster control node to complete the authentication.

4. The computer cluster security protection method according to claim 1, characterized in that, The security assessment model is a weighted scoring model; the generation of a quantitative security score is achieved by assigning specific weights to each feature parameter and calculating a weighted sum.

5. A computer cluster security protection method according to claim 1, characterized in that, The security assessment model is a machine learning classification model trained on historical data; the generation of a quantitative security score is achieved by inputting the feature parameters into the machine learning classification model and obtaining its output.

6. A computer cluster security protection method according to claim 1, characterized in that, In the policy execution step S3, the loading of the protection policy is achieved by calling the application programming interface of the software-defined network controller to dynamically distribute access control rules to the underlying network switching device.

7. A computer cluster security protection method according to claim 4, characterized in that, In the closed-loop optimization step S4, the internal parameters of the safety assessment model are adjusted, specifically by dynamically reducing the weight values ​​of the corresponding features in the weighted scoring model based on the feature parameters involved in the false alarm events.

8. A computer cluster security protection method according to claim 5, characterized in that, In the closed-loop optimization step S4, the internal parameters of the security assessment model are adjusted. Specifically, the data related to false alarm events are used as new negative samples to incrementally train the machine learning classification model in order to adjust its model parameters.

9. A computer cluster security protection system, used to implement the method according to any one of claims 1 to 8, characterized in that, The system includes: The data acquisition module is configured to collect multi-dimensional operational data through agent programs deployed on each node; The security assessment module is configured to receive the operational data, extract feature parameters, and use a security assessment model to calculate a security score and determine a security level. The policy management module has an embedded protection policy library, which is configured to match and issue corresponding protection policies based on the determined security level. The policy execution module configures the protection policies that are loaded and run on the nodes. The feedback optimization module is configured to monitor the node security status after policy execution and adjust the internal parameters of the security assessment model based on the feedback data.

10. A computer cluster security protection system according to claim 9, characterized in that, The system also includes a dynamic micro-segmentation control module, which is communicatively connected to a software-defined network controller and configured to convert protection policies into specific network flow table rules and distribute them to the data plane.

Images