Attack defense method and device, computer equipment, storage medium and program product
By acquiring the running status of nodes in a distributed cluster system, the working environment of the target node can be determined and updated, solving the problem of difficulty in dealing with APT attacks in existing technologies and improving the security and defense effectiveness of the system.
Patent Information
- Application Number
- CN202511760265.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-27
- Publication Date
- 2026-02-24
AI Technical Summary
When facing advanced persistent threat (APT) attacks, existing static defense methods for distributed cluster systems are insufficient to cope with the ever-changing attack methods, resulting in low security.
By acquiring the running status of each node in the distributed cluster system, the target node is determined according to the preset selection strategy and running status, and the working environment of the target node is updated, including restarting or reinstalling the image, to remove potential malware and interrupt the attacker's lateral penetration.
It improves the security of distributed cluster systems, prevents attackers from establishing persistent control chains, increases the difficulty of attacks, and enhances the unpredictability and flexibility of the system.
Smart Images
Figure CN121567413A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of application security technology, and in particular to an attack defense method, apparatus, computer equipment, storage medium, and program product. Background Technology
[0002] With the rapid development of information technology, distributed clusters have become a core form supporting modern information infrastructure such as cloud computing, edge computing, and microservice architectures. However, distributed clusters are vulnerable to Advanced Persistent Threats (APTs). APT attackers first breach the boundaries of the distributed cluster system, then implement lateral movement within the system, gradually gaining control of multiple nodes and causing serious consequences.
[0003] Currently, distributed clusters primarily rely on static defense methods based on predefined rules and signature databases to defend against attacks. However, this approach struggles to cope with constantly evolving APT attack methods, leaving distributed cluster systems with inherent security vulnerabilities. Summary of the Invention
[0004] Therefore, it is necessary to provide an attack defense method, device, computer equipment, storage medium, and program product to address the aforementioned technical problems.
[0005] Firstly, this application provides an attack defense method, including:
[0006] Obtain the running status of each node in the distributed cluster system under the current attack defense process;
[0007] The target node is determined from each node based on its operating status;
[0008] Update the target node's working environment to execute the current attack defense process.
[0009] In one embodiment, determining the target node from each of the nodes based on each of the operating states includes:
[0010] Based on the preset selection strategy and the running status of each node, the target node is determined from each node.
[0011] In one embodiment, determining the target node from each of the nodes according to a preset selection strategy and each of the operating states includes:
[0012] The target number of nodes is determined based on the minimum number of nodes required for the distributed cluster system to run, the number of available nodes in the distributed cluster system, and the number of nodes in the distributed cluster system that are in the process of updating the environment.
[0013] Based on the preset selection strategy and the respective operating states, the target node is determined from the nodes corresponding to the target number of nodes.
[0014] In one embodiment, determining the target node from the nodes corresponding to the target number of nodes according to the preset selection strategy and each of the operating states includes:
[0015] Among the nodes in this distributed cluster system, those whose running status is not "environment update" are identified as candidate nodes;
[0016] According to the preset selection strategy, the candidate nodes of the target number of nodes are determined as the target node.
[0017] In one embodiment, determining the target number of nodes based on the minimum number of nodes required for the distributed cluster system to run, the number of available nodes in the distributed cluster system, and the number of nodes in the distributed cluster system that are in the process of updating their environment includes:
[0018] Determine the sum between the minimum number of nodes and the number of nodes in the current environment update state;
[0019] Determine the difference between the number of available nodes and the summation result;
[0020] The target number of nodes is determined based on this difference.
[0021] In one embodiment, determining the target number of nodes based on the difference includes:
[0022] The range of values corresponding to the target number of nodes is determined based on this difference.
[0023] Determine any integer within this range as the target number of nodes.
[0024] In one embodiment, updating the working environment of the target node includes:
[0025] Perform a restart operation on the target node to update its working environment.
[0026] In one embodiment, updating the working environment of the target node includes:
[0027] Perform a mirror reinstallation operation on the target node to update its working environment.
[0028] In one embodiment, performing an image reinstallation operation on the target node includes:
[0029] Create a new target node based on the preset system image corresponding to the distributed cluster system;
[0030] Use this new target node as the target node.
[0031] In one embodiment, the method further includes:
[0032] During the process of updating the working environment of the target node, the running status of the target node is determined to be "environment updating".
[0033] In one embodiment, the method further includes:
[0034] Based on the completion time of the current attack defense process and the environment update cycle, determine the start time of the next attack defense, so that the next attack defense process of the current attack can be executed at the start time.
[0035] Secondly, this application also provides an attack defense device, comprising:
[0036] The acquisition module is used to acquire the running status of each node in the distributed cluster system under the current attack defense process;
[0037] The first determining module is used to determine the target node from each node based on the running status of each node;
[0038] The update module is used to update the working environment of the target node in order to execute the current attack defense process.
[0039] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:
[0040] Obtain the running status of each node in the distributed cluster system under the current attack defense process;
[0041] The target node is determined from each node based on its operating status;
[0042] Update the target node's working environment to execute the current attack defense process.
[0043] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:
[0044] Obtain the running status of each node in the distributed cluster system under the current attack defense process;
[0045] The target node is determined from each node based on its operating status;
[0046] Update the target node's working environment to execute the current attack defense process.
[0047] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:
[0048] Obtain the running status of each node in the distributed cluster system under the current attack defense process;
[0049] The target node is determined from each node based on its operating status;
[0050] Update the target node's working environment to execute the current attack defense process.
[0051] The aforementioned attack defense methods, devices, computer equipment, storage media, and program products acquire the operating status of each node in the distributed cluster system under the current attack defense process; determine the target node from each node based on the operating status; update the working environment of the target node to execute the current attack defense process, thereby continuously and randomly updating the working environment of each node in the distributed cluster system to remove malicious programs already implanted in the nodes, prevent attackers from establishing a persistent control chain, and also interrupt the attacker's lateral penetration process, increasing the difficulty of the attack, thereby improving the security of the distributed cluster system. Attached Figure Description
[0052] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0053] Figure 1 This is an application environment diagram of an attack defense method provided in an embodiment of this application;
[0054] Figure 2 This is a flowchart illustrating an attack defense method provided in an embodiment of this application;
[0055] Figure 3 This is a flowchart illustrating a target node determination method provided in an embodiment of this application;
[0056] Figure 4 This is a flowchart illustrating another target node determination method provided in an embodiment of this application;
[0057] Figure 5 This is a flowchart illustrating a method for determining the number of target nodes provided in an embodiment of this application;
[0058] Figure 6This is a flowchart illustrating another method for determining the number of target nodes provided in an embodiment of this application;
[0059] Figure 7 This is an interactive schematic diagram of an attack defense provided in an embodiment of this application;
[0060] Figure 8 This is a structural block diagram of an attack defense device provided in an embodiment of this application;
[0061] Figure 9 This is an internal structural diagram of a computer device provided in an embodiment of this application. Detailed Implementation
[0062] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.
[0063] With the rapid development of information technology, distributed clusters have become a core form supporting modern information infrastructure such as cloud computing, edge computing, and microservice architectures. However, distributed clusters are vulnerable to Advanced Persistent Threats (APTs). APT attackers first breach the boundaries of the distributed cluster system, then implement lateral movement within the system, gradually gaining control of multiple nodes and causing serious consequences.
[0064] Currently, distributed clusters primarily rely on static defense methods based on predefined rules and signature databases to defend against attacks. However, this approach struggles to cope with constantly evolving APT attack methods, leaving distributed cluster systems with inherent security vulnerabilities.
[0065] The attack defense method provided in this application embodiment can be applied to, for example... Figure 1 The distributed cluster system shown in the diagram includes a control device (i.e., a controller) that can schedule the stateless cluster nodes in the distributed cluster, a load balancer that can allocate service traffic to each stateless cluster node in response to user requests, and control devices communicating with each other. The control device can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.
[0066] In one embodiment, such as Figure 2 As shown, Figure 2 This is a flowchart illustrating an attack defense method provided in an embodiment of this application. This method can be applied to... Figure 1The method for controlling a device includes the following steps:
[0067] S201: Obtain the running status of each node in the distributed cluster system under the current attack defense process.
[0068] In the embodiments of this application, as shown in... Figure 1 In the stateless distributed cluster system shown, the running status of each node can be obtained through control devices. Stateless means that each node is stateless and can be restarted or reinstalled at any time.
[0069] For example, the running status of a node may include: the node is in a normal running state or the node is in a state of environment update.
[0070] Optionally, in the distributed cluster system provided in this embodiment, a trigger condition can be set, and an attack defense process is executed each time the trigger condition is met. The trigger condition may, for example, include a time interval or system load status.
[0071] In one optional implementation, taking the trigger condition as the time interval as an example, the environment update cycle (i.e., the attack and defense time interval Xt) can be obtained. Then, the completion time of the previous attack and defense process can be obtained. Based on the environment update cycle and the completion time of the previous attack and defense process, the start time of the current attack and defense process can be determined, and the current attack and defense process can be executed at the start time. Similarly, the start time of the next attack and defense process can be determined based on the completion time of the current attack and defense process and the environment update cycle, so that the next attack and defense process can be executed at the start time.
[0072] Optionally, the attack defense time interval Xt mentioned above is randomly generated, that is, a duration is randomly generated based on the time interval range [T_min, T_max], and this random duration is used as the attack defense time interval Xt. The random time interval further increases the unpredictability of the system, making it impossible for attackers to predict the system's environment update cycle in advance, thereby further enhancing the defense effect.
[0073] S202, determine the target node from each node based on each operating status.
[0074] Optionally, nodes that can be updated in the environment can be determined from each node according to their operating status, and several nodes can be selected from the nodes that can be updated in the environment according to a preset selection strategy to obtain the target node.
[0075] For example, the preset selection strategy could be random selection, in which case several nodes could be randomly selected from the nodes that can perform environment updates as target nodes.
[0076] In another possible implementation, the update order of the node environment can be used as a preset selection strategy. In this case, several nodes that can be updated can be selected as target nodes in sequence according to the preset update order of the node environment.
[0077] It should be noted that, compared to a regular, preset selection strategy, random selection makes the system more unpredictable and has a better attack and defense effect.
[0078] S203, Update the target node's working environment to execute the current attack defense process.
[0079] In this embodiment of the application, updating the working environment of the target node is also called resetting the working environment of the target node, so that the target node is in an initial working environment, that is, in a working environment in which the target node has not been attacked by the attacker.
[0080] Alternatively, the working environment of the target node can be updated by restarting the target node, or by reinstalling the target node through image mirroring.
[0081] In one exemplary embodiment, a random reboot operation can be performed on a selected target node to remove any malware or backdoors that may be present on the target node.
[0082] Alternatively, a new target node can be created based on a pre-defined system image corresponding to the distributed cluster system. This new target node then replaces the original target node, thus reinstalling the target node from its image. Reinstalling the target node from its image restores it to its initial clean state, effectively removing potential malware, Trojans, or backdoors.
[0083] It should be noted that before executing the process of updating the target node's working environment, the target node's running status must first be marked as "environment update in progress" and the load balancer must be notified so that the load balancer can redistribute the target node's business traffic to other nodes and remove the target node from the business traffic distribution, thus avoiding interference with the normal operation of the distributed cluster system caused by the target node's working environment update.
[0084] In this embodiment, the running status of each node in the distributed cluster system under the current attack defense process is obtained; the target node is determined from each node according to the running status; the working environment of the target node is updated to execute the current attack defense process. In this way, by continuously and randomly updating the working environment of each node in the distributed cluster system, malicious programs implanted in the nodes are removed, preventing attackers from establishing a persistent control chain. Furthermore, it can also interrupt the attacker's lateral penetration process, increase the difficulty of the attack, and thus improve the security of the distributed cluster system.
[0085] Reference Figure 3 , Figure 3 This is a flowchart illustrating a target node determination method provided in an embodiment of this application. This embodiment relates to a possible implementation of how to determine a target node from various nodes based on a preset selection strategy and various operating states. Based on the above embodiment, the target node determination method includes the following steps:
[0086] S301. Determine the target number of nodes based on the minimum number of nodes required for the distributed cluster system to run, the number of available nodes in the distributed cluster system, and the number of nodes in the distributed cluster system whose running status is environment update.
[0087] In one embodiment, the control device can obtain the minimum number of nodes A required for the distributed cluster system to run, the number of available nodes N in the distributed cluster system, and the number of nodes Nv in the distributed cluster system that are in the process of environment updating. Based on the minimum number of nodes A required for the distributed cluster system to run, the number of available nodes N in the distributed cluster system, and the number of nodes Nv in the distributed cluster system that are in the process of environment updating, the control device determines the maximum number of nodes X that can be updated in the distributed cluster system. Then, the target number of nodes is determined based on the maximum number of nodes X. Wherein, X = NA - Nv.
[0088] Optionally, the maximum number of nodes X can be directly used as the target number of nodes, or any integer less than the maximum number of nodes X can be used as the target number of nodes.
[0089] S302, based on the preset selection strategy and each operating status, determine the target node corresponding to the target number of nodes from each node.
[0090] Optionally, nodes that can be updated in the environment can be determined from each node according to each running status, and several target nodes can be selected from the nodes that can be updated in the environment according to a preset selection strategy to obtain the target node.
[0091] In this embodiment, the target number of nodes is determined based on the minimum number of nodes required for the distributed cluster system to run, the number of available nodes in the distributed cluster system, and the number of nodes in the distributed cluster system whose running state is undergoing environment updates. According to the preset selection strategy and each running state, the target node corresponding to the target number of nodes is determined from each node, thereby ensuring that there are always enough available nodes in the system to process business and avoiding the impact of node working environment updates on the normal operation of the system.
[0092] Reference Figure 4 , Figure 4This is a flowchart illustrating another target node determination method provided in this application embodiment. This embodiment relates to a possible implementation of how to determine the target node corresponding to the target node number from each node based on a preset selection strategy and various operating states. Based on the above embodiment, the above S302 includes the following steps:
[0093] S401 identifies nodes in the distributed cluster system whose running status is not in the process of updating the environment as candidate nodes.
[0094] In one possible implementation, if the previous attack defense process has not yet ended and the current attack defense process has already started, then when the current attack defense process performs the step of selecting the target node, there may still be some nodes in the distributed cluster system whose running state is "environment update". Therefore, when selecting the target node in the current process, it is necessary to avoid these nodes that are in the "environment update" state. That is, nodes whose running state is not "environment update" are identified as candidate nodes, and the target node is selected from the nodes whose running state is not "environment update".
[0095] S402, according to the preset selection strategy, the candidate nodes of the target number of nodes are determined as the target nodes.
[0096] For example, several candidate nodes can be randomly selected from the candidate nodes and used as the target node.
[0097] In this embodiment, nodes in the distributed cluster system whose running state is not in an environment update are identified as candidate nodes; according to a preset selection strategy, candidate nodes of the target number of nodes are identified as target nodes, thereby avoiding nodes in an environment update when selecting target nodes, and further improving the flexibility and reliability of the system.
[0098] Reference Figure 5 , Figure 5 This is a flowchart illustrating a method for determining the target number of nodes provided in an embodiment of this application. This embodiment relates to a possible implementation of determining the target number of nodes based on the minimum number of nodes required for the distributed cluster system to run, the number of available nodes in the distributed cluster system, and the number of nodes in the distributed cluster system whose running state is "environment update". Based on the above embodiment, step S301 includes the following steps:
[0099] S501 determines the sum between the minimum number of nodes and the number of nodes in the running state during environment updates.
[0100] S502, determine the difference between the number of available nodes and the summation result.
[0101] S503, determine the target number of nodes based on the difference.
[0102] For example, the sum of the minimum number of nodes A and the number of nodes Nv in the environment update state can be determined as A+Nv. Then, the difference N-(A+Nv) between the number of available nodes and the sum can be determined. This difference is determined as the maximum number of nodes X that can be updated in the distributed cluster system, and the target number of nodes can be determined based on the maximum number of nodes X.
[0103] Optionally, the maximum number of nodes X can be directly used as the target number of nodes, or any integer less than the maximum number of nodes X can be used as the target number of nodes.
[0104] In this embodiment, the minimum number of nodes and the number of nodes in the running environment update are summed; the difference between the number of available nodes and the sum is determined; and the target number of nodes is determined based on the difference, thereby ensuring that there are always enough available nodes in the system to process business and avoiding the impact of node working environment updates on the normal operation of the system.
[0105] Reference Figure 6 , Figure 6 This is a flowchart illustrating another method for determining the number of target nodes provided in this application embodiment. This embodiment relates to a possible implementation of how to determine the number of target nodes based on the difference. Based on the above embodiment, S503 includes the following steps:
[0106] S601, determine the range of values corresponding to the target number of nodes based on the difference.
[0107] S602, determine any integer within the range of values as the target number of nodes.
[0108] Optionally, since the above difference is the maximum number of nodes X that can be updated in the distributed cluster system, [0, X] can be determined as the range of values corresponding to the target number of nodes. Then, an integer x is randomly generated from the range [0, X] and used as the target number of nodes.
[0109] Specifically, if the randomly generated integer x=0, then the current attack defense process will not perform any operation, that is, skip the current round of working environment update.
[0110] In this embodiment, the range of values corresponding to the number of target nodes is determined based on the difference; any integer within the range is determined as the number of target nodes, thereby randomly determining the number of target nodes within the range, which further improves the unpredictability of the system and optimizes the effect of attack defense.
[0111] Reference Figure 7 , Figure 7This is an interactive schematic diagram of an attack defense method provided in an embodiment of this application. To provide a clearer explanation of the attack defense method provided in this embodiment, it is combined with... Figure 7 The complete steps of the attack defense method provided in the embodiments of this application are described below:
[0112] In this embodiment, the control device can randomly determine target nodes (taking node 1, node 2, and node N as an example), and send a notification to the load balancer based on the determined target nodes to remove node 1, node 2, and node N from the business process allocation. Then, the control device randomly restarts or reinstalls node 1, node 2, and node N respectively, updating their working environment through random restarts or reinstallations. After the restart or reinstallation is completed, the control device sends a notification to the load balancer to reattach node 1, node 2, and node N to the business process allocation through the load balancer.
[0113] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.
[0114] Based on the same inventive concept, this application also provides an attack defense device for implementing the attack defense method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more attack defense device embodiments provided below can be found in the limitations of the attack defense method described above, and will not be repeated here.
[0115] In one embodiment, such as Figure 8 As shown, Figure 8 This is a structural block diagram of an attack defense device provided in an embodiment of this application. The device 800 includes:
[0116] The acquisition module 801 is used to acquire the running status of each node in the distributed cluster system under the current attack defense process.
[0117] The first determining module 802 is used to determine the target node from each node based on each operating state.
[0118] Update module 803 is used to update the working environment of the target node in order to execute the current attack defense process.
[0119] In one embodiment, the first determining module 802 includes:
[0120] The first determining unit is used to determine the target node from each node according to the preset selection strategy and each operating state.
[0121] In one embodiment, the first determining unit includes:
[0122] The first determining subunit is used to determine the target number of nodes based on the minimum number of nodes required for the distributed cluster system to run, the number of available nodes in the distributed cluster system, and the number of nodes in the distributed cluster system whose running status is environment update.
[0123] The second determining subunit is used to determine the target node from the nodes corresponding to the target number of nodes according to the preset selection strategy and each operating state.
[0124] In one embodiment, the second determining subunit is specifically used to determine the nodes in the distributed cluster system whose running state is not in the process of environment update as candidate nodes; and to determine the candidate nodes of the target number of nodes as target nodes according to a preset selection strategy.
[0125] In one embodiment, the first determining subunit is specifically used to determine the sum of the minimum number of nodes and the number of nodes in the running state of environment update; determine the difference between the available number of nodes and the sum; and determine the target number of nodes based on the difference.
[0126] In one embodiment, the range of values corresponding to the target number of nodes is determined based on the difference; any integer within the range of values is determined as the target number of nodes.
[0127] In one embodiment, the update module 803 includes:
[0128] The first update unit is used to perform a restart operation on the target node in order to update the target node's working environment.
[0129] In one embodiment, the update module 803 includes:
[0130] The second update unit is used to perform a mirror reinstallation operation on the target node to update the target node's working environment.
[0131] In one embodiment, the second update unit is specifically used to create a new target node based on a preset system image corresponding to the distributed cluster system; and to use the new target node as the target node.
[0132] In one embodiment, the device 800 includes:
[0133] The second determination module is used to determine the running status of the target node as "environment update in progress" during the process of updating the working environment of the target node.
[0134] In one embodiment, the device 800 includes:
[0135] The third determining module is used to determine the start time of the next attack defense based on the completion time of the current attack defense process and the environment update cycle, so as to execute the next attack defense process of the current attack defense at the start time.
[0136] Each module in the aforementioned attack defense device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.
[0137] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 9 As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and databases. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media to run. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements an attack defense method.
[0138] Those skilled in the art will understand that Figure 9 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.
[0139] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:
[0140] Obtain the running status of each node in the distributed cluster system under the current attack defense process;
[0141] The target node is determined from each node based on its operating status;
[0142] Update the target node's working environment to execute the current attack defense process.
[0143] In one embodiment, the processor, when executing a computer program, also performs the following steps:
[0144] Based on the preset selection strategy and each operating status, the target node is determined from each node.
[0145] In one embodiment, the processor, when executing a computer program, also performs the following steps:
[0146] The target number of nodes is determined based on the minimum number of nodes required for the distributed cluster system to run, the number of available nodes in the distributed cluster system, and the number of nodes in the distributed cluster system that are in the process of updating the environment.
[0147] Based on the preset selection strategy and each operating status, the target node is determined from the nodes corresponding to the target number of nodes.
[0148] In one embodiment, the processor, when executing a computer program, also performs the following steps:
[0149] In the distributed cluster system, nodes whose running status is not "environment update" are identified as candidate nodes.
[0150] According to the preset selection strategy, candidate nodes with the target number of nodes are determined as target nodes.
[0151] In one embodiment, the processor, when executing a computer program, also performs the following steps:
[0152] The minimum number of nodes and the number of nodes in the running state during environment updates are determined by summing the results.
[0153] Determine the difference between the number of available nodes and the summation result;
[0154] The target number of nodes is determined based on the difference.
[0155] In one embodiment, the processor, when executing a computer program, also performs the following steps:
[0156] Determine the range of values corresponding to the target number of nodes based on the difference;
[0157] Determine any integer within the range of possible values as the target number of nodes.
[0158] In one embodiment, the processor, when executing a computer program, also performs the following steps:
[0159] Perform a restart operation on the target node to update its working environment.
[0160] In one embodiment, the processor, when executing a computer program, also performs the following steps:
[0161] Perform an image reinstallation operation on the target node to update the target node's working environment.
[0162] In one embodiment, the processor, when executing a computer program, also performs the following steps:
[0163] Create a new target node based on the preset system image corresponding to the distributed cluster system;
[0164] Set the new target node as the target node.
[0165] In one embodiment, the processor, when executing a computer program, also performs the following steps:
[0166] During the process of updating the working environment of the target node, the running status of the target node is determined to be "environment updating".
[0167] In one embodiment, the processor, when executing a computer program, also performs the following steps:
[0168] Based on the completion time of the current attack defense process and the environment update cycle, determine the start time of the next attack defense, so that the next attack defense process of the current attack defense can be executed at the start time.
[0169] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:
[0170] Obtain the running status of each node in the distributed cluster system under the current attack defense process;
[0171] The target node is determined from each node based on its operating status;
[0172] Update the target node's working environment to execute the current attack defense process.
[0173] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0174] Based on the preset selection strategy and each operating status, the target node is determined from each node.
[0175] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0176] The target number of nodes is determined based on the minimum number of nodes required for the distributed cluster system to run, the number of available nodes in the distributed cluster system, and the number of nodes in the distributed cluster system that are in the process of updating the environment.
[0177] Based on the preset selection strategy and each operating status, the target node is determined from the nodes corresponding to the target number of nodes.
[0178] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0179] In the distributed cluster system, nodes whose running status is not "environment update" are identified as candidate nodes.
[0180] According to the preset selection strategy, candidate nodes with the target number of nodes are determined as target nodes.
[0181] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0182] The minimum number of nodes and the number of nodes in the running state during environment updates are determined by summing the results.
[0183] Determine the difference between the number of available nodes and the summation result;
[0184] The target number of nodes is determined based on the difference.
[0185] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0186] Determine the range of values corresponding to the target number of nodes based on the difference;
[0187] Determine any integer within the range of possible values as the target number of nodes.
[0188] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0189] Perform a restart operation on the target node to update its working environment.
[0190] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0191] Perform an image reinstallation operation on the target node to update the target node's working environment.
[0192] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0193] Create a new target node based on the preset system image corresponding to the distributed cluster system;
[0194] Set the new target node as the target node.
[0195] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0196] During the process of updating the working environment of the target node, the running status of the target node is determined to be "environment updating".
[0197] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0198] Based on the completion time of the current attack defense process and the environment update cycle, determine the start time of the next attack defense, so that the next attack defense process of the current attack defense can be executed at the start time.
[0199] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:
[0200] Obtain the running status of each node in the distributed cluster system under the current attack defense process;
[0201] The target node is determined from each node based on its operating status;
[0202] Update the target node's working environment to execute the current attack defense process.
[0203] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0204] Based on the preset selection strategy and each operating status, the target node is determined from each node.
[0205] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0206] The target number of nodes is determined based on the minimum number of nodes required for the distributed cluster system to run, the number of available nodes in the distributed cluster system, and the number of nodes in the distributed cluster system that are in the process of updating the environment.
[0207] Based on the preset selection strategy and each operating status, the target node is determined from the nodes corresponding to the target number of nodes.
[0208] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0209] In the distributed cluster system, nodes whose running status is not "environment update" are identified as candidate nodes.
[0210] According to the preset selection strategy, candidate nodes with the target number of nodes are determined as target nodes.
[0211] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0212] The summation between the minimum number of nodes and the number of nodes in the environment update is determined.
[0213] Determine the difference between the number of available nodes and the summation result;
[0214] The target number of nodes is determined based on the difference.
[0215] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0216] Determine the range of values corresponding to the target number of nodes based on the difference;
[0217] Determine any integer within the range of values as the target number of nodes.
[0218] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0219] Perform a restart operation on the target node to update its working environment.
[0220] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0221] Perform an image reinstallation operation on the target node to update the target node's working environment.
[0222] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0223] Create a new target node based on the preset system image corresponding to the distributed cluster system;
[0224] Set the new target node as the target node.
[0225] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0226] During the process of updating the working environment of the target node, the running status of the target node is determined to be "environment updating".
[0227] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0228] Based on the completion time of the current attack defense process and the environment update cycle, determine the start time of the next attack defense, so that the next attack defense process of the current attack defense can be executed at the start time.
[0229] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.
[0230] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.
[0231] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.
Claims
1. An attack defense method, characterized in that, The method is applied to a control device in a distributed cluster system, and the method includes: Obtain the running status of each node in the distributed cluster system under the current attack defense process; The target node is determined from each of the nodes based on the described operating status; Update the working environment of the target node to execute the current attack defense process.
2. The method according to claim 1, characterized in that, The step of determining the target node from each of the nodes based on each of the aforementioned operating states includes: The target node is determined from each of the nodes according to the preset selection strategy and the respective operating states.
3. The method according to claim 2, characterized in that, The step of determining the target node from each of the nodes according to a preset selection strategy and each of the operating states includes: The target number of nodes is determined based on the minimum number of nodes required for the distributed cluster system to run, the number of available nodes in the distributed cluster system, and the number of nodes in the distributed cluster system that are in the process of updating the environment. Based on the preset selection strategy and each of the operating states, the target node is determined from each of the nodes corresponding to the target number of nodes.
4. The method according to claim 3, characterized in that, The step of determining the target node from the nodes corresponding to the target number of nodes according to the preset selection strategy and each of the operating states includes: Among the nodes in the distributed cluster system, those whose running status is not "environment update" are identified as candidate nodes. According to the preset selection strategy, candidate nodes of the target number of nodes are determined as the target nodes.
5. The method according to claim 3, characterized in that, The step of determining the target number of nodes based on the minimum number of nodes required for the distributed cluster system to run, the number of available nodes in the distributed cluster system, and the number of nodes in the distributed cluster system whose running status is environment update includes: Determine the sum between the minimum number of nodes and the number of nodes in the environment update state; Determine the difference between the number of available nodes and the summation result; The target number of nodes is determined based on the difference.
6. The method according to claim 5, characterized in that, Determining the target number of nodes based on the difference includes: The range of values corresponding to the target number of nodes is determined based on the difference. The target number of nodes is determined to be any integer within the range of values.
7. The method according to claim 1, characterized in that, Updating the working environment of the target node includes: Perform a restart operation on the target node to update the target node's working environment.
8. The method according to claim 1, characterized in that, Updating the working environment of the target node includes: Perform a mirror reinstallation operation on the target node to update the target node's working environment.
9. The method according to claim 8, characterized in that, The mirror reinstallation operation on the target node includes: Create a new target node based on the preset system image corresponding to the distributed cluster system; The new target node is used as the target node.
10. The method according to any one of claims 1-9, characterized in that, The method further includes: During the process of updating the working environment of the target node, the running status of the target node is determined to be "environment updating".
11. The method according to any one of claims 1-9, characterized in that, The method further includes: Based on the completion time of the current attack defense process and the environment update cycle, the start time of the next attack defense is determined, so that the next attack defense process of the current attack defense is executed at the start time.
12. An attack defense device, characterized in that, The device includes: The acquisition module is used to acquire the running status of each node in the distributed cluster system under the current attack defense process; The first determining module is used to determine the target node from each of the nodes based on each of the said operating states; The update module is used to update the working environment of the target node in order to execute the current attack defense process.
13. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 11.
14. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 11.
15. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 11.