Adaptive scanning concurrent number adjusting method under microgrid isolation

Abstract

The invention relates to the technical field of intelligent power grid network security, in particular to an adaptive scanning concurrency number adjusting method under micro-grid isolation, which comprises the following steps: S1, respectively deploying load monitoring nodes in a control area, a non-control area and a management information area, collecting service load and network state data of each area in real time through the load monitoring node; and S2, based on the collected service load and network state data, constructing a concurrent number calculation formula, and through dynamic concurrent adjustment driven by the real-time load, the vulnerability scanning efficiency is ensured, and the service operation of each region of the micro-grid is prevented from being interfered.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of smart grid network security detection technology, in particular to a self-adaptive scanning concurrent number adjustment method under micro-grid isolation. BACKGROUND

[0002] In order to meet the requirements of the "Electric Power Monitoring System Security Protection Regulations", the power monitoring system adopts a micro-grid isolation architecture to divide the network into control areas (such as the area where the SCADA system is located), non-control areas (such as the area where the condition monitoring system is located), management information areas (such as office networks), etc. Each area is strictly isolated through firewalls and isolation devices. As a core means of discovering security risks, the number of concurrent scans directly affects the detection efficiency and business stability. The traditional scanning technology has the following significant defects in this environment: The traditional scanning tool uses a preset number of concurrent threads (such as 50 threads), without considering the dynamic load changes of the power business: the control area needs to handle a large amount of real-time data (such as 1000+ telemetry frames received per second by the SCADA system) during the peak power consumption period (8:00-22:00). A fixed high concurrency will cause the server CPU occupancy rate to soar from 50% to 90%, causing data transmission delays.

[0003] The non-control area has a low load during the low peak period (22:00-6:00), but a fixed low concurrency results in a prolonged scanning time (such as 12 hours for 1000 devices), which cannot meet the compliance requirements of "daily scanning". The network characteristics and business sensitivity of different micro-grid areas differ significantly, but the traditional scanning uses a unified concurrency strategy. The control area is sensitive to delay (requires ≤100ms), but the concurrency number is not reduced, resulting in a scan packet loss rate exceeding 30%. The management information area has sufficient network bandwidth, but due to the concurrency limit, the resources are not fully utilized, and the scanning efficiency is only 30% of the theoretical value.

[0004] In the prior art, general scanning tools (such as Nessus, OpenVAS) support concurrency configuration, but are not optimized for micro-grid isolation characteristics: first, there is no load awareness mechanism designed in combination with the real-time nature of the power business; second, there is a lack of differentiated strategies across regions; third, the dynamic response delay exceeds 5 minutes, which cannot respond to sudden load changes.

[0005] The present application aims to solve the core problem of scanning concurrency adjustment in a micro-grid isolation environment, i.e. fixed concurrency causing business interference, and to achieve dynamic adaptation based on real-time business load. SUMMARY

[0006] In view of the problems existing in the prior art, the present application is proposed.

[0007] To solve the above technical problems, the application provides the following technical scheme: a self-adaptive scanning concurrent number adjustment method under micro-network isolation, comprising the following steps, Step S1, load monitoring nodes are arranged in the control area, non-control area and management information area respectively, and the load monitoring nodes are used to collect the service load and network state data of each area in real time; Step S2, based on the collected service load and network state data, a concurrent number calculation formula is constructed, the concurrent number calculation formula is current concurrent number = reference concurrent number * load coefficient * network coefficient * service coefficient, wherein the reference concurrent number is preset according to the service priority of each area, the load coefficient is determined according to the server load state, the network coefficient is determined according to the network transmission state, and the service coefficient is determined according to the real-time demand of the service; Step S3, the current concurrent number of each area is calculated according to the concurrent number calculation formula, and the calculated current concurrent number is sent to the detection nodes of each area, and the detection nodes perform the vulnerability scanning task according to the current concurrent number; Step S4, in the scanning task execution process, the load monitoring nodes are used to continuously monitor the service load and network state changes of each area, and when the changes exceed the preset threshold, the current concurrent number is recalculated and sent to the detection nodes, so that the dynamic adjustment of the concurrent number is realized; Step S5, when the emergency scanning task is accessed, the releasable concurrent number is calculated based on the current concurrent number and the minimum guarantee concurrent number of each area, a preset proportion of the releasable concurrent number is occupied from the regular scanning task and allocated to the emergency scanning task, and the occupied concurrent number is released to the regular scanning task pool after the emergency scanning task is completed; Step S6, for the multi-area scanning task queuing scene, the concurrent resource is allocated based on the “service importance-scanning urgency” matrix, and the cooperative scheduling of the cross-area concurrent resource is realized.

[0008] As a preferred scheme of the self-adaptive scanning concurrent number adjustment method under micro-network isolation, in step S1, the service load and network state data collected by the load monitoring node include four types of key indicators, namely server load indicators, network state indicators, service real-time indicators and task queue indicators, the collection period of the load monitoring node is 1-10 seconds, and the collected data is synchronized to the control node arranged in the headquarters security management area in real time.

[0009] As a preferred scheme of the self-adaptive scanning concurrent number adjustment method under micro-network isolation, in step S2, the reference concurrent number is set according to the service priority of each area, wherein the reference concurrent number of the control area is set to 10, the reference concurrent number of the non-control area is set to 30, and the reference concurrent number of the management information area is set to 50.

[0010] As a preferred scheme of the adaptive scan concurrent number adjustment method under the micro-network isolation, in the step S2, the load coefficient is determined according to the CPU usage rate and the memory usage rate in the server load index; when the CPU usage rate is less than or equal to 50% and the memory usage rate is less than or equal to 60%, the load coefficient is 1.2; when the CPU usage rate is greater than 50% and less than or equal to 70% or the memory usage rate is greater than 60% and less than or equal to 80%, the load coefficient is 1.0; and when the CPU usage rate is greater than 70% or the memory usage rate is greater than 80%, the load coefficient is 0.5.

[0011] As a preferred scheme of the adaptive scan concurrent number adjustment method under the micro-network isolation, in the step S2, the network coefficient is determined according to the link bandwidth utilization rate and the packet loss rate in the network state index; when the link bandwidth utilization rate is less than or equal to 50% and the packet loss rate is less than or equal to 3%, the network coefficient is 1.1; when the link bandwidth utilization rate is greater than 50% and less than or equal to 70% or the packet loss rate is greater than 3% and less than or equal to 5%, the network coefficient is 1.0; and when the link bandwidth utilization rate is greater than 70% or the packet loss rate is greater than 5%, the network coefficient is 0.8.

[0012] As a preferred scheme of the adaptive scan concurrent number adjustment method under the micro-network isolation, in the step S2, the service coefficient is determined according to the real-time task proportion in the service real-time index; when the real-time task proportion is less than or equal to 30%, the service coefficient is 1.0; when the real-time task proportion is greater than 30% and less than or equal to 60%, the service coefficient is 0.9; and when the real-time task proportion is greater than 60%, the service coefficient is 0.7.

[0013] As a preferred scheme of the adaptive scan concurrent number adjustment method under the micro-network isolation, in the step S4, a dynamic threshold updating step is further included, and the determination threshold of the reference concurrent number and each coefficient is optimized based on the historical acquisition data of each region every week; if the CPU usage rate of the control region is less than or equal to 30% for three consecutive weeks, the reference concurrent number of the control region is increased from 10 to 15; and if the link bandwidth utilization rate of the non-control region frequently exceeds 70%, the “decrease threshold” in the network coefficient is decreased from 70% to 60%.

[0014] As a preferred scheme of the adaptive scan concurrent number adjustment method under the micro-network isolation, in the step S5, the priority of the emergency scan task is marked as level 10, and the priority of the conventional scan task is marked as level 5; the minimum guarantee concurrent number is 50% of the reference concurrent number of the corresponding region; the proportion of the releasable concurrent number occupied from the conventional scan task is 30%, and after the emergency scan task is completed, the occupied concurrent number is immediately released back to the conventional scan task pool.

[0015] As a preferred scheme of the adaptive scanning concurrent number adjustment method under the micro-network isolation of the application, in the step S6, the resource allocation ratio of the "service importance-scanning urgency" matrix is as follows: the task with high importance and high urgency is allocated 40% of the total concurrent resources, the task with high importance and medium urgency is allocated 25% of the total concurrent resources, the task with medium importance and high urgency is allocated 20% of the total concurrent resources, the task with medium importance and medium urgency is allocated 10% of the total concurrent resources, and the task with low importance and high or medium urgency is allocated 5% of the total concurrent resources; wherein the control area is a high importance area, the non-control area is a medium importance area, and the management information area is a low importance area.

[0016] As a preferred scheme of the adaptive scanning concurrent number adjustment method under the micro-network isolation of the application, when the load data is lost for three times in succession, the control node enables the historical synchronous data of the area to estimate the current concurrent number and triggers an alarm; when the probe node does not adjust the concurrent number as instructed, the control node sets the concurrent number by force through a backup channel and records the deviation value for subsequent threshold optimization; when the scanning task causes the service delay of the control area to exceed 100 ms, the concurrent number of the control area is immediately reduced to 1, and the concurrent number is gradually restored after 30 seconds, while the scanning task is suspended for 30 minutes.

[0017] The application has the following beneficial effects: the application realizes dynamic concurrent adjustment driven by real-time load, guarantees the efficiency of vulnerability scanning, and avoids interference to the operation of services in each area of the micro-network; the application formulates targeted concurrent strategies according to the service priority and demand of each area, and improves the rationality of resource utilization in different isolated areas; the application monitors the service and network state in real time, and adjusts the concurrent number in time; the application optimizes parameters in combination with historical data, provides a bottom solution for abnormal scenarios, and reduces the influence of faults; the application establishes a priority mechanism for emergency scanning tasks, quickly allocates resources to support emergency demand, releases resources in time after the completion of the task, and does not affect the regular scanning; and the application allocates cross-area concurrent resources according to the logic of service importance and scanning urgency, avoids task accumulation, and improves the overall vulnerability scanning efficiency of the micro-network. BRIEF DESCRIPTION OF DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without any creative effort on the basis of these drawings. Among them: Figure 1 It is a general schematic diagram in the application. DETAILED DESCRIPTION

[0019] In order to make the above objectives, characteristics and advantages of the present application more obvious and easy to understand, the specific embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0020] In the following description, a large number of specific details are set forth in order to facilitate a thorough understanding of the present application, but the present application can also be implemented in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the concept of the present application, therefore the present application is not limited to the specific embodiments disclosed below.

[0021] Secondly, "one embodiment" or "embodiment" referred to herein means that a specific feature, structure or characteristic can be included in at least one implementation of the present application. "In one embodiment" appearing in different places in the specification does not mean the same embodiment, nor is it an embodiment that is separate or alternative to other embodiments.

[0022] Before performing the method, the following hardware deployment and communication configuration are completed to provide a basis for adaptive adjustment, the control node: deployed in the power headquarters security management area, using an industrial server with 8 cores and 16 GB of memory, running a concurrent scheduling engine developed based on Golang, the core functions are receiving load data, calculating concurrency, issuing adjustment instructions and cross-area resource allocation; load monitoring node: each micro-network area (control area, non-control area, management information area) is deployed with 1 terminal with 2 cores and 4 GB of memory, which collects server CPU, memory and other load indicators through SNMP protocol, analyzes network indicators such as link bandwidth utilization and packet loss rate in real time through DPDK technology, the data collection period is 1 second, and after collection, it is synchronized to the control node through the power special vertical encryption device; probe node: 2-3 scanning terminals with 4 cores and 8 GB of memory are deployed in each micro-network area, which are used to receive concurrency instructions from the control node and execute vulnerability scanning tasks; task queue: realized based on RabbitMQ, distinguishing between "emergency task priority queue" (priority level 10) and "regular task normal queue" (priority level 5), to ensure that emergency tasks are scheduled first; isolated communication configuration: unidirectional data transmission is realized between the control area and the non-control area using a forward isolation device, and the non-control area and the management information area are isolated by a firewall, and all node communications are through a power special encryption channel to ensure data security.

[0023] The control area and the management information area of a certain 220kV substation are taken as application objects in this embodiment, and the process is executed according to the process of "load sensing → concurrency calculation → dynamic adjustment → emergency response → cross-area cooperation", and the specific steps are as follows: Step 1, initial configuration and load sensing First, the baseline parameters and initial load state of each area are configured and collected: Baseline parameter preset: According to the regional service priority, set the control area (high importance) baseline concurrency to 10, and the management information area (low importance) baseline concurrency to 50; At the same time, preset the judgment threshold of each coefficient: CPU safety threshold control area ≤ 70%, management information area ≤ 80%, bandwidth safety threshold control area ≤ 50%, management information area ≤ 70%, real-time task proportion high threshold control area > 60%, management information area > 30%; Load data collection: The load monitoring node collects and synchronizes data to the control node in real time, and the collection results are as follows: Control area: CPU usage 45%, memory usage 50%, link bandwidth utilization 40%, packet loss rate 2%, real-time task proportion 70% (telemetry data proportion high), 20 devices to be scanned (regular task); Management information area: CPU usage 30%, memory usage 40%, link bandwidth utilization 30%, packet loss rate 1%, real-time task proportion 5% (office business proportion low), 100 devices to be scanned (regular task).

[0024] Step 2: Concurrency calculation The control node calculates the concurrency of each area based on the collected load data according to the formula "current concurrency = baseline concurrency × load coefficient × network coefficient × service coefficient", and the specific calculation process is as follows: Control area concurrency calculation: Load coefficient: 1.2 because CPU usage is 45% ≤ 50% and memory usage is 50% ≤ 60%; Network coefficient: 1.1 because bandwidth utilization is 40% ≤ 50% and packet loss rate is 2% ≤ 3%; Service coefficient: 0.7 because real-time task proportion is 70% > 60%; Calculation result: 10 × 1.2 × 1.1 × 0.7 ≈ 9.24, considering the service safety of the control area, round down to 9; Management information area concurrency calculation: Load coefficient: 1.2 because CPU usage is 30% ≤ 50% and memory usage is 40% ≤ 60%; Network coefficient: 1.1 because bandwidth utilization is 30% ≤ 50% and packet loss rate is 1% ≤ 3%; Service coefficient: 1.0 because real-time task proportion is 5% ≤ 30%; Calculation result: 50 × 1.2 × 1.1 × 1.0 = 66, considering the efficiency priority of the management information area, round up to 66.

[0025] The control node sends the calculated concurrency instruction (control area 9, management information area 66) to the corresponding area of the detection node through an encrypted channel.

[0026] Step 3: Task Execution and Dynamic Adjustment After receiving the instructions, the probe node starts the vulnerability scanning task. The control node continuously monitors the status of each region through the load monitoring node: After 30 minutes of scanning execution, the load monitoring node feedback: the control area has a sudden surge in telemetry data volume due to line monitoring demand, CPU usage rate rises to 75%, and real-time task proportion rises to 80%; The control node immediately recalculates the control area concurrency: Load coefficient: 0.5 due to CPU usage rate 75%>70%; Network coefficient remains 1.1 (bandwidth utilization rate is still 42%≤50%), business coefficient remains 0.7 (real-time task proportion 80%>60%); New concurrency: 10×0.5×1.1×0.7≈3.85, rounded down to 4; The control node issues new instructions to the control area probe node within 5 seconds. After adjusting the concurrency, the control area CPU usage rate falls to 60% within 10 seconds, and the telemetry data transmission delay stabilizes within 50ms (meets the control area ≤100ms requirement).

[0027] Step 4: Emergency Task Access and Resource Preemption When scanning execution reaches the 45th minute, the system accesses an emergency task (0day vulnerability scanning for 5 SCADA servers in the control area, priority level 10), the execution process is as follows: The control node first calculates the "releasable concurrency" of the control area: the current concurrency is 4, the minimum guaranteed concurrency is 50% of the baseline concurrency (i.e. 10×50%=5), and the releasable concurrency = 4-5=-1 (the concurrency of regular tasks has fallen below the minimum guarantee value); According to the preset rules, one concurrency resource is pre-empted from the control area regular scanning task (to ensure that the emergency task can be started), and the emergency task concurrency is set to 1, and the regular task concurrency is temporarily reduced to 3; The emergency task is completed after 15 minutes of execution, and the control node immediately releases the pre-empted 1 concurrency resource, and the control area regular task concurrency is restored to 4.

[0028] Step 5: Cross-region Resource Coordination When scanning execution reaches the 2nd hour, the management information area task queue is stacked (100 terminals waiting for scanning, regular tasks are expected to be completed in 8 hours), the control node evaluates the state and executes coordinated scheduling: State evaluation: the current CPU usage rate of the management information area is 35% (≤80% safety threshold), the bandwidth utilization rate is 38% (≤70% safety threshold), and the resources are still idle; the control area regular task is only left 20% (expected to be completed in 1 hour); Resource adjustment: The control node increases the concurrent access capacity of the management information area from 66 to 70 (accounting for 55% of the total concurrent resources of the system), accelerating the processing queue; Scheduling results: Scanning tasks in the management information area are completed within 2 hours (originally 8 hours), routine tasks in the control area are completed within 4 hours (originally 6 hours), and cross-regional concurrent resource utilization has increased from 60% to 90%.

[0029] Dynamic threshold update (periodic optimization) At the end of each week, the control node optimizes the baseline concurrency and coefficient thresholds based on historical data from each region: If the CPU utilization rate of the control area is ≤30% during the off-peak period (2:00-4:00 AM) for three consecutive weeks, the baseline concurrency of the control area will be increased from 10 to 15 to make full use of idle resources; If the link bandwidth utilization rate in the non-control zone frequently exceeds 70% (≥10 times / week) within the month, the "reduction threshold" of the network coefficient will be lowered from 70% to 60% to avoid network congestion in advance.

[0030] Exception handling examples For abnormal scenarios that may occur in actual operation, the processing flow of this method is as follows (corresponding to claim 10): 3.1 Load data loss scenario: When a load monitoring node in a non-control area fails to synchronize data for 3 consecutive times (with an interval of 1 second): The control node automatically uses historical load data of the same period last week (same time period) in that area (such as CPU utilization of 40% and memory utilization of 55% in the same period last week) to estimate the concurrency; based on the historical data, the current concurrency in the non-control area is calculated to be 30×1.2×1.0×0.9=32.4 (rounded to 32), and an alarm is triggered at the same time (by pushing an SMS to the administrator through the power operation and maintenance platform); after the administrator investigates, it is found that the network of the load monitoring node is interrupted. After repair, the system automatically switches back to real-time data acquisition, and the concurrency is recalculated and stabilized at 33.

[0031] Scenario where probe node commands do not respond When the control area probe node fails to adjust the concurrency from 9 to 4 as instructed (no feedback within 10 seconds after the instruction is issued): the control node sends a forced adjustment instruction to the probe node through the backup channel (SMS instruction module) to set the concurrency to 4; after the instruction is executed, the control node records the deviation value (the delay from instruction issuance to actual adjustment is 12 seconds), and during the threshold optimization the following week, shortens the "instruction retry interval" of the probe node from 5 seconds to 3 seconds to avoid similar problems in the future.

[0032] When the scan task causes the control area telemetry data transmission delay to rise to 120 ms (exceeding the threshold of ≤100 ms): the control node immediately triggers the "emergency concurrency reduction" mechanism to reduce the control area concurrency to 1; after 30 seconds, the control node gradually restores the concurrency (1 per 10 seconds, in turn 2, 3, 4), while suspending the control area scan task for 30 minutes; after the scan is resumed, the telemetry data transmission delay stabilizes at 45 ms, and no over-limit situation occurs again.

[0033] Through the application of the above embodiments, the method achieves the following technical effects (compared with the prior art): Control area: the peak CPU usage rate during scanning is reduced from 90% to below 65%, the network bandwidth occupancy is ≤50%, the telemetry data transmission delay is reduced from 200 ms to within 50 ms, and no service interruption occurs; Management information area: the scanning efficiency is improved by 2 times (100 devices scanning time is shortened from 12 hours to 6 hours), and the concurrency resource utilization rate is improved from 30% to 90%; Emergency response: the emergency task response time is shortened from 4 hours to 30 minutes, meeting the compliance requirements of the power industry "15-minute emergency response"; Abnormal processing: the processing delay of load data loss, instruction non-response and other scenarios is ≤30 seconds, the business impact range is controlled within a single area, and there is no cross-area fault diffusion.

[0034] Finally, it should be pointed out that the above detailed description of the method and device is only an embodiment, and those skilled in the art can modify the embodiments in different ways without departing from the scope of the present application.

Claims

1. An adaptive scanning concurrency adjustment method under microgrid isolation, characterized in that: The method comprises the following steps: Step S1, deploying load monitoring nodes in the control area, non-control area and management information area respectively, and collecting the service load and network state data of each area in real time through the load monitoring nodes; Step S2, constructing a concurrency number calculation formula based on the collected service load and network state data, wherein the concurrency number calculation formula is current concurrency number = benchmark concurrency number × load coefficient × network coefficient × service coefficient, wherein the benchmark concurrency number is preset according to the service priority of each area, the load coefficient is determined according to the server load state, the network coefficient is determined according to the network transmission state, and the service coefficient is determined according to the real-time demand of the service; Step S3, calculating the current concurrency number of each area according to the concurrency number calculation formula, and downlinking the calculated current concurrency number to the detection nodes of each area, so that the detection nodes perform the vulnerability scanning task according to the current concurrency number; Step S4, continuously monitoring the changes of the service load and network state of each area through the load monitoring nodes during the scanning task execution process, and when the changes exceed the preset threshold, recalculating the current concurrency number and downlinking it to the detection nodes to realize the dynamic adjustment of the concurrency number; Step S5, when an emergency scanning task is accessed, calculating the releasable concurrency number based on the current concurrency number and the minimum guarantee concurrency number of each area, and allocating a preset proportion of the releasable concurrency number from the regular scanning task to the emergency scanning task, and releasing the occupied concurrency number to the regular scanning task pool after the completion of the emergency scanning task; Step S6, for the multi-area scanning task queuing scene, allocating concurrency resources based on the "service importance-scanning urgency" matrix to realize the cooperative scheduling of cross-area concurrency resources.

2. The method for adaptive scan concurrent number adjustment under microgrid isolation according to claim 1, characterized in that: The service load and network state data collected by the load monitoring nodes in step S1 include four types of key indicators, namely server load indicators, network state indicators, service real-time indicators and task queue indicators, the collection period of the load monitoring nodes is 1-10 seconds, and the collected data is synchronized to the control node deployed in the headquarters security management area in real time.

3. The method of claim 2, wherein: The benchmark concurrency number in step S2 is set according to the service priority of each area, wherein the benchmark concurrency number of the control area is set to 10, the benchmark concurrency number of the non-control area is set to 30, and the benchmark concurrency number of the management information area is set to 50.

4. The method of claim 3, wherein: The load coefficient in step S2 is determined according to the CPU usage rate and memory usage rate in the server load indicators: when the CPU usage rate ≤ 50% and the memory usage rate ≤ 60%, the load coefficient is 1.2; when 50% < CPU usage rate ≤ 70% or 60% < memory usage rate ≤ 80%, the load coefficient is 1.0; when CPU usage rate > 70% or memory usage rate > 80%, the load coefficient is 0.

5.

5. The method of claim 4, wherein: The network coefficient in step S2 is determined according to the link bandwidth utilization and the packet loss rate in the network state index: when the link bandwidth utilization is less than or equal to 50% and the packet loss rate is less than or equal to 3%, the network coefficient is 1.1; when 50% < link bandwidth utilization < 70% or 3% < packet loss rate < 5%, the network coefficient is 1.0; when the link bandwidth utilization is greater than 70% or the packet loss rate is greater than 5%, the network coefficient is 0.

8.

6. The method of claim 5, wherein: The service coefficient in step S2 is determined according to the real-time task proportion in the real-time service index: when the real-time task proportion is less than or equal to 30%, the service coefficient is 1.0; when 30% < real-time task proportion < 60%, the service coefficient is 0.9; when the real-time task proportion is greater than 60%, the service coefficient is 0.

7.

7. The method of claim 6, wherein: Step S4 further includes a dynamic threshold updating step, which optimizes the determination threshold of the benchmark concurrency and each coefficient based on the historical acquisition data of each region every week: if the CPU usage rate of the control area is less than or equal to 30% for three consecutive weeks in the low peak period, the benchmark concurrency of the control area is increased from 10 to 15; if the link bandwidth utilization of the non-control area frequently exceeds 70%, the "decrease threshold" in the network coefficient is decreased from 70% to 60%.

8. The method of claim 7, wherein: In step S5, the priority of the emergency scanning task is marked as level 10, and the priority of the regular scanning task is marked as level 5; the minimum guaranteed concurrency is 50% of the benchmark concurrency of the corresponding region; the proportion of the releasable concurrency seized from the regular scanning task is 30%, and after the completion of the emergency scanning task, the seized concurrency is immediately released back to the regular scanning task pool.

9. The method of claim 8, wherein: In step S6, the resource allocation ratio of the "service importance-scanning urgency" matrix is as follows: the task with high importance and high urgency is allocated 40% of the total concurrency resources, the task with high importance and medium urgency is allocated 25% of the total concurrency resources, the task with medium importance and high urgency is allocated 20% of the total concurrency resources, the task with medium importance and medium urgency is allocated 10% of the total concurrency resources, and the task with low importance and high or medium urgency is allocated 5% of the total concurrency resources; wherein the control area is a high importance area, the non-control area is a medium importance area, and the management information area is a low importance area.

10. The method of claim 9, wherein: When the load data is lost for three consecutive times, the control node estimates the current concurrency based on the historical synchronous data of the region and triggers an alarm; when the detection node does not adjust the concurrency as instructed, the control node sets the concurrency through a backup channel and records the deviation value for subsequent threshold optimization; when the scanning task causes the business delay of the control area to exceed 100ms, the concurrency of the control area is immediately reduced to 1, and the concurrency is gradually restored after 30 seconds, while the scanning task is suspended for 30 minutes.

Images