Sandbox virtual machine scheduling method and device based on large language model

Abstract

This application provides a sandbox virtual machine scheduling method and apparatus based on a large language model, relating to the field of computer technology. The method includes: upon receiving a task request, performing metadata extraction and feature analysis on the target task to obtain a structured task object corresponding to the target task; the task object includes: metadata and task features; acquiring the current running state of the system and the text description corresponding to the target task, and using a large language model to perform semantic analysis and reasoning on the current running state, text description, and task object to generate a target scheduling plan; and scheduling virtual machines to execute the target task based on the target scheduling plan. The sandbox virtual machine scheduling method and apparatus based on a large language model provided in this application can not only dynamically allocate virtual machines according to task semantics and risk, but also optimize the scheduling strategy through self-learning via task execution feedback, thereby improving resource utilization and scheduling efficiency while ensuring system security.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a sandbox virtual machine scheduling method and apparatus based on a large language model. Background Technology

[0002] With the increasing complexity of cyber threats and the explosive growth in the number of unknown attack samples, security vendors are widely adopting sandboxing technology for dynamic behavioral analysis to identify potential malicious behaviors.

[0003] However, with the rapid increase in the amount of tasks, the scheduling algorithm of the virtual machine (VM) scheduling mechanism in the traditional sandbox system is fixed, lacks self-learning ability and adaptability, and cannot cope with the massive task requirements. Summary of the Invention

[0004] The purpose of this application is to provide a sandbox virtual machine scheduling method and apparatus based on a large language model. It can not only dynamically allocate virtual machines according to task semantics and risks, and support the isolation and safe grouping of high-risk tasks, but also optimize the scheduling strategy through self-learning through task execution feedback, so as to improve resource utilization and scheduling efficiency while ensuring system security.

[0005] This application provides a sandbox virtual machine scheduling method based on a large language model, including:

[0006] Upon receiving a task request, metadata extraction and feature analysis are performed on the target task to obtain a structured task object corresponding to the target task. The task object includes metadata and task features. The current running state of the system and the text description corresponding to the target task are obtained, and semantic analysis and reasoning are performed on the current running state, the text description, and the task object using a large language model to generate a target scheduling plan. The virtual machine is scheduled to execute the target task based on the target scheduling plan. The prompt words of the large language model are generated based on a dynamic prompt word concatenation mechanism. The dynamic prompt word concatenation mechanism includes standardizing the model input through structured templates based on task context, system state, and historical execution feedback.

[0007] Optionally, the metadata includes at least one of the following: filename, size, MIME type, submission source, and timestamp; the task features include: static features, intelligence tags, and task priority; the static features include at least one of the following: executable file header information, macro script tags, suspicious strings, and network address; the intelligence tags are used to characterize the risk level of the target task.

[0008] Optionally, the step of performing metadata extraction and feature analysis on the target task to obtain the structured task object corresponding to the target task includes: extracting metadata from the target task and extracting static features through a parser to obtain the static features of the target task; and using a feature scoring model to perform risk labeling on the target task based on the extracted static features to obtain the intelligence tag of the target task.

[0009] Optionally, scheduling virtual machines to execute the target task based on the target scheduling plan includes: generating standardized scheduling instruction objects based on the target scheduling plan, and matching corresponding target virtual machine instances in the resource pool based on the scheduling instruction objects; the scheduling instruction objects include: target virtual machine group number, resource weight, and parallelism control; and using an isolation strategy corresponding to the risk level represented by the intelligence tag to call the target virtual machine instance to execute the target task; wherein, when the risk level represented by the intelligence tag is high-risk, execution is performed in a completely isolated virtual network and independent disk snapshot; when the risk level represented by the intelligence tag is normal, execution is performed in a controlled manner in a shared resource pool.

[0010] Optionally, the method further includes: during the execution of the target task, evaluating the node resource consumption trend and task execution efficiency, generating a resource utilization report, and providing contextual information to the large language model based on the resource utilization report to optimize the subsequently generated scheduling plan; after the target task is completed, summarizing the execution results, performance indicators, and behavior logs to generate task execution feedback, and adjusting the prompt template based on the task execution feedback to achieve self-learning and continuous optimization of the scheduling strategy; wherein the task execution feedback includes at least one of the following: task time, abnormal events, resource utilization, and execution status code.

[0011] Optionally, the dynamic prompt word concatenation mechanism includes: determining a basic template corresponding to the task type of the target task; the basic template includes: a fixed instruction part for defining the model role and output format, and a dynamic slot for injecting metadata; concatenating historical execution feedback and system state snapshots into semantically continuous context information, and concatenating prompt words for the large language model based on the basic template and the context information.

[0012] This application also provides a sandbox virtual machine scheduling device based on a large language model, including:

[0013] An information extraction module is used to extract metadata and perform feature analysis on the target task upon receiving a task request, thereby obtaining a structured task object corresponding to the target task. The task object includes metadata and task features. A plan generation module is used to obtain the current running state of the system and the text description corresponding to the target task, and to perform semantic analysis and reasoning on the current running state, the text description, and the task object using a large language model to generate a target scheduling plan. A plan execution module is used to schedule a virtual machine to execute the target task based on the target scheduling plan. The prompt words of the large language model are generated based on a dynamic prompt word concatenation mechanism. The dynamic prompt word concatenation mechanism includes standardizing the model input through structured templates based on task context, system state, and historical execution feedback.

[0014] Optionally, the metadata includes at least one of the following: filename, size, MIME type, submission source, and timestamp; the task features include: static features, intelligence tags, and task priority; the static features include at least one of the following: executable file header information, macro script tags, suspicious strings, and network address; the intelligence tags are used to characterize the risk level of the target task.

[0015] Optionally, the information extraction module is specifically used to extract metadata from the target task and extract static features through a parser to obtain the static features of the target task; the information extraction module is also specifically used to perform risk labeling on the target task based on the extracted static features using a feature scoring model to obtain the intelligence tag of the target task.

[0016] Optionally, the plan execution module is specifically used to generate standardized scheduling instruction objects based on the target scheduling plan, and to match corresponding target virtual machine instances in the resource pool based on the scheduling instruction objects; the scheduling instruction objects include: target virtual machine group number, resource weight, and parallelism control; the plan execution module is specifically used to call the target virtual machine instance to execute the target task using an isolation strategy corresponding to the risk level represented by the intelligence tag; wherein, when the risk level represented by the intelligence tag is high-risk task, execution is carried out in a completely isolated virtual network and independent disk snapshot; when the risk level represented by the intelligence tag is normal task, execution is carried out in a controlled manner in a shared resource pool.

[0017] Optionally, the device further includes: a feedback module; the feedback module is used to evaluate the node resource consumption trend and task execution efficiency during the execution of the target task, generate a resource utilization report, and provide contextual information to the large language model based on the resource utilization report to optimize the subsequently generated scheduling plan; the feedback module is also used to summarize the execution results, performance indicators, and behavior logs after the target task is completed to generate task execution feedback, and adjust the prompt template based on the task execution feedback to achieve self-learning and continuous optimization of the scheduling strategy; wherein, the task execution feedback includes at least one of the following: task time, abnormal events, resource utilization, and execution status code.

[0018] Optionally, the apparatus further includes: a prompt word generation module; the prompt word generation module is used to determine a basic template corresponding to the task type of the target task; the basic template includes: a fixed instruction part for defining the model role and output format, and a dynamic slot for injecting metadata; the prompt word generation module is also used to concatenate historical execution feedback and system state snapshots into semantically continuous context information, and concatenate the prompt words of the large language model based on the basic template and the context information.

[0019] This application also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the sandbox virtual machine scheduling method based on any of the above-described large language models.

[0020] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of any of the above-described sandbox virtual machine scheduling methods based on a large language model.

[0021] This application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the sandbox virtual machine scheduling method based on any of the above-described methods.

[0022] The sandbox virtual machine scheduling method and apparatus based on a large language model provided in this application firstly extracts metadata and performs feature analysis on the target task upon receiving a task request, obtaining a structured task object corresponding to the target task. The task object includes metadata and task features. Next, it acquires the current running state of the system and the text description corresponding to the target task, and uses a large language model to perform semantic analysis and reasoning on the current running state, the text description, and the task object to generate a target scheduling plan. Finally, it schedules virtual machines to execute the target task based on the target scheduling plan. The prompt words of the large language model are generated based on a dynamic prompt word concatenation mechanism. This dynamic prompt word concatenation mechanism includes standardizing the model input through structured templates based on task context, system state, and historical execution feedback. This not only enables dynamic allocation of virtual machines according to task semantics and risk, supporting the isolation and safe grouping of high-risk tasks, but also allows for self-learning and optimization of scheduling strategies through task execution feedback, improving resource utilization and scheduling efficiency while ensuring system security. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a schematic diagram of the structure of the sandbox virtual machine scheduling system based on a large language model provided in this application;

[0025] Figure 2 This is one of the flowcharts of the sandbox virtual machine scheduling method based on a large language model provided in this application;

[0026] Figure 3 This is the second flowchart of the sandbox virtual machine scheduling method based on a large language model provided in this application;

[0027] Figure 4 This is a schematic diagram of the structure of the sandbox virtual machine scheduling device based on a large language model provided in this application;

[0028] Figure 5 This is a schematic diagram of the structure of the electronic device provided in this application. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0030] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0031] The virtual machine scheduling methods in related technologies have the following shortcomings:

[0032] 1. Fixed scheduling algorithms, lacking adaptability: Most existing systems allocate resources based on resource weights or static priority strategies, unable to dynamically adjust according to the complexity or risk level of the task content. 2. Lack of semantic understanding: The scheduling system cannot understand the semantic characteristics of tasks (e.g., whether the task is malicious sample analysis, reverse testing, or system vulnerability reproduction), leading to unreasonable resource allocation. 3. Insufficient security risk awareness: When tasks have high-risk or high-consumption characteristics, the scheduling system cannot isolate or differentiate deployments, easily causing security vulnerabilities or performance bottlenecks. 4. Lack of self-learning capability: Traditional systems cannot automatically optimize scheduling strategies based on task execution feedback, resulting in long-term system inefficiency.

[0033] To address the aforementioned technical problems in related technologies, this application provides a sandbox virtual machine scheduling method based on a large language model. This method can not only dynamically allocate virtual machines according to task semantics and risks, and support the isolation and safe grouping of high-risk tasks, but also optimize the scheduling strategy through self-learning based on task execution feedback, thereby improving resource utilization and scheduling efficiency while ensuring system security.

[0034] For example, this method is applied to a sandbox virtual machine scheduling system based on a large language model, such as... Figure 1As shown, the system includes a task access unit, a scheduling decision unit, a virtual machine execution unit, and a monitoring feedback unit. The task access unit, as the system's entry point, is responsible for receiving task requests from external clients or internal analysis systems and standardizing them into structured task objects recognizable by the system. The scheduling decision unit is the intelligent core of the entire system, responsible for semantically fusing and analyzing task characteristics with system operating status and generating the optimal virtual machine scheduling plan. The virtual machine execution unit is responsible for selecting and scheduling appropriate sandbox virtual machine nodes to execute tasks according to the scheduling instructions generated by the scheduling decision unit, and is a key link connecting the intelligent scheduling layer and the actual execution layer. The monitoring feedback unit is the nerve center of this system, responsible for real-time perception and analysis of performance, behavior, and security status throughout the entire task execution process, and providing structured feedback of the monitoring data to the scheduling decision unit, providing basic support for subsequent self-learning optimization.

[0035] The sandbox virtual machine scheduling method based on a large language model provided in this application will be described in detail below with reference to the accompanying drawings, through specific embodiments and application scenarios.

[0036] like Figure 2 As shown in the embodiment of this application, a sandbox virtual machine scheduling method based on a large language model is provided. This method may include the following steps 201 to 203:

[0037] Step 201: Upon receiving a task request, perform metadata extraction and feature analysis on the target task to obtain the structured task object corresponding to the target task.

[0038] The task object includes: metadata and task characteristics. The metadata includes at least one of the following: filename, size, MIME type, submission source, and timestamp; the task characteristics include: static characteristics, intelligence tags, and task priority; the static characteristics include at least one of the following: executable file header information, macro script tags, suspicious strings, and network address; the intelligence tags are used to characterize the risk level of the target task.

[0039] Specifically, step 201 above may also include the following steps 201a1 and 201a2:

[0040] Step 201a1: Extract metadata from the target task and extract static features through a parser to obtain the static features of the target task.

[0041] Step 201a2: Based on the extracted static features, the target task is risk-labeled using a feature scoring model to obtain the intelligence label of the target task.

[0042] For example, when a new analysis task arrives, the task access unit first performs identity verification and rate control on the request to prevent unauthorized access and overloaded submissions. After successful verification, the system begins file reception and hash calculation. The access unit calculates the SHA-256 hash in real time during data stream reading for task deduplication and consistency verification. If a task record with the same hash already exists in the system, the historical task number is directly returned, achieving idempotent access.

[0043] Next, the task access unit performs metadata extraction and static feature analysis. Basic attributes (filename, size, MIME type, submission source, timestamp, etc.) are parsed from the task, and a lightweight parser extracts file structure and static features, such as executable file header information, macro script markers, suspicious strings, and network addresses. After static feature extraction, the unit calls the intelligence enhancement and risk prediction component to perform threat intelligence comparison on the task hash (e.g., matching blacklists, malicious sample libraries, etc.), and performs preliminary risk labeling (unknown / high-risk / normal / low-risk) based on a feature scoring model. On this basis, the system semantically encapsulates the task according to its type, risk level, and submission source, generating a structured task object in a unified format. This object contains metadata, static features, intelligence tags, preliminary priority, and other information, serving as input for subsequent scheduling decision-making units.

[0044] Step 202: Obtain the current running status of the system and the text description corresponding to the target task, and use a large language model to perform semantic analysis and reasoning on the current running status, the text description, and the task object to generate a target scheduling plan.

[0045] For example, when the task access unit submits a new task object, the scheduling decision unit first retrieves the task to be scheduled from the task queue and calls the system monitoring interface to obtain a snapshot of the current cluster's resource status, including real-time metrics such as CPU, memory, disk I / O, GPU utilization, network latency, and task load of each node.

[0046] Next, the unit enters the semantic understanding and task intent recognition stage. By calling the Large Language Model (LLM), the system performs semantic reasoning on the task's structured metadata and text description (such as task tags, sample types, source intelligence, etc.), and automatically identifies the task's technical category (such as static analysis, behavior reproduction, memory forensics, vulnerability reproduction, etc.) and its potential security risk level.

[0047] For example, when LLM identifies that "the task contains driver loading and system call tracing requests", it can infer that it belongs to a high-resource-consuming behavior analysis task.

[0048] Specifically, step 202 above, which involves scheduling the virtual machine to execute the target task based on the target scheduling plan, may further include steps 202a1 and 202a2:

[0049] Step 202a1: Generate a standardized scheduling instruction object based on the target scheduling plan, and match the corresponding target virtual machine instance in the resource pool based on the scheduling instruction object.

[0050] The scheduling instruction object includes: target virtual machine group number, resource weight, and parallelism control.

[0051] Step 202a2: Using an isolation strategy corresponding to the risk level represented by the intelligence tag, the target virtual machine instance is invoked to execute the target task.

[0052] Specifically, when the risk level represented by the intelligence tag is high-risk, the task is executed in a completely isolated virtual network and independent disk snapshot; when the risk level represented by the intelligence tag is normal, the task is executed in a controlled manner in a shared resource pool.

[0053] For example, after the scheduling plan is generated, the scheduling decision unit will finally output a standardized scheduling plan object, which includes parameters such as the target virtual machine group number, resource weight, execution priority, parallelism control, and security tags. The plan object is then passed to the virtual machine execution unit for task allocation.

[0054] In addition, the scheduling unit records each model decision and actual execution result as sample data for subsequent model fine-tuning and self-learning optimization. By monitoring the task execution performance and result indicators returned by the feedback unit, the system can periodically and adaptively update the LLM prompt template and policy generation parameters, achieving continuous evolution of decision-making capabilities.

[0055] Step 203: Schedule the virtual machine to execute the target task based on the target scheduling plan.

[0056] The prompt words of the large language model are generated based on a dynamic prompt word concatenation mechanism. The dynamic prompt word concatenation mechanism includes standardizing the model input through structured templates based on task context, system state, and historical execution feedback.

[0057] For example, after the scheduling plan is issued, the virtual machine decision unit first searches for eligible virtual machine instances in the resource pool based on the target virtual machine group, resource weight, and security level specified in the instruction. If there are no available resources in the target node group, the system can automatically trigger the creation of lightweight virtual machine instances or the dynamic launch of containerized sandbox nodes according to the preset expansion strategy to achieve elastic scaling. After task allocation, the unit enters the task deployment and environment isolation phase. Depending on the risk level of the task, the system selects different levels of execution isolation strategies: for high-risk tasks (such as unknown executable files, system drivers, kernel units, etc.), execution is carried out in a completely isolated virtual network and independent disk snapshot, prohibiting external communication; for ordinary analysis tasks, they are run in a controlled manner in a shared resource pool to improve overall resource utilization. The execution unit also supports parallel and distributed execution strategies. When the scheduling instruction marks a task as splittable or reproducible, the unit can automatically allocate the same task to multiple virtual machines for parallel execution to accelerate analysis or achieve diversity comparison. At the same time, the system supports unified recycling of task replicas and result aggregation to avoid resource leakage. After the task is executed, the unit triggers a result collection and environment rollback mechanism. All outputs (execution logs, analysis reports, system snapshots, network traffic packets, etc.) will be packaged and reported uniformly, and their long-term retention or archiving will be determined based on task policies. Subsequently, the virtual machine will automatically roll back to a secure snapshot state to ensure the purity of the execution environment and the security of subsequent tasks. Throughout the process, the virtual machine execution unit and the scheduling unit maintain asynchronous communication, transmitting state changes and abnormal events through an event bus (such as NATS, Kafka), enabling traceability and auditability of the task lifecycle. Execution anomalies (such as task freezes, resource overflows, sandbox escape detection) will immediately trigger the anomaly rollback mechanism and be reported, ensuring system stability and security.

[0058] Optionally, in this embodiment, a monitoring feedback unit can also be used to perceive and analyze the performance, behavior and security status in real time throughout the entire task execution process, and the monitoring data can be structured and fed back to the scheduling decision unit to provide basic support for subsequent self-learning optimization.

[0059] For example, the sandbox virtual machine scheduling method based on a large language model provided in this application embodiment may further include the following steps 204 and 205:

[0060] Step 204: During the execution of the target task, evaluate the node resource consumption trend and task execution efficiency, generate a resource utilization report, and provide contextual information for the large language model based on the resource utilization report to optimize the subsequently generated scheduling plan.

[0061] Step 205: After the target task is completed, summarize the execution results, performance indicators, and behavior logs to generate task execution feedback, and adjust the prompt template based on the task execution feedback to achieve self-learning and continuous optimization of the scheduling strategy.

[0062] The task execution feedback includes at least one of the following: task time, abnormal events, resource utilization, and execution status code.

[0063] For example, after a task starts, the system automatically injects a lightweight monitoring agent (MonitorAgent) into the virtual machine. This agent works in conjunction with the host supervisor to collect operational metrics from both the virtual machine and the host layer. The monitoring scope covers key dimensions such as CPU, memory, I / O, network traffic, system calls, file operations, and process tree changes. All collected data is streamed to the central monitoring service in time-series format. During task execution, the monitoring feedback unit is also responsible for performance trend analysis and resource prediction. The system dynamically evaluates node resource consumption trends and task execution efficiency by modeling historical execution data over time, and generates a resource utilization report. This report is periodically transmitted to the scheduling unit, providing the large language model with the latest system context information for optimal task allocation and risk prediction.

[0064] For example, upon task completion, the monitoring unit summarizes the execution results, performance metrics, and behavior logs to generate a standardized feedback object, which includes task duration, exception events, resource utilization, and execution status codes. This feedback object is asynchronously transmitted to the scheduling decision unit via a message queue. The latter fine-tunes the LLM's prompt template or internal parameters based on the feedback, thereby achieving self-learning and continuous optimization of the scheduling strategy. Furthermore, the monitoring feedback unit possesses auditing and visualization capabilities. All task lifecycle data (including scheduling decisions, execution trajectories, and exception reports) is recorded in the log database, allowing for task tracing, performance analysis, and security posture assessment through a visualization panel. This mechanism not only enhances system transparency but also provides data support for subsequent model optimization and exception review.

[0065] For example, to ensure that the large language model can accurately understand the task intent and generate the optimal scheduling strategy, the system designs a dynamic prompt concatenation mechanism during the semantic analysis stage.

[0066] For example, the sandbox virtual machine scheduling method based on a large language model provided in this application embodiment may further include the following steps 206 and 207:

[0067] Step 206: Determine the basic template corresponding to the task type of the target task.

[0068] The basic template includes: a fixed instruction section for defining model roles and output formats, and a dynamic slot for injecting metadata.

[0069] Step 207: Concatenate the historical execution feedback and system state snapshot into semantically continuous contextual information, and concatenate the prompt words of the large language model based on the basic template and the contextual information.

[0070] For example, this mechanism uses task context, system state, and historical feedback as core elements, and achieves standardization and interpretability of model input through structured templates. When generating prompts, the system first selects the corresponding basic template based on the task type, which includes fixed instructions that define the model role and output format, such as "You are an intelligent sandbox scheduling engine, and you need to generate a JSON-formatted scheduling strategy based on task information and system state." At the same time, dynamic slots are reserved in the template for injecting real-time task metadata (such as filename, hash, MIME type, risk level, submission source, etc.) and cluster resource snapshots (CPU, memory, I / O, GPU utilization, network load, etc.). When constructing the prompts, the system sequentially concatenates task feature summaries, static and dynamic risk assessment results, resource status snapshots, and historical execution feedback into semantically continuous contextual information. This input is presented in a hybrid format of natural language and structured data, as shown in the example: "Task file ample.exe, type PE, initial risk high; current node Node-3 has 85% CPU utilization and 70% memory usage; the last similar task was successfully executed on Node-4, taking 12 seconds." The scheduling module adjusts the weights of key instructions in the prompts based on risk level and resource pressure. For example, it strengthens the security isolation priority description for high-risk tasks and adds a sufficient schedulable resource marker to lightly loaded nodes, thereby guiding the model to generate more targeted policy outputs. Finally, the system inputs the concatenated prompts into the LLM, which generates a structured policy response (including target node, priority, parallelism, security isolation level, etc.). After legality verification and rule constraint validation at the parsing layer, it is transformed into a standardized scheduling instruction object and sent to the virtual machine execution module, achieving an integrated closed loop of prompt generation, semantic reasoning, and policy implementation.

[0071] For example, in this embodiment, the accuracy of the task analysis results and the optimization of the model strategy are performed based on the execution data (including task execution time, system resource consumption, abnormal behavior records, and threat detection results) provided by the monitoring feedback unit. After receiving this feedback, the scheduling unit uses a built-in self-learning mechanism to fine-tune the task allocation strategy and virtual machine scheduling model. For example, when a certain type of task consistently exhibits low accuracy or high anomaly rate on a specific virtual machine type, the system will automatically adjust its allocation weight; conversely, when the detection model consistently performs well on a certain task type, its priority will be increased. Through this continuous feedback-adjustment closed loop, the system can achieve adaptive optimization of the virtual machine scheduling and analysis model, continuously improving the overall accuracy of task analysis and resource utilization efficiency.

[0072] For example, such as Figure 3 The following are the detailed steps of the sandbox virtual machine scheduling method based on a large language model provided in this application embodiment:

[0073] 1. Users upload task files and related request information through the client or API.

[0074] 2. The task access unit performs identity verification and rate limiting on upload requests to prevent unauthorized access and task overload.

[0075] 3. During the file reception process, the system calculates the SHA-256 hash value in real time for deduplication and integrity verification.

[0076] 4. If the hash already exists in the history, the system returns the task number and terminates the repeated execution; otherwise, continue to the next step.

[0077] 5. Extract task metadata from the unit, including file name, size, MIME type, submission source, and threat tags.

[0078] 6. Perform lightweight static feature extraction on the file, such as PE file header, macro script markers, suspicious strings, memory image structure, etc.

[0079] 7. The system compares hashes or features with the intelligence database to generate a preliminary risk assessment (unknown, high-risk, normal, or low-risk).

[0080] 8. Encapsulate the data into standardized task objects and enqueue them into the task scheduling queue.

[0081] 9. The scheduling unit retrieves task objects from the queue and simultaneously collects a snapshot of the current cluster status, including CPU, memory, I / O, GPU utilization, network load, and task status of each node.

[0082] 10. The scheduling unit calls the LLM to perform semantic understanding of the task metadata and text description, and to determine the task type, potential risk level and resource consumption characteristics.

[0083] 11. Based on the semantic analysis results and system status, LLM generates scheduling policies, including target virtual machine nodes or node groups, resource allocation weights, execution priorities, parallelism, and security isolation levels.

[0084] 12. After the strategy is generated, the rules are verified through the strategy constraint layer to ensure compliance with node availability, security isolation strategies and task dependency constraints.

[0085] 13. After successful verification, a scheduling instruction object is generated and sent to the virtual machine execution unit.

[0086] 14. The virtual machine execution unit selects or creates a suitable virtual machine instance according to the scheduling instructions to execute the task.

[0087] 15. Set isolation policies according to the task risk level. High-risk tasks are executed in virtual machines isolated by independent network and storage space, while ordinary tasks are executed in a controlled manner in a shared resource pool.

[0088] 16. After the task is deployed, the virtual machine execution unit starts the task and records a snapshot of the execution environment.

[0089] 17. Supports parallel task execution and distributed reproduction. Similar tasks can be assigned to multiple nodes for parallel execution, and the system automatically aggregates and collects the results.

[0090] 18. All execution logs, snapshots, and intermediate data are continuously recorded for backtracking and analysis.

[0091] 19. The monitoring agent collects task execution data inside the virtual machine and at the host layer, including CPU, memory, I / O, network traffic, system calls, process tree, file operations, etc.

[0092] 20. The behavior anomaly detection subsystem detects crashes, freezes, resource preemption, and high-risk behaviors (such as sandbox escape and unauthorized network access) in real time.

[0093] 21. Performance trend analysis predicts resource consumption and node load based on historical data, providing dynamic context information for LLM.

[0094] 22. All data is organized into standardized feedback objects and asynchronously transmitted to the scheduling unit via a message queue.

[0095] 23. The scheduling unit receives feedback objects and evaluates the task execution results and performance indicators, including task analysis accuracy, resource utilization, and abnormal event rate.

[0096] 24. The system dynamically fine-tunes the LLM scheduling strategy and prompt templates based on the evaluation results, and adjusts the task allocation weights, node selections, and priorities.

[0097] 25. Complete the self-learning loop, optimize overall task processing efficiency and system performance, and continuously improve the accuracy of virtual machine scheduling and analysis results.

[0098] The sandbox virtual machine scheduling method based on a large language model provided in this application introduces semantic understanding capabilities through the large language model, enabling the scheduling system to automatically determine task type, risk level, and resource requirements based on task metadata and context information, thereby generating accurate scheduling strategies. Compared to traditional static priority or weight scheduling algorithms, this system can dynamically adapt to task characteristics, significantly improving the rationality of task allocation and the intelligence level of scheduling decisions. The system collects task execution results, resource usage, and abnormal events in real time through a monitoring feedback unit and feeds the data back to the scheduling unit. The scheduling strategy is automatically fine-tuned based on this feedback, achieving continuous self-learning and optimization. Compared to existing static scheduling strategies, this invention can continuously iterate and optimize during task execution, improving long-term execution efficiency and task analysis accuracy. The scheduling unit dynamically allocates virtual machine resources based on task complexity, resource consumption prediction, and node load, supporting parallel and distributed execution while avoiding node overload and resource waste. Compared to traditional fixed allocation methods, it can significantly reduce CPU / GPU idle rate and resource contention, improving system throughput and overall utilization efficiency. The system can automatically isolate virtual machines, execute high-risk tasks independently, and perform snapshot rollback based on task risk levels. For high-risk tasks, network access or resource sharing with other tasks is prohibited to reduce the risk of cross-infection and escape. Compared with existing technologies, this system provides more reliable security guarantees in terms of task isolation, anomaly handling, and environment rollback. This invention is applicable to various distributed sandbox systems, cloud security analysis platforms, and automated threat detection centers. The system's modular design supports node expansion, parallel analysis, multi-type task processing, and access to diverse virtual machine environments, exhibiting high scalability and good cross-platform applicability.

[0099] The sandbox virtual machine scheduling method based on a large language model provided in this application firstly extracts metadata and performs feature analysis on the target task upon receiving a task request, obtaining a structured task object corresponding to the target task. The task object includes metadata and task features. Next, it acquires the current running state of the system and the text description corresponding to the target task, and uses a large language model to perform semantic analysis and reasoning on the current running state, the text description, and the task object to generate a target scheduling plan. Finally, it schedules virtual machines to execute the target task based on the target scheduling plan. The prompt words of the large language model are generated based on a dynamic prompt word concatenation mechanism. This dynamic prompt word concatenation mechanism includes standardizing model input through structured templates based on task context, system state, and historical execution feedback. This not only enables dynamic allocation of virtual machines according to task semantics and risk, supporting the isolation and safe grouping of high-risk tasks, but also allows for self-learning and optimization of scheduling strategies through task execution feedback, improving resource utilization and scheduling efficiency while ensuring system security.

[0100] It should be noted that the sandbox virtual machine scheduling method based on a large language model provided in this application can be executed by a sandbox virtual machine scheduling device based on a large language model, or by a control module within that device for executing the sandbox virtual machine scheduling method based on a large language model. This application uses the execution of the sandbox virtual machine scheduling method based on a large language model by a sandbox virtual machine scheduling device as an example to illustrate the sandbox virtual machine scheduling device based on a large language model provided in this application.

[0101] It should be noted that, in the embodiments of this application, the sandbox virtual machine scheduling methods based on large language models shown in the accompanying drawings are all illustrated by way of example with reference to one of the accompanying drawings in the embodiments of this application. In specific implementation, the sandbox virtual machine scheduling methods based on large language models shown in the accompanying drawings of the above methods can also be implemented in conjunction with any other accompanying drawings that can be combined with the above embodiments, which will not be elaborated here.

[0102] The sandbox virtual machine scheduling device based on a large language model provided in this application is described below. The sandbox virtual machine scheduling method based on a large language model described above can be referred to in correspondence with the following description.

[0103] Figure 4 A schematic diagram of the structure of the sandbox virtual machine scheduling device based on a large language model provided in the embodiments of this application is shown below. Figure 4 As shown, it specifically includes:

[0104] Information extraction module 401 is used to extract metadata and perform feature analysis on the target task upon receiving a task request, thereby obtaining a structured task object corresponding to the target task; the task object includes: metadata and task features; plan generation module 402 is used to obtain the current running state of the system and the text description corresponding to the target task, and to perform semantic analysis and reasoning on the current running state, the text description, and the task object using a large language model to generate a target scheduling plan; plan execution module 403 is used to schedule the virtual machine to execute the target task based on the target scheduling plan; wherein, the prompt words of the large language model are generated based on a dynamic prompt word concatenation mechanism; the dynamic prompt word concatenation mechanism includes: standardizing the model input through structured templates based on task context, system state, and historical execution feedback.

[0105] Optionally, the metadata includes at least one of the following: filename, size, MIME type, submission source, and timestamp; the task features include: static features, intelligence tags, and task priority; the static features include at least one of the following: executable file header information, macro script tags, suspicious strings, and network address; the intelligence tags are used to characterize the risk level of the target task.

[0106] Optionally, the information extraction module 401 is specifically used to extract metadata from the target task and extract static features through a parser to obtain the static features of the target task; the information extraction module 401 is also specifically used to perform risk labeling on the target task based on the extracted static features using a feature scoring model to obtain the intelligence label of the target task.

[0107] Optionally, the plan execution module 403 is specifically used to generate standardized scheduling instruction objects based on the target scheduling plan, and to match corresponding target virtual machine instances in the resource pool based on the scheduling instruction objects; the scheduling instruction objects include: target virtual machine group number, resource weight, and parallelism control; the plan execution module 403 is specifically used to call the target virtual machine instance to execute the target task using an isolation strategy corresponding to the risk level represented by the intelligence tag; wherein, when the risk level represented by the intelligence tag is high-risk task, execution is carried out in a completely isolated virtual network and independent disk snapshot; when the risk level represented by the intelligence tag is ordinary task, execution is carried out in a controlled manner in a shared resource pool.

[0108] Optionally, the device further includes: a feedback module; the feedback module is used to evaluate the node resource consumption trend and task execution efficiency during the execution of the target task, generate a resource utilization report, and provide contextual information to the large language model based on the resource utilization report to optimize the subsequently generated scheduling plan; the feedback module is also used to summarize the execution results, performance indicators, and behavior logs after the target task is completed to generate task execution feedback, and adjust the prompt template based on the task execution feedback to achieve self-learning and continuous optimization of the scheduling strategy; wherein, the task execution feedback includes at least one of the following: task time, abnormal events, resource utilization, and execution status code.

[0109] Optionally, the apparatus further includes: a prompt word generation module; the prompt word generation module is used to determine a basic template corresponding to the task type of the target task; the basic template includes: a fixed instruction part for defining the model role and output format, and a dynamic slot for injecting metadata; the prompt word generation module is also used to concatenate historical execution feedback and system state snapshots into semantically continuous context information, and concatenate the prompt words of the large language model based on the basic template and the context information.

[0110] The sandbox virtual machine scheduling device based on a large language model provided in this application firstly extracts metadata and performs feature analysis on the target task upon receiving a task request, obtaining a structured task object corresponding to the target task. The task object includes metadata and task features. Next, it acquires the current running state of the system and the text description corresponding to the target task, and uses a large language model to perform semantic analysis and reasoning on the current running state, the text description, and the task object to generate a target scheduling plan. Finally, it schedules virtual machines to execute the target task based on the target scheduling plan. The prompt words of the large language model are generated based on a dynamic prompt word concatenation mechanism. This dynamic prompt word concatenation mechanism includes standardizing the model input through structured templates based on task context, system state, and historical execution feedback. In this way, it can not only dynamically allocate virtual machines according to task semantics and risk, supporting the isolation and safe grouping of high-risk tasks, but also self-learn and optimize the scheduling strategy through task execution feedback, thereby improving resource utilization and scheduling efficiency while ensuring system security.

[0111] Figure 5 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 5As shown, the electronic device may include: a processor 510, a communications interface 520, a memory 530, and a communications bus 540, wherein the processor 510, the communications interface 520, and the memory 530 communicate with each other through the communications bus 540. The processor 510 can call logical instructions in the memory 530 to execute a sandbox virtual machine scheduling method based on a large language model. This method includes: first, upon receiving a task request, performing metadata extraction and feature analysis on the target task to obtain a structured task object corresponding to the target task; the task object includes metadata and task features; then, obtaining the current running state of the system and the text description corresponding to the target task, and using the large language model to perform semantic analysis and reasoning on the current running state, the text description, and the task object to generate a target scheduling plan; finally, scheduling the virtual machine to execute the target task based on the target scheduling plan; wherein, the prompt words of the large language model are generated based on a dynamic prompt word concatenation mechanism; the dynamic prompt word concatenation mechanism includes: standardizing the model input through structured templates based on task context, system state, and historical execution feedback. In this way, not only can virtual machines be dynamically allocated according to task semantics and risk, supporting high-risk task isolation and safe grouping, but the scheduling strategy can also be optimized through self-learning based on task execution feedback, thereby improving resource utilization and scheduling efficiency while ensuring system security.

[0112] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0113] On the other hand, this application also provides a computer program product, which includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions, and when the program instructions are executed by the computer, the computer can execute the sandbox virtual machine scheduling method based on the large language model provided by the above methods. The method includes: first, upon receiving a task request, performing metadata extraction and feature analysis on the target task to obtain a structured task object corresponding to the target task; the task object includes: metadata and task features; then, obtaining the current running state of the system and the text description corresponding to the target task, and using the large language model to perform semantic analysis and reasoning on the current running state, the text description, and the task object to generate a target scheduling plan; finally, scheduling the virtual machine to execute the target task based on the target scheduling plan; wherein, the prompt words of the large language model are generated based on a dynamic prompt word concatenation mechanism; the dynamic prompt word concatenation mechanism includes: standardizing the model input through a structured template based on the task context, system state, and historical execution feedback. In this way, not only can virtual machines be dynamically allocated according to task semantics and risks, supporting the isolation and safe grouping of high-risk tasks, but also the scheduling strategy can be optimized through self-learning by task execution feedback, so as to improve resource utilization and scheduling efficiency while ensuring system security.

[0114] Furthermore, this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned sandbox virtual machine scheduling methods based on large language models. This method includes: first, upon receiving a task request, performing metadata extraction and feature analysis on the target task to obtain a structured task object corresponding to the target task; the task object includes metadata and task features; then, obtaining the current running state of the system and the text description corresponding to the target task, and using a large language model to perform semantic analysis and reasoning on the current running state, the text description, and the task object to generate a target scheduling plan; finally, scheduling a virtual machine to execute the target task based on the target scheduling plan; wherein the prompt words of the large language model are generated based on a dynamic prompt word concatenation mechanism; the dynamic prompt word concatenation mechanism includes: standardizing the model input through structured templates based on task context, system state, and historical execution feedback. Thus, not only can virtual machines be dynamically allocated according to task semantics and risk, supporting high-risk task isolation and secure grouping, but the scheduling strategy can also be optimized through self-learning based on task execution feedback, thereby improving resource utilization and scheduling efficiency while ensuring system security.

[0115] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0116] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0117] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A sandbox virtual machine scheduling method based on a large language model, characterized in that, include: Upon receiving a task request, metadata extraction and feature analysis are performed on the target task to obtain the structured task object corresponding to the target task; The task object includes: metadata and task characteristics; The system obtains the current running status of the system and the text description corresponding to the target task, and uses a large language model to perform semantic analysis and reasoning on the current running status, the text description, and the task object to generate a target scheduling plan; The virtual machine is scheduled to execute the target task based on the target scheduling plan; The prompt words of the large language model are generated based on a dynamic prompt word concatenation mechanism. The dynamic prompt word concatenation mechanism includes: standardizing the model input through structured templates based on task context, system state, and historical execution feedback. The process of extracting metadata and performing feature analysis on the target task to obtain the structured task object corresponding to the target task includes: Metadata is extracted from the target task, and static features are extracted using a parser to obtain the static features of the target task. Based on the extracted static features, the target task is risk-labeled using a feature scoring model to obtain the intelligence label of the target task. The step of scheduling the virtual machine to execute the target task based on the target scheduling plan includes: Based on the target scheduling plan, a standardized scheduling instruction object is generated, and based on the scheduling instruction object, a corresponding target virtual machine instance is matched in the resource pool; the scheduling instruction object includes: target virtual machine group number, resource weight, and parallelism control; Using an isolation strategy corresponding to the risk level represented by the intelligence tag, the target virtual machine instance is invoked to execute the target task; Specifically, when the risk level indicated by the intelligence tag is a high-risk task, it is executed in a completely isolated virtual network and independent disk snapshot; when the risk level indicated by the intelligence tag is a normal task, it is run in a controlled manner in a shared resource pool. The method further includes: During the execution of the target task, the node resource consumption trend and task execution efficiency are evaluated, a resource utilization report is generated, and contextual information is provided to the large language model based on the resource utilization report to optimize the subsequently generated scheduling plan. After the target task is completed, the execution results, performance indicators, and behavior logs are summarized to generate task execution feedback. Based on the task execution feedback, the prompt words of the large language model are adjusted to achieve self-learning and continuous optimization of the scheduling strategy. The task execution feedback includes at least one of the following: task time, abnormal events, resource utilization, and execution status code.

2. The method according to claim 1, characterized in that, The metadata includes at least one of the following: filename, size, MIME type, submission source, and timestamp; the task features include: static features, intelligence tags, and task priority; the static features include at least one of the following: executable file header information, macro script markers, suspicious strings, and network addresses; the intelligence tags are used to characterize the risk level of the target task.

3. The method according to claim 1, characterized in that, The dynamic prompt word concatenation mechanism includes: Determine a base template corresponding to the task type of the target task; the base template includes: a fixed instruction section for defining the model role and output format, and a dynamic slot for injecting metadata; Historical execution feedback and system state snapshots are concatenated into semantically continuous contextual information, and prompt words for the large language model are obtained by concatenating the basic template and the contextual information.

4. A sandbox virtual machine scheduling device based on a large language model, characterized in that, The device includes: The information extraction module is used to perform metadata extraction and feature analysis on the target task upon receiving a task request, to obtain a structured task object corresponding to the target task; the task object includes: metadata and task features; The plan generation module is used to obtain the current running status of the system and the text description corresponding to the target task, and use a large language model to perform semantic analysis and reasoning on the current running status, the text description, and the task object to generate a target scheduling plan; The plan execution module is used to schedule virtual machines to execute the target task based on the target scheduling plan; The prompt words of the large language model are generated based on a dynamic prompt word concatenation mechanism. The dynamic prompt word concatenation mechanism includes: standardizing the model input through structured templates based on task context, system state, and historical execution feedback. The information extraction module is specifically used to extract metadata from the target task and extract static features through a parser to obtain the static features of the target task. The information extraction module is further configured to perform risk labeling on the target task based on the extracted static features using a feature scoring model, thereby obtaining the intelligence label of the target task. The plan execution module is specifically used to generate standardized scheduling instruction objects based on the target scheduling plan, and to match corresponding target virtual machine instances in the resource pool based on the scheduling instruction objects; the scheduling instruction objects include: target virtual machine group number, resource weight, and parallelism control; The plan execution module is specifically used to invoke the target virtual machine instance to execute the target task by adopting an isolation strategy corresponding to the risk level represented by the intelligence tag. Specifically, when the risk level indicated by the intelligence tag is a high-risk task, it is executed in a completely isolated virtual network and independent disk snapshot; when the risk level indicated by the intelligence tag is a normal task, it is run in a controlled manner in a shared resource pool. The device further includes: a feedback module; The feedback module is used to evaluate the node resource consumption trend and task execution efficiency during the execution of the target task, generate a resource utilization report, and provide contextual information to the large language model based on the resource utilization report to optimize the subsequently generated scheduling plan. The feedback module is also used to summarize the execution results, performance indicators, and behavior logs after the target task is completed, so as to generate task execution feedback, and adjust the prompt words of the large language model based on the task execution feedback to realize the self-learning and continuous optimization of the scheduling strategy. The task execution feedback includes at least one of the following: task time, abnormal events, resource utilization, and execution status code.

5. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the sandbox virtual machine scheduling method based on any one of claims 1 to 3.

6. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the steps of the sandbox virtual machine scheduling method based on a large language model as described in any one of claims 1 to 3.

Images