Computing power network security management and control method and device, computer device and storage medium

Abstract

This invention belongs to the field of computing power networks and network security, and relates to methods, devices, computer equipment, and storage media for computing power network security management and control. The method includes: dividing computing power nodes into multiple logical regions, deploying a supervisory agent in each region, and deploying a coordinating agent at the core node to construct a hierarchical collaborative management and control architecture; collecting node behavior data and calculating a comprehensive trust value; issuing verification tasks and observing responses, and updating the posterior probability of the node's true security type; making a clear judgment on the node's final trust state based on the dominant probability principle; forming a unified security view of the entire network through real-time broadcasting and periodic reporting to the coordinating agent; and having the supervisory agent execute specific management and control strategies, providing feedback on the network status and adjusted parameters after execution. It features decentralization and high availability, enabling proactive verification and accurate identification, cross-domain collaboration and joint prevention and control, and adaptive dynamic defense.

Description

Technical Field

[0001] This invention relates to the fields of computing power networks and network security technology, and in particular to computing power network security management and control methods, devices, computer equipment and storage media. Background Technology

[0002] With the rapid development of cloud computing, edge computing, and artificial intelligence, computing power networks have become a key infrastructure for providing ubiquitous computing services. Computing power networks abstract and connect heterogeneous computing resources (CPUs, GPUs, FPGAs, etc.) distributed across different geographical locations and belonging to different management domains, forming a unified computing power supply platform.

[0003] However, the openness, distribution, and heterogeneity of computing networks also bring severe security challenges. First, traditional centralized security management architectures suffer from single points of failure and performance bottlenecks, making them ill-suited to the massive scale and dynamic expansion characteristics of computing networks. Second, existing trust assessment methods are mostly based on passive observation, lacking proactive verification mechanisms, making it difficult to accurately identify malicious nodes with camouflage capabilities. Third, security information is isolated across different regions, allowing malicious nodes to evade detection and punishment through cross-regional migration. Finally, static security strategies cannot adapt to the dynamically changing network attack landscape.

[0004] Therefore, there is an urgent need for a computing power network security management method that can achieve distributed deployment, proactive verification, cross-domain collaboration, and adaptive adjustment. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention provides a method for network security management of computing power, employing the following technical solution, including the following steps: The computing power nodes are divided into multiple logical regions, a supervisory intelligent agent is deployed in each region, and a coordinating intelligent agent is deployed in the core nodes to build a hierarchical collaborative management and control architecture; Using the aforementioned regulatory intelligent agent as the execution subject, it continuously collects node behavior data and calculates a comprehensive trust value. It uses dual thresholds to classify nodes into three categories: trustworthy, malicious, and suspicious, and outputs information on nodes that fall into the suspicious range. Using the node information as the verification object, the regulatory agent actively issues verification tasks and observes the response. Based on Bayes' theorem, the posterior probability of the node's true security type is recursively updated, and the posterior probability distribution at the time of termination is output. Using the posterior probability distribution as input, the regulatory agent makes a clear judgment on the final trust state of the node based on the dominant probability principle, and outputs the node judgment result. Using the node determination results as information carriers, the network forms a unified security view by real-time broadcasting between adjacent regional regulatory agents and periodic reporting to the coordinating agent, and outputs a global list of malicious nodes. Based on the global malicious node list and the final trust status of the nodes, the regulatory agent executes specific control strategies and dynamically adjusts system parameters according to the global malicious node distribution. The network status after execution and the adjusted parameters are fed back to form an adaptive security control closed loop.

[0006] Preferably, the step of dividing the computing power nodes into multiple logical regions, deploying a supervisory intelligent agent in each region, and deploying a coordinating intelligent agent in the core node to construct a hierarchical collaborative management and control architecture specifically includes: Based on the principles of geographical proximity, management domain boundaries, and load balancing, the computing power node set is divided into multiple non-overlapping regions; Deploy independent regulatory agents in each region to be responsible for trust assessment, game theory verification and local isolation within the region, and deploy coordination agents at core nodes to be responsible for global information aggregation, consistency verification and policy distribution; Establish a lightweight communication channel between adjacent regulatory agents and initialize the state table of each agent.

[0007] Preferably, the step of using the regulatory intelligent agent as the execution subject, continuously collecting node behavior data and calculating a comprehensive trust value, using dual thresholds to classify nodes into three categories: trustworthy, malicious, and suspicious, and outputting information about nodes falling into the suspicious range specifically includes: During each evaluation cycle, the regulatory agent collects node behavior metrics from the agent and calculates the task completion quality score. Define a behavioral observation vector, construct a historical baseline vector using an exponentially weighted moving average, and calculate a behavioral consistency score. The system integrates scores from two dimensions: task completion quality and behavioral consistency. It calculates a comprehensive trust value and identifies suspicious intervals. Using dual thresholds, nodes are classified into three categories: trustworthy, malicious, and suspicious. The system outputs information about nodes that fall into the suspicious interval.

[0008] Preferably, the steps of using the node information as the verification object, having the regulatory agent actively issue verification tasks and observe responses, recursively updating the posterior probability of the node's true security type based on Bayes' theorem, and outputting the posterior probability distribution at termination specifically include: Using the node information as the verification object, a category space for the true security type of the node is defined, and the node's comprehensive trust value is mapped to a priori probability distribution. Actively issue various types of verification tasks, obtain the response behavior of nodes, and define the probability distribution of node responses for different security types to provide a likelihood function for Bayesian updates; After each round of the game, based on the observation results, the posterior probability of a node belonging to each type of security is recursively updated according to Bayes' theorem. The game terminates early when the confidence threshold is met or the maximum number of rounds is reached, and the posterior probability distribution at the time of termination is output.

[0009] Preferably, the step of taking the posterior probability distribution as input, having the regulatory agent make a clear judgment on the final trust state of the node based on the dominant probability principle, and outputting the node judgment result specifically includes: Using the posterior probability distribution as input, and based on the posterior probability distribution at the end of the game, the dominant type is selected as the final trust state of the node, and the decision result is output. For nodes identified as being under continuous monitoring, their permissions are restricted and the monitoring frequency is increased; The final judgment result is persisted to the local node state table, and the game round and posterior probability information are recorded. The node judgment result is then output.

[0010] Preferably, the step of using the node determination result as an information carrier, and through real-time broadcasting between adjacent regional regulatory agents and periodic reporting to the coordinating agent to form a unified security view of the entire network, and outputting a global list of malicious nodes, specifically includes: The node determination results in this region are broadcast to the regulatory agents in all adjacent regions in real time to achieve rapid collaborative response between regions. Each regulatory intelligence agent periodically reports the list of nodes identified as maliciously isolated within its region to the coordinating intelligence agent, which then aggregates the data globally to form a unified security view across the entire network. The coordinating agent resolves conflicts in the judgment results of the same node reported by multiple regions, generates a unified list of malicious nodes across the entire network, and distributes it to all regulatory agents to achieve global trust unification and output a global list of malicious nodes.

[0011] Preferably, the step of having the supervisory agent execute specific control strategies based on the global malicious node list and the final trust status of the nodes, dynamically adjust system parameters according to the global malicious node distribution, and provide feedback on the network status after execution and the adjusted parameters to form an adaptive security control closed loop specifically includes: Based on the global malicious node list and the node's final trust status, a multi-level local isolation strategy is immediately implemented for nodes determined to be in a malicious isolation state, cutting off their ability to interact with the computing power network. For nodes identified as being under continuous monitoring, restrict their access to high-risk tasks and increase the frequency of behavioral monitoring. Based on the distribution of the global malicious node list, the trust threshold and game parameters of each region are dynamically adjusted to achieve adaptive security protection.

[0012] To address the aforementioned technical problems, the present invention also provides a computing power network security management and control device, which adopts the following technical solution, including: The domain partitioning module is used to divide the computing power nodes into multiple logical regions, deploy a supervisory agent in each region, and deploy a coordinating agent in the core nodes to build a hierarchical collaborative management and control architecture. The regulatory intelligent agent module is used to continuously collect node behavior data and calculate a comprehensive trust value, using the regulatory intelligent agent as the execution subject. It then uses dual thresholds to classify nodes into three categories: trustworthy, malicious, and suspicious, and outputs information about nodes that fall into the suspicious range. The trust assessment module is used to verify the node information. The supervisory agent actively issues verification tasks and observes the responses. Based on Bayes' formula, it recursively updates the posterior probability of the node's true security type and outputs the posterior probability distribution at the time of termination. The decision module is used to take the posterior probability distribution as input, and make a clear decision on the final trust state of the node by the regulatory agent according to the dominant probability principle, and output the node decision result. The collaborative broadcast module is used to form a unified security view of the entire network by using the node determination result as the information carrier, through real-time broadcasting between adjacent regional regulatory agents and periodic reporting to the coordinating agent, and outputting a global list of malicious nodes. The adjustment module is used to execute specific control strategies by the regulatory agent based on the global malicious node list and the final trust status of the nodes, and to dynamically adjust system parameters according to the global malicious node distribution. The module also provides feedback on the network status after execution and the adjusted parameters to form an adaptive security control closed loop.

[0013] To address the aforementioned technical problems, the present invention also provides a computer device that employs the technical solution described below, comprising a memory and a processor. The memory stores computer-readable instructions, and the processor executes the computer-readable instructions to implement the steps of the aforementioned computing power network security management method.

[0014] To address the aforementioned technical problems, the present invention also provides a computer-readable storage medium, which employs the technical solution described below. The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the aforementioned computing power network security management method.

[0015] Compared with the prior art, the present invention has the following main advantages: (1) It features decentralization and high availability: In response to the single point of failure and performance bottleneck of traditional centralized management and control, this invention constructs a distributed hierarchical management and control architecture through regional division and multi-agent deployment. Each regional regulatory agent operates independently, and the coordinating agent only performs global aggregation, eliminating the risk of central node failure and significantly improving the system's scalability and robustness.

[0016] (2) Active verification and accurate identification: To address the difficulty of identifying disguised malicious nodes through passive observation, this invention introduces a multi-round incomplete information Bayesian game mechanism to actively issue verification tasks and dynamically update the posterior probability of node types based on Bayesian inference. This active verification method can effectively detect malicious nodes with deceptive behavior, significantly improving identification accuracy.

[0017] (3) Cross-domain collaboration and joint prevention and control: In response to the problem that malicious nodes can migrate across regions to evade punishment due to security information silos, this invention realizes rapid information sharing between regions and a unified security view of the entire network through real-time broadcasting between adjacent regions and global consistency verification. Once a malicious node is identified by any region, the adjacent regions can immediately take isolation measures.

[0018] (4) Adaptive dynamic defense: In response to the problem that static strategies cannot adapt to dynamic attack situations, this invention dynamically adjusts the trust threshold and game parameters according to the global distribution of malicious nodes, realizing adaptive closed-loop adjustment of security strategies, which can reduce overhead when the risk is low and actively strengthen defense when the risk is high. Attached Figure Description

[0019] To more clearly illustrate the solutions in this invention, the accompanying drawings used in the description of the embodiments of this invention will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0020] Figure 1 This is a flowchart of an embodiment of the computing power network security management and control method of the present invention; Figure 2 This is an exemplary system architecture diagram in which the present invention can be applied; Figure 3 This is a schematic diagram of a structure of an embodiment of the computing power network security management and control device of the present invention; Figure 4 This is a schematic diagram of another embodiment of the computing power network security management and control device of the present invention; Figure 5 This is a schematic diagram of the structure of an embodiment of the computer device of the present invention. Detailed Implementation

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains; the terminology used herein in the specification is for the purpose of describing particular embodiments only and is not intended to limit the invention; the terms "comprising" and "having," and any variations thereof, in the specification, claims, and foregoing drawings are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification, claims, or foregoing drawings are used to distinguish different objects and not to describe a particular order.

[0022] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0023] To enable those skilled in the art to better understand the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0024] It should be noted that the computing power network security management method provided in the embodiments of the present invention is generally executed by a server / terminal device, and correspondingly, the computing power network security management device is generally installed in the server / terminal device.

[0025] It should be understood that the number of terminal devices, networks, and servers is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be used.

[0026] Example 1 Please refer to Figure 1 The flowchart illustrates an embodiment of the computing power network security management method of the present invention. Figure 2 This is an exemplary system architecture diagram in which the present invention can be applied. For example... Figure 1 , Figure 2 As shown, the computing power network security management and control method includes the following steps: Step S1: Divide the computing power nodes into multiple logical regions, deploy a regulatory intelligent agent in each region, and deploy a coordinating intelligent agent in the core nodes to build a hierarchical collaborative management and control architecture.

[0027] In this embodiment, the electronic devices (e.g., servers / terminal devices) on which the computing power network security management and control method runs can receive computing power network security management and control requests via wired or wireless connections. It should be noted that the aforementioned wireless connection methods may include, but are not limited to, 3G / 4G / 5G connections, WiFi connections, Bluetooth connections, WiMAX connections, Zigbee connections, UWB (ultra wideband) connections, and other currently known or future-developed wireless connection methods.

[0028] In this embodiment, step S1 may specifically include the following steps: S11 divides the computing power node set into multiple non-overlapping regions according to the principles of geographical proximity, management domain boundary, and load balancing.

[0029] The computing power network should be divided into regions according to the following three principles: Geographic proximity principle: Nodes located in the same physical location or with low network latency are grouped into the same region to reduce cross-regional communication latency.

[0030] Management domain boundary principle: Nodes within the same management domain (such as the same computer room or the same enterprise department) are preferentially assigned to the same area to facilitate the division of management responsibilities.

[0031] Load balancing principle: The number of nodes in each region should be relatively balanced with the computing load to avoid performance bottlenecks caused by overload in a single region.

[0032] Let the set of computing nodes in the entire computing power network be: .in: The set of all computing nodes in the entire computing power network. : No. The identifier of each computing node. The total number of nodes in the computing power network.

[0033] The node set is divided into regions. Let the set of non-overlapping regions be denoted as: .in: The set of regions after partitioning. The 1st division Each logical region contains several computing nodes. The total number of regions obtained from the division.

[0034] satisfy: .in, : No. Each logical region. : Empty set.

[0035] Number of regions It can be dynamically adjusted according to network size. For any node There exists a unique region. Make .

[0036] Define the adjacency relationship between regions: If two regions and ( If nodes in a region have a direct communication link or are physically adjacent, then these two regions are considered adjacent regions. The region adjacency matrix is ​​denoted as: .

[0037] in: : The region adjacency matrix has elements of 0 or 1.

[0038] in express and Adjacent, This indicates that they are not adjacent. Adjacency relationships are symmetrical, that is... .

[0039] For the region Its adjacent region index set is defined as: .

[0040] in: : Region index. : The region adjacency matrix has elements of 0 or 1. :matrix The Middle Line number The elements of the column represent regions. and Are they adjacent? :area The set of all adjacent region indices.

[0041] The significance of the above formula and division method is to ensure that each node uniquely belongs to one region, thus avoiding management conflicts.

[0042] Through the adjacency matrix Quantifying the topological relationships between regions provides a clear communication range for subsequent coordinated broadcasting. Number of regions It can be dynamically adjusted to adapt to the elastic expansion of the computing network. The symmetry of adjacency relationships ensures the feasibility of two-way broadcasting.

[0043] The purpose of step S11 is to divide the large-scale, distributed computing power nodes into multiple logically independent regions, ensuring load balancing, clear management boundaries, and controllable communication overhead in each region, thus providing a prerequisite for the independent deployment of regulatory agents.

[0044] S12 deploys independent regulatory agents in each region, responsible for trust assessment, game theory verification, and local isolation within that region. It also deploys coordination agents at core nodes, responsible for global information aggregation, consistency verification, and policy distribution.

[0045] In each region Deploy a separate regulatory agent on the server or edge gateway device within the system. This intelligent agent possesses the following functions: Continuously collect behavioral data from all nodes within this region; Perform local trust assessment and multi-round incomplete information Bayesian game; Real-time collaborative broadcasting with regulatory agents in adjacent areas; Implement local isolation policies for nodes identified as malicious.

[0046] Each regulatory agent Initialize and maintain two types of state tables: Local Node Status Table: Records the status of each node within this region. The following information: Node identifier Node overall trust value Posterior probability distribution Current trust status determination And the game round count and historical response record.

[0047] Local cross-region node status table: records the current trust status, judgment timestamp, and source region identifier of adjacent regional nodes.

[0048] Deploy a coordinating intelligent agent on the core server or cloud management platform of the computing power network. ,Responsible: Regularly receive lists of malicious nodes reported by various regulatory agents; Perform global consistency checks and conflict resolution; Generate a unified list of malicious nodes across the entire network and distribute it to all regulatory agents.

[0049] The formal definition of the entire distributed hierarchical multi-agent collaborative management and control architecture is: .in: : The mathematical representation of the entire collaborative management and control architecture. : Set of regions. A collection of regional regulatory intelligent agents. Adjacent region lookup function Return to area The set of adjacent region indexes. Coordinating intelligent agents.

[0050] The significance of this formal definition lies in abstracting the physical deployment into a mathematical model, facilitating subsequent algorithm description and system analysis. It clarifies the hierarchical structure of the control system: regional regulatory layer (…). ) and global coordination layer ( ).pass The function encapsulates the topological relationships between regions, simplifying the description of cooperative broadcasting.

[0051] The purpose of step S12 is to deploy the supervisory agent and the coordinating agent.

[0052] S13, establish a lightweight communication channel between adjacent supervisory agents and initialize the state table of each agent.

[0053] Communication link establishment: based on the adjacency matrix For each pair of adjacent regions Establish a two-way communication link. The communication protocol uses lightweight message queues or UDP broadcast to ensure low latency.

[0054] Parameter loading: After each regulatory agent starts up, it loads the following parameters from the configuration center: evaluation period (Typical value 300 seconds), High confidence threshold (Typical value 0.7), Low confidence threshold (Typical value 0.3), Maximum number of game rounds (Typical value 5), High-confidence termination threshold (Typical value 0.85), Low confidence termination threshold (Typical value 0.85) and elements of the observation probability matrix (Typical values: 0.95, 0.70, 0.30).

[0055] State table initialization: Each regulatory agent initializes its local node state table and cross-region node state table to be empty, and starts the behavior data collection thread.

[0056] The purpose of step S13 is to ensure the real-time performance and reliability of subsequent collaborative broadcasting and global convergence by establishing communication and state initialization between intelligent agents.

[0057] The purpose of step S1 is to build a distributed, layered, and collaborative computing power network security management and control infrastructure, eliminate single points of failure and performance bottlenecks in centralized management and control, and provide physical and logical carriers for subsequent trust assessment, game verification, and collaborative broadcasting.

[0058] Step S2: The regulatory intelligent agent acts as the execution subject, continuously collects node behavior data and calculates the comprehensive trust value. Using dual thresholds, nodes are divided into three categories: trustworthy, malicious, and suspicious. The information of nodes that fall into the suspicious range is output.

[0059] In this embodiment, step S2 may specifically include the following steps: S21. During each evaluation cycle, the supervisory agent obtains node behavior indicators through the collection agent and calculates the task completion quality score.

[0060] In each evaluation cycle Internally, regulatory intelligent agents Lightweight data acquisition agents deployed across various computing nodes continuously acquire behavioral data from all nodes within the region. These agents sample data at a second-level granularity and aggregate it into an average value at the end of each period.

[0061] Assuming an evaluation cycle Inside, the nodes obtained by the regulatory intelligent agent The core behavioral indicators include: : Number of tasks successfully completed by the node; : Total number of tasks assigned to each node; Average time to complete a task; Average CPU utilization; Average GPU utilization; Average memory usage; Average bandwidth utilization; Average task queue length and Average task response latency.

[0062] Task completion quality score Taking into account both the task completion success rate and efficiency performance of a node, the calculation formula is as follows: .

[0063] in This is the preset maximum tolerable time to complete the task.

[0064] in: :node During the evaluation period The task completion quality score within the range of values. . : The number of tasks successfully completed by the node. The total number of tasks assigned to this node. : The average time taken for this node to successfully complete the task. The maximum tolerable time for a single task is preset by the system; exceeding this value is considered abnormal.

[0065] First item This reflects the success rate of the task; a higher value indicates that the node is more reliable.

[0066] Second item The score reflects task efficiency; the shorter the time taken, the higher the score.

[0067] Multiplying the two penalties incurs punishment for both nodes with high failure rates and nodes that take too long to complete.

[0068] when A value close to 1 indicates that the node is efficient and reliable; a value close to 0 indicates that the node may have performance problems or be unresponsive.

[0069] The purpose of step S21 is to obtain the core behavioral indicators of the node, calculate the task completion quality score, and reflect the task processing efficiency and reliability of the node.

[0070] S22, define the behavior observation vector, construct the historical baseline vector using the exponentially weighted moving average, and calculate the behavior consistency score.

[0071] Define behavior observation vector It includes six dimensions of behavioral metrics: .

[0072] Historical behavior baseline vector It is composed of the exponentially weighted moving average of each indicator over the historical evaluation period. Taking CPU utilization as an example: .

[0073] in: : No. The historical baseline value of CPU utilization for each evaluation period. The evaluation cycle number. . Historical decay factor, range of values Control the weighting of historical data on the current baseline. The larger the value, the higher the weight of recent data. : No. Average CPU utilization of nodes within each evaluation period. : No. The historical baseline value of CPU utilization for each evaluation period.

[0074] The formula for behavioral consistency scoring is: .in: :node During the evaluation period Within the range of behavioral consistency scores. . : The behavior observation vector for the current period, which includes indicators in 6 dimensions. Historical behavior baseline vector, obtained by exponentially weighted moving average. The magnitude of a vector (Euclidean distance) is calculated using the following formula: . Minimal constant (e.g.) ( ), to prevent the denominator from being zero.

[0075] molecular This indicates the degree of deviation of the current behavior from the historical baseline; the greater the deviation, the larger the value.

[0076] denominator The degree of deviation is normalized so that the score is independent of the node's own baseline size.

[0077] score The closer to 1, the more consistent the behavior is with the past and there are no abnormalities; the closer to 0, the more significant the abnormality in behavior (such as CPU spikes or a sharp increase in response latency).

[0078] By using an exponentially weighted moving average, the baseline can smoothly adapt to the normal gradual changes in node behavior and avoid false alarms.

[0079] The purpose of step S22 is to quantify the degree of deviation of the node's current behavior from its historical normal pattern, identify anomalies in resource consumption or response latency, and discover possible malicious behavior or failures.

[0080] S23 integrates the scores of two dimensions: task completion quality and behavioral consistency, calculates the comprehensive trust value, and determines the suspicious interval. It uses dual thresholds to classify nodes into three categories: trustworthy, malicious, and suspicious, and outputs the node information that falls into the suspicious interval.

[0081] Node overall trust value Task completion quality score Behavioral consistency score The weighted average is obtained as follows: .

[0082] in: :node During the evaluation period The overall trust value within the range of values. . : Weighting coefficients for task completion quality score This is the weighting coefficient, with typical values. This indicates that both dimensions are equally important. Weights for behavioral consistency scores. :node Task completion quality score. :node Behavioral consistency score.

[0083] In each evaluation cycle When node Overall trust value After the calculation is completed, the regulatory agent Compare it with a preset trust threshold and update the trust status. .

[0084] Set two trust thresholds: a high trust threshold. Typical value Low confidence threshold Typical value .satisfy .

[0085] The specific judgment rules are as follows: like If the node is deemed trustworthy, it can directly be determined as a trusted node and participate in the computing power task scheduling normally without entering the game process.

[0086] like If the node is in a malicious isolation state, the local isolation policy will be executed immediately.

[0087] like If a node falls into the suspicious interval, it triggers a multi-round incomplete information Bayesian game process. Nodes falling into the suspicious interval remain in a temporary state of continuous monitoring until the game is completed, and can only participate in low-risk tasks (such as read-only operations and non-sensitive computations).

[0088] in: High trust threshold: If the overall trust value is higher than this value, it is directly trusted. Low trust threshold: If the overall trust value is lower than this value, the system will be directly isolated.

[0089] The significance of this formula and the judgment rule is as follows: By combining the evaluation results from two dimensions through a weighted average, the one-sidedness of a single dimension is avoided.

[0090] The dual-threshold design divides nodes into three regions: a high-trust region (directly trusted), a low-trust region (directly isolated), and a suspicious region (requiring in-depth verification).

[0091] The existence of suspicious intervals avoids erroneous judgments by applying a blanket approach and provides a second verification opportunity for boundary nodes.

[0092] Weighting coefficient Adjustable based on the scenario: Improves efficiency in compute-intensive scenarios. It can improve safety in security-sensitive scenarios. .

[0093] The purpose of step S23 is to integrate the scores of the two dimensions of task completion quality and behavioral consistency to obtain the node's comprehensive trust value, and compare it with the two thresholds to determine whether the node is directly trusted, directly isolated, or enters the game process.

[0094] The purpose of step S2 is to continuously collect node behavior data, quantify the trust level of nodes from two dimensions: task completion quality and behavior consistency, identify suspicious nodes that need to enter the game process, and provide triggering conditions for proactive verification.

[0095] Step S3: Using node information as the verification object, the supervisory agent actively issues verification tasks and observes the responses. Based on Bayes' theorem, the posterior probability of the node's true security type is recursively updated, and the posterior probability distribution at the time of termination is output.

[0096] In this embodiment, step S3 may specifically include the following steps: S31 uses node information as the verification object, defines the category space of the node's true security type, and maps it to a prior probability distribution based on the node's comprehensive trust value.

[0097] The true security type of nodes falling into the suspicious range. Divided into three categories: (Highly Trustworthy Type): With standardized behavior and reliable computing resources, it can correctly complete the vast majority of verification tasks.

[0098] (Medium Trust Type): The behavior exhibits slight fluctuations or occasional anomalies (such as momentary overload or network jitter), but the node is not malicious.

[0099] (Low Trust Type): Possesses malicious intent and may intermittently refuse to respond or intentionally return incorrect results.

[0100] The regulatory agent first establishes a prior probability distribution for the true security types of different nodes: .

[0101] in: : Initial prior probability distribution vector. This represents the prior probability that a node belongs to a high-confidence type. The prior probability is of medium confidence type. This represents the prior probability of a low-confidence type.

[0102] These three values ​​are the node's overall trust value. The mapping is obtained, and the specific mapping function is: ; ; .

[0103] in: This is a scaling factor that controls the sensitivity of the trust value to the prior probability; typical values ​​are... , The larger the value, the more significant the impact of the trust value on the prior. : A minimum value function that limits the result to no more than 0.9. : The maximum value function, which limits the result to no less than 0.1. and Limit the probability value to Within the range, extreme values ​​(0 or 1) should be avoided, and a certain degree of uncertainty should be retained.

[0104] Nodes with higher overall trust scores receive more rewards. Nodes with lower trust values ​​receive higher rewards. .

[0105] pass and The constraint ensures that each type retains at least a probability of 0.1, reflecting the uncertainty under incomplete information.

[0106] Probability of moderately reliable type Automatically replenish as a margin to ensure the sum of probabilities equals 1.

[0107] scaling factor The sensitivity of the mapping can be adjusted according to the security policy: it can be increased when security requirements are high. This allows suspicious nodes to enter the game more quickly.

[0108] The purpose of step S31 is to define the category space of the true security type of the node and map it to the prior probability distribution based on the node's comprehensive trust value, so as to quantify the initial belief of the regulatory agent in the node type as the starting point of the game.

[0109] S32 proactively issues various types of verification tasks, obtains the response behavior of nodes, and defines the probability distribution of node responses for different security types, providing a likelihood function for Bayesian updates.

[0110] The supervisory agent obtains node response observations by proactively issuing response verification tasks. Each round of the game randomly selects one type of task, and the tasks are different each round. The three types of verification tasks are designed as follows: Correctness verification task: The supervisory agent issues a computation task with preset input (such as matrix multiplication or prime number determination), and the supervisory agent can independently calculate the correct result. After the node returns the calculation result, the supervisory agent compares the node's result with its local calculation result. If they match, it is a correct response; otherwise, it is an incorrect response.

[0111] Storage integrity verification task: The supervisory agent requests nodes to return the hash value of a specified data block, whose baseline hash value has been stored by the supervisory agent. After the node returns the hash value, the supervisory agent compares it with the local baseline value; if they match, it is a correct response; otherwise, it is an incorrect response.

[0112] Behavioral compliance verification task: The supervisory agent issues an operation request that requires specific permissions or authentication to execute (such as accessing sensitive resources or modifying configuration), and verifies whether the node has correctly performed the permission check. If the node returns a compliance result or successfully completes the authentication process, it is a correct response; if the node returns that the unauthorized operation was successful or that authentication was bypassed, it is an error response.

[0113] The response behavior of nodes with different security types to the verification task follows different probability distributions. The observation probability matrix is ​​defined as follows: ; .

[0114] in Typical values ​​are: Highly trusted nodes have a 95% probability of responding correctly.

[0115] Medium-trust nodes have a 70% probability of responding correctly.

[0116] Low-trust nodes have only a 30% probability of responding correctly.

[0117] in: : When the node's true type is Under certain conditions, the conditional probability that a node will respond correctly. : No. The response outcome of a round-robin game. This indicates a correct response. This indicates an error response or no response. : The node's true security type, with a value of . : The probability of a node responding correctly in a highly reliable type. : The probability of a node responding correctly in a medium-trust type. : The probability of a correct response from a low-trust node.

[0118] : When the node's true type is Under certain conditions, the conditional probability that a node will respond correctly. : These correspond to the correct response probabilities of nodes of high, medium, and low trust types, respectively.

[0119] The significance of this observation model is that: Quantifying the behavioral characteristics of different types of nodes into conditional probabilities provides a mathematical foundation for Bayesian inference.

[0120] The setting aligns with intuition: highly trusted nodes are more likely to respond correctly, while low-trust nodes are more likely to respond incorrectly.

[0121] The values ​​of the observation probability matrix can be adjusted according to the security strategy and verification difficulty of the actual deployment environment, providing flexibility.

[0122] By randomly selecting different types of verification tasks, we can prevent malicious nodes from adaptively deceiving specific task types.

[0123] The purpose of step S32 is to proactively issue various types of verification tasks, obtain the response behavior of nodes, and define the probability distribution of node responses for different security types, thereby providing a likelihood function for Bayesian updates.

[0124] S33: After each round of the game, based on the observation results, the posterior probability of a node belonging to each type of security is recursively updated according to the Bayesian formula. The game terminates early when the confidence threshold is met or the upper limit of the number of rounds is reached, and the posterior probability distribution at the time of termination is output.

[0125] Let the maximum number of game rounds be... In the In round game ( ), regulatory intelligent agents To the node Randomly select and issue a response verification task ,node After execution, the regulatory agent obtains the response verification result. .

[0126] In the After each round of the game, the regulatory agent verifies the results based on the observed responses. The posterior probability distribution of the true security type of a node is recursively updated based on Bayesian inference. For any node's true security type... posterior probability The recursive calculation formula is: .

[0127] in: : No. After rounds of game, the node belongs to type The posterior probability. : Current game round index . : In the real type The response results were observed under the following conditions. The conditional probability. : No. The posterior probability after the first round of the game (the initial prior probability in the first round). ). : Summing the index variable, traversing all three node types . It is given by the defined observation probability matrix.

[0128] No. The updated posterior probability distribution after round-robin game is: and satisfy .

[0129] Early termination conditions: Set a termination threshold and ,satisfy Typical value , The three types of early termination conditions are: Termination condition for high-confidence type: If If the node fails to reach a certain threshold, the process will terminate prematurely, and the node will be determined to be in a trusted state.

[0130] Termination condition for low-trust types: If If the condition is not met, the process will terminate prematurely, and the node will be deemed to be in a malicious isolation state.

[0131] The maximum number of rounds will terminate if: If the game ends, the final state determination will proceed.

[0132] After each round of posterior probability updates, the supervisory agent checks three types of early termination conditions. If any condition is met, the game process terminates and the termination round is recorded. and the posterior probability distribution at termination Otherwise, the game will proceed to the next round.

[0133] in: : The preset maximum number of game rounds. : Current game round index . : Early termination threshold for the posterior probability of high-confidence types. : Early termination threshold for low-confidence type posterior probability. The game round at which the game actually ends. : The posterior probability distribution vector at the time of termination.

[0134] The significance of this recursive update and early termination mechanism is that: The Bayesian recursive formula achieves a closed loop for belief updates: each round of observations corrects the judgment of node type.

[0135] Recursiveness (relying only on the previous posterior probability and the current observation) greatly reduces computational and storage overhead, eliminating the need to backtrack the entire history.

[0136] The early termination condition (high or low confidence reaching the threshold) allows most nodes to complete the decision within 1-2 rounds, avoiding unnecessary verification overhead.

[0137] Termination threshold and Adjustable, allowing for a trade-off between speed and accuracy in decision-making.

[0138] Maximum round As a safety net mechanism, it ensures that the game will not continue indefinitely.

[0139] The purpose of step S33 is to update the posterior probability of a node belonging to various security types based on the observation results after each round of the game, and terminate the game early when the confidence threshold is met or the upper limit of the number of rounds is reached, thereby reducing communication overhead and computational delay.

[0140] The purpose of step S3 is to proactively issue verification tasks to suspicious nodes, gradually update the posterior probability of the node's true security type through Bayesian inference, achieve deep integration of proactive verification and passive observation, improve the accuracy of malicious node identification, and terminate early when the confidence level is met.

[0141] Step S4: Taking the posterior probability distribution as input, the supervisory agent makes a clear judgment on the final trust state of the node based on the dominant probability principle, and outputs the node judgment result.

[0142] In this embodiment, step S4 may specifically include the following steps: S41, taking the posterior probability distribution as input, selects the dominant type as the final trust state of the node based on the posterior probability distribution at the end of the game, and outputs the decision result.

[0143] After multiple rounds of incomplete information Bayesian game, the regulatory agent Based on the posterior probability distribution at the time of termination For nodes Make a final state determination. The specific determination rules are as follows: Determined to be in a trustworthy state: If and (Or, if the node terminates early due to meeting the termination conditions for a high-trust type), then the node is determined to be in a trusted state. The node is removed from the temporary state under continuous monitoring, restores to a trusted state, and can participate normally in the scheduling of all types of computing power tasks.

[0144] Determined to be in a malicious isolation state: If and (Or if the node terminates prematurely due to meeting the termination conditions for a low-trust type), then the node is determined to be in a malicious isolation state. The local isolation policy is immediately executed.

[0145] Nodes are classified as being under continuous monitoring if none of the above conditions are met (i.e., the posterior probability is highest for the moderately reliable type, or the probabilities of the three types are similar). In this case, the node's behavior exhibits uncertainty or sporadic anomalies.

[0146] The purpose of step S41 is to make a final decision based on the posterior probability.

[0147] S42 restricts the permissions of nodes that are determined to be in a continuous monitoring state and increases the monitoring frequency.

[0148] Nodes placed under continuous monitoring are restricted to low-risk and non-sensitive computational tasks (such as read-only operations and data backups), with access to sensitive resources and core computational tasks temporarily prohibited. Simultaneously, the supervisory agent shortens the node's evaluation cycle (e.g., from 300 seconds to 60 seconds) to monitor behavioral changes more frequently. In subsequent evaluation cycles, if the node's overall trust value falls back into the suspicious range, a multi-round incomplete information Bayesian game is retried; if the overall trust value rises to the high-trust range, it is restored to a trustworthy state; if it further deteriorates to the low-trust range, it is classified as maliciously isolated.

[0149] The purpose of step S42 is to restrict the permissions of nodes that are determined to be in a continuous monitoring state and increase the monitoring frequency to prevent unpredictable nodes from causing security risks, while providing them with an opportunity to return to normal.

[0150] S43 persists the final judgment result to the local node state table, records the game round and posterior probability information, and outputs the node judgment result.

[0151] After completing the final state determination of the node, the regulatory intelligent agent Node Current trust status Record the information in the local node status table, along with the following information: game round count. ; Posterior probability distribution at termination And the determination timestamp.

[0152] These records will be used for: message encapsulation during neighbor broadcasts, periodic reporting to the coordinating agent, and historical reference for subsequent evaluation cycles.

[0153] The purpose of step S43 is to record and update the local state, providing data support for subsequent collaborative broadcasting and policy execution.

[0154] The purpose of step S4 is to determine whether a node's final trust state is trustworthy, maliciously isolated, or continuously monitored based on the posterior probability distribution at the end of the game, and to record the determination result in the local state table, providing a basis for subsequent collaborative broadcasting and strategy execution.

[0155] Step S5: Using the node determination result as the information carrier, the results are aggregated through real-time broadcasting between adjacent regional regulatory agents and periodic reporting to the coordinating agent to form a unified security view of the entire network and output a global list of malicious nodes.

[0156] In this embodiment, step S5 may specifically include the following steps: S51 broadcasts the node determination results of this region to the regulatory agents of all adjacent regions in real time, enabling rapid collaborative response between regions.

[0157] When regulatory intelligence Complete Node After determining the final state, the result is immediately broadcast to all regulatory agents in adjacent areas. For each area... Its adjacent region index set is .

[0158] Adjacent broadcasts use a lightweight message format, and the broadcast process can be formally represented as follows: .

[0159] in: : Index of adjacent regions. :area The set of all adjacent region indices. :area The regulatory intelligence. :area The regulatory intelligence. Source region identifier, i.e., the region to which the broadcasting regulatory agent belongs. . Target node identifier. :node The determination of the trust status (trusted, continuously monitored, or maliciously isolated). : The timestamp when the judgment result was generated.

[0160] Neighboring regulatory intelligent agents Upon receiving the broadcast, perform the following collaborative operations: Update the local cross-region node status table: record the node In the region The judgment result, judgment timestamp, and source region identifier are included.

[0161] Prior information fusion: if node Subsequent access area And then enter the game process, The prior probability can be adjusted based on the historical judgment results of adjacent regions. For example, the low-confidence prior probability of nodes in adjacent regions that are judged as malicious can be increased.

[0162] Collaborative isolation triggered: If the received judgment result is a malicious isolation state, and the node... Currently connected areas , The node can be directly updated to a malicious isolation state, and a local isolation policy can be implemented immediately to prevent the malicious node from reconnecting after migration.

[0163] The purpose of step S51 is to broadcast the node determination results of this region to the regulatory agents of all adjacent regions in real time, so as to realize rapid collaborative response between regions and prevent malicious nodes from reconnecting after migration.

[0164] S52, each regulatory agent periodically reports the list of nodes in its region that are determined to be in a malicious isolation state to the coordinating agent, which then aggregates the data globally to form a unified security view of the entire network.

[0165] Set reporting cycle (Typical value 60 seconds), each regulatory agent Regularly in this area The list of nodes determined to be in a malicious isolation state is reported to the coordinating agent. : .in, :area The regulatory intelligence.

[0166] Coordinating intelligent agents. :area The list of malicious isolated nodes reported. . :area The list of malicious isolated nodes reported. : Computing power node. :node In the region The determination of trust status in the process. : No. Each logical region.

[0167] The reported information includes: node identifier, judgment timestamp, and game termination round. and the posterior probability distribution at termination wait.

[0168] Coordinating intelligent agents After collecting the list of malicious nodes reported from all regions, a global consistency check is performed.

[0169] The significance of this reporting mechanism is that: Regular reporting avoids the communication storms caused by real-time reporting, balancing real-time performance with overhead.

[0170] The reported content includes game details (rounds, posterior probabilities), providing rich decision-making basis for global consistency verification.

[0171] The coordinating agent, acting as a global information aggregation point, breaks down information silos between regions.

[0172] The purpose of step S52 is to report and aggregate the global list of malicious nodes.

[0173] S53 coordinates the intelligent agents to resolve conflicts in the judgment results of the same node reported by multiple regions, generates a unified list of malicious nodes across the entire network, and distributes it to all regulatory intelligent agents to achieve global trust unification and output a global list of malicious nodes.

[0174] For the same node appearing in multiple region lists Conflict resolution is achieved through a majority voting mechanism. Global decision result. Represented as: .

[0175] in: :node The final global decision result. The result category is determined by the value of either "trustworthy", "continuous monitoring", or "malicious isolation". The node was reported. The set of region indexes for the determination results. :area For nodes The judgment result. The number of elements in the set. : Count the number of regions that meet the criteria. Take the expression that maximizes its value. value.

[0176] The system counts the number of regions classified as trustworthy, under continuous monitoring, and maliciously isolated, and selects the region with the highest count as the final classification. In the event of a tie, a conservative strategy is adopted to prioritize the region as maliciously isolated.

[0177] Based on the consistency check results, the coordinating agent generates a unified global list of malicious nodes across the entire network. And distribute it to all regulatory agents: .

[0178] in: : Region index. Total number of regions. Coordinating intelligent agents. :area The regulatory intelligence. : A global list of malicious nodes, including node identifiers, global judgment results, and judgment timestamps.

[0179] After receiving the global list of malicious nodes, each regulatory agent performs the following local synchronization operations: Update the local node status table: compare the global judgment result with the local record, and if they are inconsistent, the global judgment result shall be adopted first.

[0180] The evaluation parameters are dynamically adjusted: the trust threshold for this region is dynamically adjusted based on the distribution of malicious isolated nodes in the global list. For example, if the number of malicious isolated nodes in the global list surges, the threshold is lowered. and This allows more nodes to participate in the game process, thus strengthening the screening process.

[0181] Global Isolation Trigger: For nodes marked as maliciously isolated in the global list, even if the node has not yet completed the game locally or is under continuous monitoring, the supervisory agent can directly update it to the malicious isolation state and implement isolation.

[0182] The significance of this global consistency verification mechanism is that: The majority voting mechanism resolves the conflict issue of inconsistent judgments on the same node in different regions.

[0183] The use of a conservative strategy (prioritizing malicious intent in the event of a draw) reflects the principle of prioritizing safety.

[0184] After the global list is distributed, each region can dynamically adjust its local parameters based on the global situation to achieve adaptive security protection.

[0185] The global isolation triggering mechanism ensures that malicious nodes can be uniformly isolated across the entire network even if they have not yet been detected in certain areas.

[0186] The purpose of step S53 is to perform global consistency verification and policy distribution.

[0187] The purpose of step S5 is to achieve information sharing and cross-regional collaborative defense among multiple agents: real-time information sharing between regions is achieved through adjacent broadcasts, and network-wide consistency verification and policy unification are achieved through global aggregation and distribution, preventing malicious nodes from migrating across regions to evade punishment.

[0188] Step S6: Based on the global malicious node list and the final trust status of the nodes, the regulatory agent executes specific control strategies and dynamically adjusts system parameters according to the global distribution of malicious nodes. The network status after execution and the adjusted parameters are fed back to form an adaptive security control closed loop.

[0189] In this embodiment, step S6 may specifically include the following steps: S61, based on the global list of malicious nodes and the final trust status of nodes, immediately executes a multi-level local isolation strategy on nodes determined to be in a malicious isolation state, cutting off their ability to interact with the computing power network.

[0190] The supervisory agent executes the following local isolation policy on nodes determined to be in a malicious isolation state: Network isolation: Blocking network communication between a node and other nodes within the region can be achieved by configuring the access control list (ACL) of the edge gateway or issuing flow table rules.

[0191] Task scheduling isolation: Pause the allocation of new computing tasks to this node and remove it from the task scheduling queue.

[0192] Blacklist management: Add nodes to the local blacklist and record their malicious behavior characteristics (such as response error rate and number of verification failures).

[0193] Security alarm triggered: A security alarm event is generated, reported to the operation and maintenance management platform, and the security administrator is notified.

[0194] The isolation policy is implemented in real time; once malicious activity is detected, all subsequent interactions are immediately blocked.

[0195] The purpose of step S61 is to immediately implement a multi-level local isolation strategy for nodes that are determined to be in a malicious isolation state, cut off their ability to interact with the computing power network, and prevent them from causing further harm.

[0196] S62 restricts the permissions of nodes that are determined to be under continuous monitoring to participate in high-risk tasks and increases the frequency of behavior monitoring.

[0197] For nodes that are determined to be under continuous monitoring: Access restrictions: Only low-risk and non-sensitive computing tasks are permitted, such as read-only operations, data backup, and non-sensitive data analysis. Access to sensitive resources (such as encryption keys, core algorithms, and user privacy data) is prohibited.

[0198] Shorten the evaluation cycle: Change the evaluation cycle from the default... (e.g., 300 seconds) shortened to (e.g., 60 seconds) to monitor changes in its behavior more frequently.

[0199] Re-triggering the game: In subsequent evaluation periods, if the node's overall trust value falls back into the suspicious range, a multi-round incomplete information Bayesian game is re-triggered; if the overall trust value increases to... If it deteriorates to a trusted state, it will be restored to a trusted state; if it deteriorates to a trusted state... If so, it is determined to be a malicious isolation state.

[0200] The purpose of step S62 is to continuously restrict the permissions and increase the frequency of monitoring nodes to prevent unpredictable nodes from causing security risks, while providing them with an opportunity to recover.

[0201] S63 dynamically adjusts the trust threshold and game parameters of each region based on the distribution of the global malicious node list to achieve adaptive security protection.

[0202] Each regulatory agent periodically receives a global list of malicious nodes from the coordinating agent. And adjust the parameters dynamically accordingly: Threshold adaptive adjustment: If the number of malicious isolated nodes in the global list increases dramatically compared to the previous period (e.g., increases by more than 50%), then the trust threshold for the suspicious interval will be lowered. , ,in The step size is 0.05.

[0203] in: : Adjusted high confidence threshold. : High confidence threshold before adjustment. : Adjusted low confidence threshold. Low confidence threshold before adjustment.

[0204] Lowering the threshold will cause more nodes to fall into the suspicious zone and enter the game process, thereby strengthening the screening efforts across the entire network.

[0205] If the number of malicious nodes remains low, the default threshold can be gradually restored.

[0206] Game parameter adjustment: If malicious nodes are typically identified only after many rounds of gameplay, the termination threshold can be appropriately lowered. or This allows the game to end more quickly.

[0207] If a persistent monitoring state is observed due to frequent draws, the observation probability matrix can be adjusted. This makes it more distinctive.

[0208] Cooperative defense strategy triggered: When the number of malicious nodes globally exceeds a preset threshold, a network-wide collaborative defense mode is triggered, increasing the collection frequency, shortening the evaluation cycle, and lowering the suspicious threshold in all areas.

[0209] The purpose of step S63 is to improve the response capability to sudden attacks through global situational awareness and dynamic parameter adjustment.

[0210] The purpose of step S6 is to execute and dynamically adjust the strategy to form a closed-loop adaptive security management system.

[0211] This invention can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This invention can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This invention can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0212] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware through computer-readable instructions. These computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above methods. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, optical disk, or read-only memory (ROM), or random access memory (RAM).

[0213] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0214] Example 2 Further reference Figure 3 As a response to the above Figure 1 The present invention provides an embodiment of a computing power network security management and control device, which is similar to the implementation of the method shown. Figure 1 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0215] like Figure 3 As shown, the computing power network security management and control device 70 in this embodiment includes: a domain partitioning module 71, a supervisory intelligent agent module 72, a trust assessment module 73, a decision module 74, a cooperative broadcast module 75, and an adjustment module 76. Wherein: The domain partitioning module 71 is used to divide the computing power nodes into multiple logical regions, deploy a supervisory intelligent agent in each region, deploy a coordinating intelligent agent in the core node, and build a hierarchical collaborative management and control architecture. The regulatory intelligent agent module 72 is used to continuously collect node behavior data and calculate a comprehensive trust value with the regulatory intelligent agent as the execution subject, divide nodes into three categories of trustworthy, malicious and suspicious using dual thresholds, and output node information that falls into the suspicious interval. The trust assessment module 73 is used to take the node information as the verification object, and the supervisory agent actively issues a verification task and observes the response. It recursively updates the posterior probability of the true security type of the node based on the Bayesian formula and outputs the posterior probability distribution at the time of termination. The decision module 74 is used to take the posterior probability distribution as input, make a clear decision on the final trust state of the node by the regulatory agent according to the dominant probability principle, and output the node decision result. The collaborative broadcast module 75 is used to form a unified security view of the entire network by using the node determination result as the information carrier, through real-time broadcasting between adjacent regional regulatory agents and periodic reporting to the coordinating agent, and outputting a global list of malicious nodes. The adjustment module 76 is used to execute specific control strategies by the regulatory agent based on the global malicious node list and the final trust status of the nodes, and to dynamically adjust system parameters according to the global malicious node distribution, and to feed back the network status after execution and the adjusted parameters to form an adaptive security control closed loop.

[0216] Example 3 Further reference Figure 4 As a response to the above Figure 1 The present invention provides another embodiment of a computing power network security management and control device, which is similar to the method shown. Figure 1 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0217] like Figure 4 As shown, the computing power network security management and control device described in this embodiment includes: a data acquisition layer, a regional supervision layer, a global coordination layer, and a management and operation layer. The data acquisition layer consists of lightweight acquisition agents deployed on each computing power node, responsible for the local acquisition and reporting of node behavior data; the regional supervision layer consists of supervisory agents deployed on edge servers or gateway devices in each network region, responsible for trust assessment, multi-round game verification, and local isolation execution of nodes within the region; the global coordination layer consists of coordination agents deployed on the core server of the computing power network or the cloud management and control platform, responsible for the aggregation, consistency verification, and global distribution of the list of malicious nodes across the entire network; the management and operation layer provides system configuration and a visual human-computer interaction interface.

[0218] The data acquisition layer further includes: The behavioral data acquisition module uses lightweight acquisition agents deployed on each computing node to obtain core behavioral metrics of the nodes in real time. These metrics include the number of tasks successfully completed by the node, the total number of tasks assigned to the node, the average task completion time, average CPU utilization, average GPU utilization, average memory utilization, average bandwidth utilization, average task queue length, and average task response latency. The module supports multi-source data fusion and streaming reporting to ensure the real-time performance and integrity of the collected data. It also supports offline caching and breakpoint resumption to ensure no data loss during network fluctuations.

[0219] The data preprocessing module cleans and normalizes the collected raw behavioral data. It removes outlier or missing data points, normalizes the maximum and minimum values ​​of various indicators, eliminates dimensional differences between different indicators, and forms standardized behavioral observation vectors, providing a unified format of input data for regional regulatory trust assessments.

[0220] The regional regulatory body further includes: The regulatory agent management module divides the computing power network into multiple regions based on the principles of geographical proximity, management domain boundaries, and load balancing, and assigns a regulatory agent to each region. The module supports dynamic adjustment of region boundaries and management of node migration between regions. It maintains a local node state table for each regulatory agent, recording the node identifier, overall trust value, posterior probability distribution, current trust status, game round count, and historical response records for each node within its region. Simultaneously, the module maintains a local cross-regional node state table for the regulatory agent, recording the current trust status, judgment timestamp, and source region identifier of nodes in adjacent regions.

[0221] The trust assessment module performs periodic calculations of the node's overall trust value and determines suspicious intervals. Within each assessment period, based on node behavior data reported by the data acquisition layer, the module calculates a task completion quality score and a behavior consistency score, and obtains the node's overall trust value through a weighted average. The module compares the overall trust value with preset high-trust and low-trust thresholds, updates the node's trust status (trustworthy, continuously monitored, or maliciously isolated), and triggers an incomplete information Bayesian game when the trust value falls into a suspicious interval.

[0222] The Incomplete Information Bayesian Game module implements multi-round incomplete information Bayesian game functionality. The module first establishes a prior probability distribution of the node's true security type (high-trust type, medium-trust type, low-trust type) based on the node's comprehensive trust value. The module proactively sends response verification tasks to the nodes, including computational correctness verification, storage integrity verification, and behavioral compliance verification tasks, randomly selecting different types of tasks in each round. Based on the response results returned by the nodes, the module recursively updates the posterior probability using the observation probability matrix and Bayesian inference. The module supports three early termination mechanisms: high-trust type termination condition, low-trust type termination condition, and round-limited termination condition, achieving rapid convergence while ensuring accuracy. After the game is completed, the module determines the node's final state (trusted, maliciously isolated, or continuously monitored) based on the posterior probability distribution at termination.

[0223] The local isolation and policy enforcement module is responsible for executing local isolation policies on nodes determined to be in a malicious isolation state. Isolation policies include, but are not limited to: blocking network communication between the node and other nodes in the region, suspending the allocation of new computing tasks to the node, adding the node to a local blacklist, and triggering security alerts. For nodes under continuous monitoring, the module restricts their participation to low-risk and non-sensitive computing tasks and shortens the evaluation cycle to enhance monitoring.

[0224] The collaborative broadcasting and global synchronization module enables neighborly broadcasting and global synchronization among regulatory agents. After a regulatory agent completes the final state determination of a node, the module broadcasts the determination result (including source region identifier, node identifier, trust status, and timestamp) to all adjacent regulatory agents in real time. Simultaneously, the module periodically reports a list of nodes within its region that have been determined to be maliciously isolated to the coordinating agent. The module receives a global list of malicious nodes from the coordinating agent, updates its local node status table, prioritizes the global determination result, and dynamically adjusts the trust threshold parameters for its region based on the distribution of maliciously isolated nodes in the global list.

[0225] The global coordination layer further includes: The global aggregation module collects and verifies the consistency of malicious node lists reported by regional regulatory agents. Triggered by the reporting cycle, the module collects malicious node lists from all regions. For the same node appearing in multiple regional lists, the module uses a majority voting mechanism to resolve conflicts, counts the number of regions with each judgment result (trustworthy, continuously monitored, maliciously isolated), and takes the judgment result with the largest count as the final global judgment. In case of a tie, a conservative strategy is used to prioritize the malicious isolation state. Based on the consistency verification results, the module generates a unified global malicious node list for the entire network.

[0226] The global distribution and synchronization module is responsible for distributing the generated global list of malicious nodes to all supervisory agents. This module supports breakpoint resumption and asynchronous update mechanisms to ensure the reliability and timeliness of policy synchronization. Upon receiving the global list of malicious nodes, each supervisory agent performs local synchronization operations, including updating its local node status table, dynamically adjusting evaluation parameters, and triggering global isolation.

[0227] The global monitoring and auditing module provides real-time monitoring and historical auditing of the overall security status. The module records key information such as malicious node identification records and global consistency verification results reported by each region, and supports retrieval and auditing by node identifier, time range, and identification result. The module generates global security reports, providing data support for system operation and maintenance and policy optimization.

[0228] The management and maintenance layer further includes: The system configuration and management module provides a web-based management interface for system administrators to configure global parameters, including region division, evaluation cycle, trust thresholds (high trust threshold, low trust threshold), and game parameters (maximum number of game rounds, termination threshold, observation probability matrix). The module supports system health monitoring and anomaly alerts, displaying real-time operational status and key indicators such as resource utilization at each level.

[0229] The visualization module provides a visual console that displays the global topology of the computing network, the trust status distribution of nodes in each region, the real-time status of the game process, and information on the isolation of malicious nodes. Operations personnel can manually review the judgment results, mark false alarms and missed alarms, and manually trigger node isolation or recovery through the interface. The module supports multiple alarm notification methods, including work orders and emails, enabling human-machine collaborative security management decisions.

[0230] Example 4 To address the aforementioned technical problems, embodiments of the present invention also provide a computer device. Please refer to [link / reference needed]. Figure 5 , Figure 5 This is a basic structural block diagram of the computer device in this embodiment.

[0231] The aforementioned computer device 8 includes a memory 81, a processor 82, and a network interface 83 that are interconnected via a system bus. It should be noted that only the computer device 8 with components 81, 82, and 83 is shown in the figure; however, it should be understood that it is not required to implement all the shown components, and more or fewer components can be implemented alternatively. Those skilled in the art will understand that the computer device described herein is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0232] The aforementioned computer devices can be desktop computers, laptops, handheld computers, and cloud servers, among other computing devices. These devices can facilitate human-computer interaction with users through keyboards, mice, remote controls, touchpads, or voice-activated devices.

[0233] The aforementioned memory 81 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the aforementioned memory 81 may be an internal storage unit of the aforementioned computer device 8, such as the hard disk or memory of the computer device 8. In other embodiments, the aforementioned memory 81 may also be an external storage device of the aforementioned computer device 8, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 8. Of course, the aforementioned memory 81 may also include both the internal storage unit and its external storage device of the aforementioned computer device 8. In this embodiment, the aforementioned memory 81 is typically used to store the operating system and various application software installed on the aforementioned computer device 8, such as computer-readable instructions for computing power network security management methods, etc. In addition, the aforementioned memory 81 can also be used to temporarily store various types of data that have been output or will be output.

[0234] In some embodiments, the processor 82 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 82 is typically used to control the overall operation of the computer device 8. In this embodiment, the processor 82 is used to execute computer-readable instructions stored in the memory 81 or to process data, such as executing computer-readable instructions for the aforementioned computing power network security management method.

[0235] The network interface 83 may include a wireless network interface or a wired network interface, which is typically used to establish a communication connection between the computer device 8 and other electronic devices.

[0236] Example 5 The present invention also provides another embodiment, namely, providing a computer-readable storage medium storing computer-readable instructions that can be executed by at least one processor to cause the at least one processor to perform the steps of the computing power network security management method described above.

[0237] The beneficial effects of implementing the above embodiments are as follows: (1) Features decentralization and high availability: To address the single point of failure and performance bottlenecks of traditional centralized management and control, this invention constructs a distributed hierarchical management and control architecture through regional division and multi-agent deployment. Each regional regulatory agent operates independently, and the coordinating agent only performs global aggregation, eliminating the risk of central node failure and significantly improving the system's scalability and robustness.

[0238] (2) Enables proactive verification and accurate identification: To address the difficulty of identifying disguised malicious nodes through passive observation, this invention introduces a multi-round incomplete information Bayesian game mechanism to proactively issue verification tasks and dynamically update the posterior probability of node types based on Bayesian inference. This proactive verification method can effectively detect malicious nodes with deceptive behavior, significantly improving identification accuracy.

[0239] (3) Cross-domain collaboration and joint prevention and control: In response to the problem that malicious nodes can migrate across regions to evade punishment due to security information silos, this invention realizes rapid information sharing between regions and a unified security view of the entire network through real-time broadcasting between adjacent regions and global consistency verification. Once a malicious node is identified by any region, the adjacent regions can immediately take isolation measures.

[0240] (4) Adaptive dynamic defense: In view of the problem that static strategies cannot adapt to dynamic attack situations, this invention dynamically adjusts the trust threshold and game parameters according to the global distribution of malicious nodes, realizing the adaptive closed-loop adjustment of security strategies, which can reduce overhead when the risk is low and actively strengthen defense when the risk is high.

[0241] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0242] Obviously, the embodiments described above are merely some embodiments of the present invention, not all embodiments. The accompanying drawings show preferred embodiments of the present invention, but do not limit the patent scope of the present invention. The present invention can be implemented in many different forms; rather, these embodiments are provided to provide a more thorough and complete understanding of the disclosure of the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the patent protection scope of this invention.

Claims

1. A method for network security management and control of computing power, characterized in that, Includes the following steps: The computing power nodes are divided into multiple logical regions, a supervisory intelligent agent is deployed in each region, and a coordinating intelligent agent is deployed in the core nodes to build a hierarchical collaborative management and control architecture; Using the aforementioned regulatory intelligent agent as the execution subject, it continuously collects node behavior data and calculates a comprehensive trust value. It uses dual thresholds to classify nodes into three categories: trustworthy, malicious, and suspicious, and outputs information on nodes that fall into the suspicious range. Using the node information as the verification object, the regulatory agent actively issues verification tasks and observes the response. Based on Bayes' theorem, the posterior probability of the node's true security type is recursively updated, and the posterior probability distribution at the time of termination is output. Using the posterior probability distribution as input, the regulatory agent makes a clear judgment on the final trust state of the node based on the dominant probability principle, and outputs the node judgment result. Using the node determination results as information carriers, the network forms a unified security view by real-time broadcasting between adjacent regional regulatory agents and periodic reporting to the coordinating agent, and outputs a global list of malicious nodes. Based on the global malicious node list and the final trust status of the nodes, the regulatory agent executes specific control strategies and dynamically adjusts system parameters according to the global malicious node distribution. The network status after execution and the adjusted parameters are fed back to form an adaptive security control closed loop.

2. The computing power network security management and control method according to claim 1, characterized in that, The steps of dividing computing power nodes into multiple logical regions, deploying a supervisory intelligent agent in each region, and deploying a coordinating intelligent agent on the core node to construct a hierarchical collaborative management and control architecture specifically include: Based on the principles of geographical proximity, management domain boundaries, and load balancing, the computing power node set is divided into multiple non-overlapping regions; Deploy independent regulatory agents in each region to be responsible for trust assessment, game theory verification and local isolation within the region, and deploy coordination agents at core nodes to be responsible for global information aggregation, consistency verification and policy distribution; Establish a lightweight communication channel between adjacent regulatory agents and initialize the state table of each agent.

3. The computing power network security management and control method according to claim 1, characterized in that, The steps of using the regulatory intelligent agent as the execution subject, continuously collecting node behavior data and calculating a comprehensive trust value, classifying nodes into three categories—trustworthy, malicious, and suspicious—using dual thresholds, and outputting information about nodes falling into the suspicious range specifically include: During each evaluation cycle, the regulatory agent collects node behavior metrics from the agent and calculates the task completion quality score. Define a behavioral observation vector, construct a historical baseline vector using an exponentially weighted moving average, and calculate a behavioral consistency score. The system integrates scores from two dimensions: task completion quality and behavioral consistency. It calculates a comprehensive trust value and identifies suspicious intervals. Using dual thresholds, nodes are classified into three categories: trustworthy, malicious, and suspicious. The system outputs information about nodes that fall into the suspicious interval.

4. The computing power network security management and control method according to claim 1, characterized in that, The steps of using the node information as the verification object, having the regulatory agent actively issue verification tasks and observe responses, recursively updating the posterior probability of the node's true security type based on Bayes' formula, and outputting the posterior probability distribution at termination specifically include: Using the node information as the verification object, a category space for the true security type of the node is defined, and the node's comprehensive trust value is mapped to a priori probability distribution. Actively issue various types of verification tasks, obtain the response behavior of nodes, and define the probability distribution of node responses for different security types to provide a likelihood function for Bayesian updates; After each round of the game, based on the observation results, the posterior probability of a node belonging to each type of security is recursively updated according to Bayes' theorem. The game terminates early when the confidence threshold is met or the maximum number of rounds is reached, and the posterior probability distribution at the time of termination is output.

5. The computing power network security management and control method according to claim 1, characterized in that, The step of taking the posterior probability distribution as input, having the regulatory agent make a clear judgment on the final trust state of the node based on the dominant probability principle, and outputting the node judgment result specifically includes: Using the posterior probability distribution as input, and based on the posterior probability distribution at the end of the game, the dominant type is selected as the final trust state of the node, and the decision result is output. For nodes identified as being under continuous monitoring, their permissions are restricted and the monitoring frequency is increased; The final judgment result is persisted to the local node state table, and the game round and posterior probability information are recorded. The node judgment result is then output.

6. The computing power network security management and control method according to claim 1, characterized in that, The steps of using the node determination result as an information carrier, and through real-time broadcasting between adjacent regional regulatory agents and periodic reporting to the coordinating agent to form a unified security view of the entire network and output a global list of malicious nodes specifically include: The node determination results in this region are broadcast to the regulatory agents in all adjacent regions in real time to achieve rapid collaborative response between regions. Each regulatory intelligence agent periodically reports the list of nodes identified as maliciously isolated within its region to the coordinating intelligence agent, which then aggregates the data globally to form a unified security view across the entire network. The coordinating agent resolves conflicts in the judgment results of the same node reported by multiple regions, generates a unified list of malicious nodes across the entire network, and distributes it to all regulatory agents to achieve global trust unification and output a global list of malicious nodes.

7. The computing power network security management and control method according to any one of claims 1 to 6, characterized in that, The steps of having the supervisory agent execute specific control strategies based on the global malicious node list and the final trust status of the nodes, dynamically adjust system parameters according to the global malicious node distribution, and provide feedback on the network status and adjusted parameters after execution to form an adaptive security control closed loop specifically include: Based on the global malicious node list and the node's final trust status, a multi-level local isolation strategy is immediately implemented for nodes determined to be in a malicious isolation state, cutting off their ability to interact with the computing power network. For nodes identified as being under continuous monitoring, restrict their access to high-risk tasks and increase the frequency of behavioral monitoring. Based on the distribution of the global malicious node list, the trust threshold and game parameters of each region are dynamically adjusted to achieve adaptive security protection.

8. A computing power network security management and control device, characterized in that, include: The domain partitioning module is used to divide the computing power nodes into multiple logical regions, deploy a supervisory agent in each region, and deploy a coordinating agent in the core nodes to build a hierarchical collaborative management and control architecture. The regulatory intelligent agent module is used to continuously collect node behavior data and calculate a comprehensive trust value, using the regulatory intelligent agent as the execution subject. It then uses dual thresholds to classify nodes into three categories: trustworthy, malicious, and suspicious, and outputs information about nodes that fall into the suspicious range. The trust assessment module is used to verify the node information. The supervisory agent actively issues verification tasks and observes the responses. Based on Bayes' formula, it recursively updates the posterior probability of the node's true security type and outputs the posterior probability distribution at the time of termination. The decision module is used to take the posterior probability distribution as input, and make a clear decision on the final trust state of the node by the regulatory agent according to the dominant probability principle, and output the node decision result. The collaborative broadcast module is used to form a unified security view of the entire network by using the node determination result as the information carrier, through real-time broadcasting between adjacent regional regulatory agents and periodic reporting to the coordinating agent, and outputting a global list of malicious nodes. The adjustment module is used to execute specific control strategies by the regulatory agent based on the global malicious node list and the final trust status of the nodes, and to dynamically adjust system parameters according to the global malicious node distribution. The module also provides feedback on the network status after execution and the adjusted parameters to form an adaptive security control closed loop.

9. A computer device, characterized in that, The system includes a memory and a processor, wherein the memory stores computer-readable instructions, and the processor executes the computer-readable instructions to implement the steps of the computing power network security management method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the computing power network security management method as described in any one of claims 1 to 7.

Images