A flow-aware resource scheduling method for large-scale network target range

Abstract

The application belongs to the technical field of cloud computing and network space security simulation, and particularly relates to a traffic-aware resource scheduling method for large-scale network ranges, which comprises the following steps: constructing a hybrid virtualization system for large-scale network ranges; analyzing a network range description file uploaded by a user to generate an undirected attribute graph, and obtaining a predicted traffic correlation matrix L through graph convolution network inference; collecting resource load data of physical computing nodes and constructing a physical distance matrix, and combining the predicted traffic correlation matrix L to construct a multi-objective fitness function; based on the multi-objective fitness function, generating a global optimal resource mapping matrix through a genetic-whale hybrid evolutionary scheduling algorithm; generating a scheduling instruction according to the global optimal resource mapping matrix, and realizing collaborative instantiation scheduling of virtual machines and containers on specified physical computing nodes through a cloud platform interface; and the application effectively avoids the defects of traditional methods, such as complicated configuration and easy to fall into local extreme value.

Description

Technical Field

[0001] This invention belongs to the interdisciplinary field of cloud computing and cyberspace security simulation, specifically involving a traffic-aware resource scheduling method for large-scale network test ranges. Background Technology

[0002] As the cybersecurity landscape becomes increasingly complex, network test ranges, as critical infrastructure supporting network attack and defense drills, security technology verification, and the training of specialized personnel, are experiencing a continuous rise in construction scale and system complexity. To highly replicate real network environments, modern network test ranges commonly employ virtualization technologies (such as virtual machines and containers) to construct large-scale simulation node clusters. However, under the existing technological framework, resource scheduling mechanisms for large-scale network test ranges still face the following key challenges:

[0003] First, there is a lack of awareness of attack and defense traffic. Current mainstream scheduling strategies primarily follow the resource management paradigm of cloud computing platforms, focusing their optimization on the utilization and binning rate of computing resources such as CPU and memory, while treating nodes to be deployed as independent entities. This scheduling model severely ignores the unique "business chain" topology characteristics of network test ranges. In actual attack and defense exercises, there are often close logical connections and high-frequency bursts of traffic between attack sources, jump servers, routing gateways, and victim machines. If traditional random or load balancing scheduling is used, logically tightly coupled business nodes are easily physically dispersed across different racks or even data centers. This mismatch between physical and logical topology forces a large amount of attack and defense traffic to frequently detour through the underlying physical network, not only excessively consuming core switching bandwidth but also introducing significant network latency and jitter, severely damaging the real-time performance and interactive experience of the exercise.

[0004] Second, manual configuration is insufficient for large-scale dynamic scenarios. To alleviate the aforementioned traffic issues, existing methods largely rely on administrators manually configuring static affinity groups or traffic weights based on experience. However, in large-scale test environments with a large number of nodes and complex, ever-changing topologies, attack and defense links are often hidden within intricate network connections. Relying on manual experience to analyze and statically configure traffic correlation matrices is not only labor-intensive and inefficient, but also highly susceptible to errors that could lead to drill anomalies. Existing technologies lack intelligent means to automatically mine, learn, and predict attack and defense traffic characteristics from complex topologies, making them unsuitable for dynamically generated and rapidly iterative drill requirements.

[0005] Third, traditional algorithms lack the ability to find optimal solutions in large-scale solution spaces. Network range resource scheduling is essentially a multi-objective NP-hard optimization problem. As the range expands to the level of thousands of nodes, the solution space grows exponentially. Traditional metaheuristic algorithms (such as standard genetic algorithms and particle swarm optimization) are prone to getting trapped in local optima due to premature loss of population diversity during the search process. This results in a deployment scheme that, while achieving a balanced computational load, falls far short of global optimum in key indicators such as network communication overhead and security isolation, making it difficult to meet the stringent requirements of high performance and high security for large-scale attack and defense exercises. Summary of the Invention

[0006] To address the above problems, this invention provides a traffic-aware resource scheduling method for large-scale network test ranges, comprising the following steps:

[0007] S1. Construct a hybrid virtualization system for large-scale network test ranges, comprising a physical resource layer, a virtualization layer, and a control layer; wherein:

[0008] The physical resource layer includes M physical computing nodes; the physical resource layer is strictly divided into a red team attack zone, a blue team defense zone, and a white team control zone at the logical level; and each physical computing node is configured with a corresponding security attribute label;

[0009] The virtualization layer includes the Nova component and the Zun component. The Nova component is responsible for managing virtual machines, and the Zun component is responsible for managing containers.

[0010] The main control layer is equipped with an intelligent scheduling controller, which is used to take over the native scheduling logic of the Nova and Zun components;

[0011] S2. The intelligent scheduling controller parses the user-uploaded network range description file to generate an undirected attribute graph, and obtains the predicted traffic correlation matrix L through graph convolutional network inference; where, the elements l of the predicted traffic correlation matrix L... ij The predicted probability intensity of high-frequency traffic interaction between node i and node j due to business dependencies during the exercise was quantified.

[0012] S3. Collect resource load data of physical computing nodes and construct a physical distance matrix. Combine the predicted traffic correlation matrix L to construct a multi-objective fitness function that comprehensively considers load balancing, communication overhead and security penalties.

[0013] S4. Based on a multi-objective fitness function, a globally optimal resource mapping matrix is ​​generated through a genetic-whale hybrid evolutionary scheduling algorithm.

[0014] S5. Generate scheduling instructions based on the global optimal resource mapping matrix, and use the cloud platform interface to achieve collaborative instantiation scheduling of virtual machines and containers on a specified physical computing node.

[0015] The beneficial effects of this invention are:

[0016] To address the high complexity challenge of resource scheduling in large-scale network test ranges, this invention establishes a deep learning-assisted traffic prediction model and employs an improved genetic-whale hybrid evolutionary algorithm for global optimization. This effectively avoids the drawbacks of traditional methods, such as cumbersome configuration and susceptibility to local extrema, and achieves efficient and accurate resource scheduling.

[0017] Specifically, this invention utilizes deep learning technology to replace human experience, accurately predicting the implicit traffic characteristics of the attack and defense business chain. It also guides the aggregation and deployment of high-traffic nodes at the physical layer through algorithms, effectively reducing cross-switch communication overhead and eliminating the interference of physical network bandwidth on simulation experiments. Simultaneously, by embedding a genetic mutation operator into the whale optimization algorithm, it enhances the algorithm's global search capability in a large-scale solution space, effectively solving the problem of premature convergence of a single algorithm and ensuring the global optimality of the resource mapping scheme. This maximizes the resource utilization and load balancing of the physical cluster while guaranteeing business performance and security isolation. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the overall process of the method of the present invention;

[0019] Figure 2 This is a schematic diagram of the architecture of the hybrid virtualization system in an embodiment of the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] This invention aims to provide a traffic-aware resource scheduling method for large-scale network test ranges. Its core objective is to address the key bottlenecks faced by existing technologies in dealing with large-scale, complex attack and defense scenarios: firstly, a lack of real-time intelligent perception of service traffic; secondly, reliance on manually configured association rules, which is cumbersome and difficult to adapt to dynamically changing network topologies; and thirdly, traditional scheduling strategies are prone to getting trapped in local optima within a vast solution space, resulting in high network communication overhead and severely limiting the realism of the simulation environment.

[0022] Please see Figures 1-2 This invention proposes a traffic-aware resource scheduling method for large-scale network test ranges, comprising the following steps:

[0023] S1. Construct a hybrid virtualization system for large-scale network test ranges, which includes a physical resource layer, a virtualization layer, and a control layer.

[0024] In some embodiments, a hybrid virtualization system comprising a physical resource layer, a virtualization layer, and a control layer is constructed based on the OpenStack open-source cloud platform architecture.

[0025] The physical resource layer consists of M physical computing nodes, denoted as H = {h1, h2, ..., h}. M At the network architecture level, the physical resource layer adopts a high-performance Spine-Leaf topology to provide non-blocking data exchange capabilities and ensure high efficiency in underlying communication. To meet the stringent security requirements of the network range, the physical resource layer implements strict isolation and partitioning strategies at the logical level, primarily dividing it into three security domains: the red team attack zone, the blue team defense zone, and the white team control zone. Furthermore, to achieve fine-grained security management, the system configures corresponding security attribute tags for each physical computing node.

[0026] The virtualization layer primarily consists of two core components, Nova and Zun, providing differentiated management capabilities for two different virtualization resource types: virtual machines and containers. The Nova component manages the entire lifecycle of virtual machines, and its architecture is designed for business nodes with extremely high isolation requirements in large-scale network test environments (such as attack simulators and virus sample analyzers), ensuring the secure isolation and stable operation of critical business nodes. The Zun component focuses on managing container instances, suitable for lightweight business nodes such as web targets and traffic probes, enabling rapid resource deployment and elastic scaling. Nova and Zun are deployed under a unified virtual network controller, leveraging VXLAN tunneling technology to effectively shield the heterogeneity of the underlying physical network, thereby achieving Layer 2 logical network interconnection across heterogeneous resources.

[0027] The main control layer deploys an intelligent scheduling controller built on the Java language. As the system's decision-making core, the intelligent scheduling controller operates independently of the underlying infrastructure. Its core responsibility is to take over and override the default scheduling logic of OpenStack native compute services (Nova) and container services (Zun). The intelligent scheduling controller is primarily responsible for receiving and parsing the exercise scenario definitions, executing the core scheduling algorithm, and ultimately issuing precise resource orchestration and scheduling instructions to the underlying execution layer through a standardized RESTful API interface.

[0028] S2. The intelligent scheduling controller parses the user-uploaded network range description file to generate an undirected attribute graph, and obtains the predicted traffic correlation matrix L through graph convolutional network inference; where, the elements l of the predicted traffic correlation matrix L... ij The predicted probability intensity of high-frequency traffic interaction between node i and node j due to business dependencies during the exercise was quantified.

[0029] In some embodiments, to address the technical problems of highly concealed, sudden, and difficult-to-quantify traffic flow in large-scale attack and defense exercises, this invention employs Graph Neural Network (GNN) technology to perform deep feature extraction and modeling of implicit traffic relationships between nodes based on the system's logical topology. The specific implementation process includes:

[0030] S21. Map the network target description file to an undirected attribute graph G=(V,E), where V represents the set of nodes and E represents the set of logical connection edges; construct the initial feature matrix Y, where Y i Represents node v i The initial eigenvectors of ∈V.

[0031] Furthermore, assuming there are N nodes in an undirected attribute graph G, for each node in G, the system extracts its set of static attributes based on the metadata definition of the orchestration template, and constructs the initial feature vector of the node based on this. Specifically, the construction of the initial feature vector mainly covers the following four dimensions: resource type (virtual machine or container), image type characteristics, business service port characteristics, and security domain identifier.

[0032] S22. To capture higher-order topological dependencies between nodes, a graph convolutional network is used to process the initial feature matrix Y, obtaining a node representation matrix Z containing higher-order semantic information; the feature propagation and update rules of the (l+1)th layer in the graph convolutional network are as follows:

[0033]

[0034] In the formula, H (l) H represents the input matrix of the (l+1)th layer. (l+1) This represents the output matrix of the (l+1)th layer; specifically, the input matrix of the first layer of the graph convolutional network is the initial feature matrix Y, i.e., H. (0) =Y; σ(·) represents the ReLU nonlinear activation function. This represents the adjacency matrix with added self-loops, where A represents the original adjacency matrix, and I represents the adjacency matrix with added self-loops. N It represents an N×N dimensional identity matrix. By introducing self-connections, it ensures that the feature information of the nodes themselves can be preserved and aggregated during graph convolution. express The corresponding degree matrix, its diagonal elements , Used to perform symmetric normalization on the adjacency matrix to prevent numerical instability; W (l) This represents the trainable weight matrix of the l-th layer, used for linear transformation of the feature space.

[0035] S23. Using the inner product decoder, the node representation matrix Z is transformed into an N×N dimensional predicted flow correlation matrix L between node pairs, expressed as:

[0036]

[0037] In the formula, Z T The node represents the transpose of matrix Z, and Sigmoid(·) represents the inner product decoder, which is used to map the inner product result to the interval [0,1].

[0038] S3. Collect resource load data of physical computing nodes and construct a physical distance matrix. Combine the predicted traffic correlation matrix L to construct a multi-objective fitness function that comprehensively considers load balancing, communication overhead and security penalties.

[0039] Resource scheduling in a large-scale network range environment is fundamentally about resolving the trade-off between "service performance" and "system security." The goal of this step is to design a comprehensive evaluation model that achieves dynamic load balancing of system resources while ensuring service communication performance and maintaining the physical security of the range.

[0040] In some embodiments, step S3 specifically includes:

[0041] S31. Real-time collection of resource load data of each physical computing node in the physical resource layer through the underlying virtualization interface, wherein the resource load data includes CPU utilization, memory utilization, disk I / O utilization and network bandwidth throughput.

[0042] S32. Construct the physical distance matrix D phy , where d ij d represents the physical distance between node i and node j. If node i and node j are deployed on the same physical server (i.e., physical computing nodes), then d ij =0, in this case it is memory copy communication; otherwise d ij =1, at this time it is network forwarding communication.

[0043] S33. Define the conflict function Conflict(i,j) to characterize whether there is a physical co-occurrence conflict between node i and node j. If node i and node j belong to the red team's attack zone and the blue team's defense zone respectively, or belong to the red team's attack zone and the neutral gray zone respectively, then it is determined that node i and node j have a physical co-occurrence conflict, and Conflict(i,j)=1. Otherwise, Conflict(i,j)=0, that is, co-occurrence is allowed within the same domain or between blue and white.

[0044] It is important to note that, to ensure system security and effectively prevent virtual machine escape and side-channel attack risks, this embodiment of the invention implements physical anti-affinity rules on target range nodes based on a preset three-domain security architecture: red team attack zone, blue team defense zone, and white team control zone. The specific strategy is as follows: high-risk nodes such as attack machines and malicious traffic generators are assigned to the red team attack zone; core defense facilities and high-value targets are assigned to the blue team defense zone; and neutral nodes such as referee servers and traffic probes are assigned to the white team control zone.

[0045] S34. Construct a multi-objective fitness function F(X) for a scheduling scheme X, expressed as:

[0046]

[0047] In the formula, α, β, and γ represent weighting coefficients, and V load D represents the load balancing item. comm P represents the communication overhead item. sec This represents a safety penalty term. The objective of this invention is to minimize the value of the multi-objective fitness function F(X). Wherein:

[0048] To avoid a single resource bottleneck, a weighted variance is used to calculate the load balancing term, expressed as:

[0049]

[0050] In the formula, ω1, ω2, and ω3 represent the dimension weights. This represents the variance of CPU utilization. This represents the variance of memory utilization. This represents the variance of disk I / O utilization. Specifically, normalization is performed to eliminate evaluation biases caused by different units of measurement before calculating the variance of each resource. A smaller load balancing term indicates a more uniform distribution of resource load across physical computing nodes.

[0051] The communication overhead term is calculated using the predicted traffic correlation matrix L, and is expressed as follows:

[0052]

[0053] When the prediction probability strength l ijApproaching 1 (strong correlation) and physical distance d ij When the value is 1 (cross-machine deployment), the overhead penalty increases significantly, thus driving the algorithm to find a solution to aggregate high-frequency communication tasks to the same physical computing node.

[0054]

[0055] II represents the characteristic function, which is 1 only when two nodes co-host. i This represents the physical computing node number deployed on node i, and Ω represents the preset maximum penalty constant (e.g., 10). 9 The security penalty adopts a "one-vote veto" strategy to enforce physical isolation between different security domains. During the scheduling scheme evaluation process, if mutually exclusive nodes (such as red-blue nodes or red-white nodes) are detected to be assigned to the same host machine, the fitness function value will surge instantly, causing the scheduling scheme to be directly eliminated in the evolutionary selection stage of the genetic algorithm.

[0056] S4. Based on the multi-objective fitness function, a globally optimal resource mapping matrix is ​​generated through a genetic-whale hybrid evolutionary scheduling algorithm.

[0057] To address the challenges posed by the high dimensionality of the solution space and complex constraints in large-scale network range resource scheduling scenarios, where traditional heuristic algorithms are prone to getting trapped in local optima, this paper proposes a genetic-whale hybrid evolutionary scheduling algorithm (GA-WOA) to achieve global optimization and solution.

[0058] In some embodiments, step S4 includes:

[0059] S41. Initialization phase: Construct a global topology probability guidance matrix P based on the predicted traffic correlation matrix L; Based on the global topology probability guidance matrix P, use a roulette wheel selection strategy to generate an initial population with binary encoding.

[0060] In some embodiments, to overcome the quality deficiencies of traditional random initialization methods in generating initial solutions, this invention constructs a global topology probability guidance matrix P of size N×M based on the predicted traffic correlation matrix L and the physical topology state, including:

[0061]

[0062]

[0063] In the formula, P im B represents the topology fit probability of physical computation node m to node i; im S represents the potential energy of the traffic attraction between physical computing node m and node i, used to aggregate the traffic traction force of deployed nodes; deployed Represents the set of predecessor nodes that have been deployed in the current sequence, lin δ represents the predicted probability strength between node i and its predecessor node n; nm The position indicator function is δ, which indicates that if the preceding node n is located at the physical computation node m. nm =1; This represents the fundamental potential energy constant.

[0064] This invention utilizes the Softmax function to transform potential energy into a normalized probability distribution P. im Based on the global topological probability guidance matrix P, a roulette wheel selection is performed to generate an initial population with high flow aggregation characteristics.

[0065] S42. Hybrid Evolutionary Stage: In each iteration cycle, a global search is first performed using the whale optimization algorithm to generate an intermediate population; then, selection, crossover, and mutation operations are performed on the intermediate population; finally, the individuals after genetic operations are discretized and mapped.

[0066] Specifically, within each iteration cycle, a global search is first performed using the spiral update mechanism of the Whale Optimization Algorithm (WOA), i.e.:

[0067] Using the current globally optimal solution X * Guided by (t), individuals in the population are driven to simulate the spiral bubble web behavior of humpback whales, generating an updated continuous solution vector X. cont (t+1), the position update formula is as follows:

[0068]

[0069] In the formula, b represents the spiral shape constant, l represents a random number in the range [-1, 1], and X(t) represents the current position vector of the individual at the current iteration number t. This step utilizes the gradient information of the whale algorithm to enable the population to quickly approach the high-potential region in the solution space.

[0070] Specifically, to overcome the problem of population diversity loss in the later stages of the algorithm, selection, crossover, and mutation operations are performed on the intermediate population. The crossover operation is represented as:

[0071]

[0072] In the formula, X cross X represents the offspring position vector generated after the crossover operation. i Let λ represent the position vectors of two parent individuals randomly selected from the intermediate state population, and let λ represent the cross-weight coefficient.

[0073] The mutation operation is represented as:

[0074]

[0075] In the formula, X mut N(0,σ) represents the offspring individual location vector generated after the mutation operation, θ represents the mutation intensity coefficient, and N(0,σ) represents the offspring individual location vector. 2 ) indicates that the mean is 0 and the variance is σ. 2 Gaussian normal distribution random variable

[0076] Specifically, given that the security attribute labels of physical computing nodes are discrete integers, the system needs to accurately map the individuals (i.e., continuous solution vectors) after genetic operations to the numbering space of the physical computing nodes. The discretization mapping of the individuals after genetic operations includes:

[0077] S421. The Sigmoid function is used to compress the individuals after genetic operations to a normalized interval and map them to the integer range [0, M-1] to obtain discretized individuals;

[0078] S422. Determine whether there is a physical co-occurrence conflict among the discretized individuals (i.e., violating the hard constraints of red-blue or red-white physical isolation). If so, migrate the violating node to the nearest physical computing node in its security domain.

[0079] S43. Termination determination phase: After each iteration, if the maximum number of iterations is reached or the early termination condition is met, the global optimal resource mapping matrix is ​​output; otherwise, the iteration count is incremented and the process returns to step S42.

[0080] Specifically, the early stopping condition for convergence is that the global optimal solution does not improve significantly within τ consecutive iterations.

[0081] This algorithm ensures solution quality while effectively avoiding invalid iterations, thus meeting the real-time requirements of network range resource scheduling.

[0082] S5. Generate scheduling instructions based on the global optimal resource mapping matrix, and use the cloud platform interface to achieve collaborative instantiation scheduling of virtual machines and containers on a specified physical computing node.

[0083] This stage serves as the execution terminal of the scheduling system. Its core function is to instantiate the optimal scheduling scheme into physical resources and, based on practical feedback, achieve adaptive evolution of the scheduling model. The specific implementation process is as follows:

[0084] First, heterogeneous resource orchestration based on the OpenStack architecture is performed. The intelligent scheduling controller parses the globally optimal resource mapping matrix output by S3 and performs unified scheduling of underlying services through a standardized southbound interface.

[0085] For virtual machine tasks, the intelligent scheduler controller uses the OpenStack Nova service to strongly bind virtual machine instances to the target physical compute node.

[0086] For containerized tasks, the intelligent scheduler controller anchors container instances to the target physical compute node through the OpenStack Zun service.

[0087] Simultaneously, fine-grained network policy injection is implemented. Utilizing OpenStack Neutron components, virtual network flow tables and security group policies are dynamically distributed, enforcing network isolation in red, blue, and white zones. This ensures that logical security constraints are accurately mapped and strictly enforced in the physical environment, thus achieving seamless integration from the virtualization solution to the physical runtime environment.

[0088] In some embodiments, after completing the target range environment delivery in step S5 and ending a single exercise, the system will construct a real-world traffic correlation matrix L based on the real communication logs collected by the physical switch and the virtual bridge. real And calculate the mean squared error loss between it and the predicted flow correlation matrix L generated in step S2, using the following formula:

[0089]

[0090] In the formula, L represents the actual traffic correlation matrix real Element.

[0091] The system uses this loss value as a feedback signal to incrementally train the graph convolutional neural network based on the backpropagation algorithm, in order to correct its cognitive biases in identifying specific attack and defense business traffic characteristics. By constructing a closed-loop optimization mechanism of "prediction-scheduling-practice-feedback", the system achieves continuous perception and adaptive learning of the dynamic evolution of attack and defense scenarios, thereby ensuring the long-term effectiveness of the scheduling strategy.

[0092] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A traffic-aware resource scheduling method for large-scale network test ranges, characterized in that, Includes the following steps: S1. Construct a hybrid virtualization system for large-scale network test ranges, comprising a physical resource layer, a virtualization layer, and a control layer; wherein: The physical resource layer comprises M physical computing nodes; logically, the physical resource layer is strictly divided into a red team attack zone, a blue team defense zone, and a white team control zone; and each physical computing node is configured with a corresponding security attribute label. The virtualization layer includes the Nova component and the Zun component. The Nova component is responsible for managing virtual machines, and the Zun component is responsible for managing containers. The main control layer is equipped with an intelligent scheduling controller, which is used to take over the native scheduling logic of the Nova and Zun components; S2. The intelligent scheduling controller parses the user-uploaded network range description file to generate an undirected attribute graph, and obtains the predicted traffic correlation matrix L through graph convolutional network inference; where, the elements l of the predicted traffic correlation matrix L... ij The predicted probability intensity of high-frequency traffic interaction between node i and node j due to business dependencies during the exercise was quantified. S3. Collect resource load data of physical computing nodes and construct a physical distance matrix. Combine the predicted traffic correlation matrix L to construct a multi-objective fitness function that comprehensively considers load balancing, communication overhead and security penalties. S4. Based on a multi-objective fitness function, a globally optimal resource mapping matrix is ​​generated through a genetic-whale hybrid evolutionary scheduling algorithm. S5. Generate scheduling instructions based on the global optimal resource mapping matrix, and use the cloud platform interface to achieve collaborative instantiation scheduling of virtual machines and containers on a specified physical computing node.

2. The traffic-aware resource scheduling method for large-scale network ranges according to claim 1, characterized in that, Step S2 includes: S21. Map the network target description file to an undirected attribute graph G=(V,E), where V represents the set of nodes and E represents the set of logical connection edges; construct the initial feature matrix Y, where Y i Represents node v i The initial eigenvectors of ∈V, the initial eigenvectors Y i It covers four dimensions: resource type, image type characteristics, business service port characteristics, and security domain identifier; S22. The initial feature matrix Y is processed using a graph convolutional network to obtain the node representation matrix Z. The processing includes: ， In the formula, H (l) H represents the input matrix of the l-th layer. (0) =Y; σ(·) represents the ReLU nonlinear activation function. This represents the adjacency matrix with added self-loops, where A represents the original adjacency matrix, and I represents the adjacency matrix with added self-loops. N Represents the identity matrix. express The corresponding degree matrix, W (l) This represents the trainable weight matrix of the l-th layer; S23. Transform the node representation matrix Z into the predicted flow correlation matrix L, as follows: ， In the formula, Z T The node represents the transpose of matrix Z, and Sigmoid(·) represents the inner product decoder.

3. The traffic-aware resource scheduling method for large-scale network ranges according to claim 1, characterized in that, Step S3 includes: S31. Collect resource load data of each physical computing node in the physical resource layer, including CPU utilization, memory utilization, disk I / O utilization and network bandwidth throughput; S32. Construct the physical distance matrix D phy , where d ij This represents the physical distance between node i and node j. If node i and node j are deployed on the same physical server, then d ij =0, otherwise d ij =1; S33. Define the conflict function Conflict(i,j) to characterize whether there is a physical co-occurrence conflict between node i and node j. If node i and node j belong to the red team's attack zone and the blue team's defense zone respectively, or belong to the red team's attack zone and the neutral gray zone respectively, then it is determined that node i and node j have a physical co-occurrence conflict. In this case, Conflict(i,j)=1, otherwise Conflict(i,j)=0. S34. Construct a multi-objective fitness function F(X), expressed as: ， ， ， ， In the formula, α, β, and γ represent weighting coefficients, and V load D represents the load balancing item. comm P represents the communication overhead item. sec This represents the security penalty term, and ω1, ω2, and ω3 represent the dimension weights. This represents the variance of CPU utilization. This represents the variance of memory utilization. II represents the variance of disk I / O utilization; Ⅱ represents the indicator function, Host i Ω represents the physical computing node number deployed on node i, Ω represents the preset maximum penalty constant, and N represents the number of nodes.

4. The traffic-aware resource scheduling method for large-scale network test ranges according to claim 1, characterized in that, Step S4 includes: S41. Initialization phase: Construct a global topology probability guidance matrix P based on the predicted traffic correlation matrix L; Based on the global topology probability guidance matrix P, use a roulette wheel selection strategy to generate an initial population with binary encoding; S42. Hybrid Evolutionary Stage: In each iteration cycle, a global search is first performed using the whale optimization algorithm to generate an intermediate population; then, selection, crossover, and mutation operations are performed on the intermediate population; finally, the individuals after genetic operations are discretized and mapped. S43. Termination determination phase: After each iteration, if the maximum number of iterations is reached or the early termination condition is met, the global optimal resource mapping matrix is ​​output; otherwise, the iteration count is incremented and the process returns to step S42.

5. A traffic-aware resource scheduling method for large-scale network ranges according to claim 4, characterized in that, Construct a global topological probability guidance matrix P of size N×M based on the predicted traffic correlation matrix L, including: ， ， In the formula, P im B represents the topology fit probability of physical computation node m to node i. im S represents the attraction potential energy between physical computing nodes m and i, representing the flow attraction between them; deployed Represents the set of predecessor nodes that have been deployed in the current sequence, l in δ represents the predicted probability strength between node i and its predecessor node n; nm The position indicator function is δ, which indicates that if the preceding node n is located at the physical computation node m. nm =1; This represents the fundamental potential energy constant.

6. A traffic-aware resource scheduling method for large-scale network test ranges according to claim 4, characterized in that, Discretization mapping of individuals after genetic manipulation includes: S421. The Sigmoid function is used to compress the individuals after genetic operations to a normalized interval and map them to the integer range [0, M-1] to obtain discretized individuals; S422. Determine whether there is a physical co-occurrence conflict among the discretized individuals. If so, migrate the violating node to the nearest physical computing node in its security domain.

7. A traffic-aware resource scheduling method for large-scale network test ranges according to claim 1, characterized in that, After completing the target range environment delivery in step S5 and concluding the single exercise mission, the system constructs the combat traffic correlation matrix L. real The mean squared error loss of the graph convolutional neural network is calculated and its correlation matrix L with the predicted traffic is used as a feedback signal. Based on the backpropagation algorithm, the graph convolutional neural network is incrementally trained to correct its cognitive bias in the identification of traffic features in specific attack and defense business.

Images