A container network dynamic trust evaluation method, system, device and medium

Abstract

This application relates to a method, system, device, and medium for dynamic trust assessment of container networks. The method includes: collecting a set of container behavior features based on the operational status information of the container network; performing time-series modeling on the feature set to obtain a dynamic sequence of container behavior; inputting the dynamic sequence of container behavior into a machine learning network to identify container service load patterns; and performing adaptive fuzzy processing on the feature set based on these patterns to generate an adaptive fuzzy feature set; calculating a dynamic trust score for the container based on a weighted average of the adaptive fuzzy feature set and the dynamic sequence of container behavior, and setting a trusted state label for the container accordingly; and generating a dynamic trust assessment of the container network based on the dynamic sequence and the trusted state label according to trust assessment rules. This method can dynamically adapt to the operational scenarios of container networks, achieve accurate trust assessment, and effectively improve the security protection capabilities of container networks.

Description

Technical Field

[0001] This invention belongs to the field of container network trust assessment, and in particular relates to a method, system, device and medium for dynamic trust assessment of container networks. Background Technology

[0002] With the rapid development of cloud computing and microservice architecture technologies, container technology, due to its lightweight, agile, and easily scalable characteristics, has become the core carrier for enterprises to deploy distributed applications, and the scale and network complexity of container clusters continue to increase. To ensure container network security, most mainstream protection methods currently adopt static trust assessment mechanisms, such as firewall policies based on preset fixed thresholds, single-dimensional resource monitoring alerts, or traditional intrusion detection rule matching, which determine the trust status of nodes by comparing them with a known malicious behavior signature database.

[0003] Traditional technologies typically rely on manually configured static rules to perform discrete sampling and analysis of container behavior data. This approach fails to consider the impact of load fluctuations on behavior patterns and struggles to handle ambiguous behavioral characteristics. However, container networks are highly dynamic. Frequent fluctuations in business load and elastic scaling of instances lead to continuous evolution of behavior patterns. Static assessment methods are ill-suited to dynamic scenarios and are prone to misjudgments: for example, they may miss abnormal behaviors under normal load fluctuations, generate numerous false alarms due to rigid thresholds, and fail to effectively integrate ambiguous and deterministic behavioral characteristics. This results in low accuracy and poor real-time performance in trust assessments, making it difficult to meet the dynamic security protection requirements of container networks. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, system, device, and medium for dynamic trust assessment of container networks that can solve the above problems.

[0005] Firstly, this application provides a method for dynamic trust assessment in container networks, including:

[0006] Based on the operational status information of the container network, collect the container behavior feature set of the container network;

[0007] Temporal modeling of the container behavior feature set yields a dynamic sequence of container behavior.

[0008] The dynamic sequence of container behavior is input into a machine learning network to identify the container's business load pattern.

[0009] Based on the container business load mode, adaptive fuzzy processing is performed on the container behavior feature set to generate an adaptive fuzzy feature set.

[0010] Based on the adaptive fuzzy feature set and the dynamic sequence of container behavior, the dynamic trust score of the container is obtained through dynamic weighted calculation, and the trust status label of the container is set based on the dynamic trust score of the container.

[0011] Based on the dynamic sequence of container behavior and the trusted state label of the container, a dynamic trust evaluation of the container network is generated according to the trust evaluation rules.

[0012] In one embodiment, based on the operational status information of the container network, a set of container behavior features of the container network is collected, including:

[0013] Based on the operational status information of the container network, the collection parameters of container behavior data are set to obtain the collection rule set. The collection parameters include collection dimension, collection granularity, collection range, collection frequency and collection threshold.

[0014] Collect a container behavior dataset based on the collection rule set;

[0015] The membership function is used to calculate the membership value of each container behavior data in the container behavior dataset, and the membership value set is obtained.

[0016] Based on the membership value set and the membership threshold, the container behavior dataset is classified to obtain fuzzy behavior data and definite behavior data.

[0017] Fuzzy behavior data is fuzzified and mapped to obtain fuzzy behavior features;

[0018] Numerical processing is performed on the data representing specific behaviors to obtain specific behavioral characteristics.

[0019] By fusing fuzzy behavioral features and deterministic behavioral features, a set of container behavioral features is obtained.

[0020] In one embodiment, temporal modeling is performed on the container behavior feature set to obtain a dynamic sequence of container behavior, including:

[0021] Based on deterministic behavioral data, a dynamic sliding time window is set, and based on the dynamic sliding time window, a bidirectional long short-term memory network model based on the attention mechanism is constructed. The bidirectional long short-term memory network model includes an input layer, a hidden layer, and an output layer.

[0022] By employing an attention mechanism, time-series correlation features of fuzzy behavioral characteristics are extracted.

[0023] The time series correlation features are input into the hidden layer, nonlinear transformation is performed to obtain transformed features, and the transformed features are encoded into time series features to obtain a high-order time series feature vector.

[0024] The high-order temporal feature vector is input into the output layer to predict the fuzzy behavior feature value of the next dynamic sliding time window;

[0025] Extracting historical behavioral trend features from time-series correlation features;

[0026] By integrating historical behavioral trend features and fuzzy behavioral feature values, a dynamic sequence of container behavior is obtained.

[0027] In one embodiment, a dynamic sequence of container behavior is input into a machine learning network to identify container service load patterns, including:

[0028] Based on the dynamic sequence of container behavior, the amplitude of behavior fluctuations and the frequency of behavior changes are statistically analyzed.

[0029] Based on the behavioral fluctuation amplitude sequence and change frequency sequence, load levels are set, and load level distribution parameters are calculated based on the load levels; load levels include low load, medium load, and high load.

[0030] Input the load level distribution parameters into the Gaussian mixture model and set the log-likelihood function;

[0031] The Gaussian mixture model is iteratively trained using the expectation-maximization algorithm until the log-likelihood function converges, thus obtaining the probability density function parameter set corresponding to each load level.

[0032] Based on the probability density function parameter set, the posterior probability of each container behavior dynamic sequence belonging to each load level is calculated, and the container business load probability distribution matrix is ​​obtained.

[0033] The similarity calculation results are obtained by comparing the container service load probability distribution matrix with the template matrix of each load pattern tag in the load pattern template library.

[0034] Verify the temporal continuity of historical behavior trend characteristics and similarity calculation results. When the temporal continuity meets the verification rules, determine the corresponding load mode label as the container business load mode.

[0035] In one embodiment, based on the container service load pattern, an adaptive fuzzy feature set is generated by performing adaptive fuzzy processing on the container behavior feature set, including:

[0036] Calculate the posterior probability range of the load probability distribution matrix corresponding to the container business load mode, and use the range as a load fluctuation sensitivity parameter.

[0037] Based on the load fluctuation sensitivity parameter, the membership function is reconstructed to obtain the adjusted membership function. The parameter reconstruction operation includes adjusting the position of the membership peak and adjusting the membership coverage.

[0038] Calculate the matrix entropy value of the load probability distribution matrix, and set the number of feature stratification levels based on the matrix entropy value;

[0039] Based on the feature-based hierarchical quantization level, combined with the load probability distribution matrix, probability-driven hierarchical quantization is performed on the determined behavioral features to obtain the quantized determined features.

[0040] The fuzzy behavioral features are remapped using the adjusted membership function to obtain the topologically reconstructed fuzzy behavioral features.

[0041] The fuzzy behavioral features after topological reconstruction and the deterministic features after quantization are concatenated to generate an adaptive fuzzy feature set.

[0042] In one embodiment, the posterior probability is calculated as follows:

[0043]

[0044] in, Let x be the posterior probability that the dynamic sequence of container behavior belongs to load level k, where K is the total number of load levels, K=1 for low load, K=2 for medium load, and K=3 for high load. Let x be the mixing coefficient for load level k, and let x be the dynamic sequence of container behavior. Let k be the mean vector of the Gaussian distribution corresponding to load level k. Let k be the Gaussian distribution covariance matrix corresponding to load level k. This is a weighting coefficient for the amplitude of behavioral fluctuations. The weighting coefficients are the frequency of behavioral changes. The variation amplitude of the container behavior dynamic sequence x under load level k. Let x be the frequency of behavior change of the container's dynamic sequence at load level k. Let be the multivariate Gaussian probability density function corresponding to load level k.

[0045] In one embodiment, a dynamic trust evaluation of the container network is generated based on the container behavior dynamic sequence and the container trusted state label, according to trust evaluation rules, including:

[0046] Based on the container's trusted state label, trust constraint parameters are extracted according to the trust evaluation rules to obtain the label constraint set;

[0047] Based on the set of label constraints, the dynamic sequence of container behavior is segmented to obtain a set of behavior fragments to be evaluated.

[0048] Calculate the behavioral similarity between the behavior of each fragment in the set of behavioral fragments to be evaluated and the predefined template behavior in the trust evaluation rules;

[0049] Based on behavioral similarity and combined with trust level threshold range, a trust level for container behavior is set.

[0050] Based on the segment trust level, a time-series voting mechanism is used to determine the trust status, thereby obtaining a dynamic trust evaluation of the container network.

[0051] Secondly, this application also provides a dynamic trust assessment system for container networks, comprising:

[0052] The feature acquisition module is used to collect a set of container behavior features based on the runtime status information of the container network.

[0053] The temporal modeling module is used to perform temporal modeling on the container behavior feature set to obtain the dynamic sequence of container behavior;

[0054] The load identification module is used to input the dynamic sequence of container behavior into the machine learning network to identify the container's business load pattern;

[0055] The fuzzy processing module is used to perform adaptive fuzzy processing on the container behavior feature set based on the container's business load mode, and generate an adaptive fuzzy feature set.

[0056] The trust calculation module is used to obtain the dynamic trust score of the container through dynamic weighted calculation based on the adaptive fuzzy feature set and the dynamic sequence of container behavior, and to set the trust status label of the container based on the dynamic trust score of the container.

[0057] The trust evaluation module is used to generate dynamic trust evaluations for container networks based on dynamic sequences of container behavior and container trust status labels, according to trust evaluation rules.

[0058] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the above-described container network dynamic trust assessment method.

[0059] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described container network dynamic trust assessment method.

[0060] The aforementioned method, system, device, and medium for dynamic trust assessment of container networks collect container behavior feature sets, covering multi-dimensional behavioral data under dynamic operating scenarios, thus solving the problem of single-dimensional static rule collection. Temporal modeling of the feature sets yields dynamic sequences of container behavior, capturing the temporal evolution of container behavior and overcoming the limitation of discrete sampling in reflecting continuous behavioral changes. Inputting these dynamic sequences into a machine learning network identifies container service load patterns, distinguishing behavioral differences under different loads. Adaptive fuzzy processing of the feature sets based on load patterns generates adaptive fuzzy feature sets, achieving dynamic fusion of fuzzy and deterministic behaviors, solving the problem of traditional methods struggling to handle fuzzy features. Weighted calculation of container dynamic trust scores using the adaptive fuzzy feature sets and container behavior dynamic sequences, along with setting trusted status labels, improves the accuracy of trust assessment and reduces false positives and false negatives. Dynamic trust evaluations are generated according to rules based on the dynamic sequences and trusted status labels, achieving real-time security protection adapted to the elasticity of container networks. Attached Figure Description

[0061] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0062] Figure 1 This is a flowchart of a container network dynamic trust assessment method according to the present invention;

[0063] Figure 2 The flowchart of the steps for generating dynamic trust evaluation of container networks is provided in the container network dynamic trust evaluation method of the present invention.

[0064] Figure 3 This is a structural diagram of a container network dynamic trust evaluation system according to the present invention. Detailed Implementation

[0065] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0066] In one embodiment, such as Figure 1As shown, a dynamic trust assessment method for container networks is provided. This embodiment illustrates the application of this method to an assessment terminal. It is understood that this method can also be applied to servers, and can also be applied to architectures including terminals and servers, and implemented through interaction between the terminal and the server. In the implementation environment of this application, the hardware architecture may include terminals, container networks, and servers, along with container network infrastructure such as network switches and firewalls. Application scenarios include: for dynamic security protection needs of container networks, when microservice deployments experience frequent fluctuations in business load and evolving behavioral patterns such as instance elastic scaling, the terminal sends a request to the server to configure collection rules. The server collects operational status information in real time through the container network, generates a dynamic trust assessment through steps such as time-series modeling, load identification, and fuzzy processing, and then feeds the results back to the terminal. At the same time, the server can synchronize load pattern templates and trust constraint parameters to dynamically adjust protection strategies.

[0067] In this embodiment, the method includes the following steps:

[0068] S01, based on the operational status information of the container network, collect the container behavior feature set of the container network.

[0069] Optionally, the runtime status information of a container network generally refers to real-time system metrics and event streams that can be legally obtained through host monitoring, the Container Runtime Interface (CRI), kernel probes (eBPF), or Sidecar agents, covering multi-dimensional observation data such as computing resource usage, network connection behavior, process call chains, and file system operations. The container behavior feature set refers to a set of quantitative features that characterize the behavior patterns of container entities within a specific time period, formed by structurally extracting and preprocessing the aforementioned runtime status information through preset collection rules. In implementation, the evaluation terminal can dynamically configure collection parameters based on the business attributes and security requirements of the container cluster. These parameters include, but are not limited to, collection dimensions (such as system call sequences and north-south traffic packet characteristics), collection granularity (such as millisecond-level sampling intervals), collection scope (such as specific namespaces or Pod groups), collection frequency, and abnormal triggering thresholds, generating a standardized collection rule set. The evaluation terminal can schedule a distributed collection agent to collect full or incremental data from the target container according to the rule set, forming an initial container behavior dataset. The evaluation terminal can use the membership function in fuzzy mathematics theory to evaluate each behavior data, dividing the data into deterministic behavior data and fuzzy behavior data with ambiguous boundaries based on a preset membership threshold. The evaluation terminal can normalize and numerically encode the deterministic behavior data, perform fuzzification mapping on the fuzzy behavior data to preserve uncertain semantics, and perform spatiotemporal alignment and fusion of the two types of behavior data to construct a container behavior feature set that is both accurate and robust.

[0070] S02, perform time-series modeling on the container behavior feature set to obtain the dynamic sequence of container behavior.

[0071] Optionally, temporal modeling refers to the process of using time series analysis methods to mine the implicit temporal dependencies and evolutionary patterns in feature data, and transforming them into a structured sequence representation with temporal continuity. In implementation, the evaluation terminal can adaptively set a dynamic sliding time window based on the definite behavioral data in the container behavior feature set, according to the business fluctuation characteristics, to capture behavioral patterns at different time scales. The evaluation terminal can construct a temporal neural network model based on the set dynamic sliding time window, and introduce an attention mechanism into the model to quantify the contribution weight of features from different historical moments to the current state, extracting the temporal series correlation features of container behavior features. The evaluation terminal can input the correlation features into the hidden layer for nonlinear transformation and temporal feature encoding to generate a high-order temporal feature vector, and predict the behavioral feature value of the next time window based on this vector. The evaluation terminal can extract historical behavioral trend features from the correlation features, and perform spatiotemporal fusion and alignment of the historical behavioral trend features with the predicted future behavioral feature values ​​to generate a dynamic sequence of container behavior that comprehensively reflects the evolution of container behavior over time, providing a temporal data foundation for subsequent load pattern recognition and trust assessment.

[0072] S03, input the dynamic sequence of container behavior into the machine learning network to identify the container business load pattern.

[0073] Optionally, the container business load mode refers to an abstract representation of the resource consumption intensity and behavioral activity of a container within a specific time period, used to distinguish the distribution of behavioral characteristics under different business pressures. In implementation, the evaluation terminal can extract time-series statistics such as behavioral fluctuation amplitude and behavioral change frequency based on the container's dynamic behavioral sequence to construct a load representation vector; the evaluation terminal can preset load level classification standards according to business scenario requirements and calculate the statistical distribution parameters for each level; the evaluation terminal can use a machine learning network based on a probabilistic graphical model, such as a Gaussian mixture model, a hidden Markov model, or a deep clustering network, to iteratively train the model using the expectation-maximization algorithm or gradient descent method, enabling it to learn the data distribution patterns under different load modes until the model converges; based on the trained model, the output probability distribution matrix of each container's dynamic behavioral sequence belonging to different load levels is determined, and similarity matching is performed with a pre-built load mode template library. This is combined with historical behavioral trend features for temporal continuity verification, eliminating transient noise interference, and determining the current container's business load mode, providing contextual basis for subsequent adaptive fuzzy processing.

[0074] S04. Based on the container business load mode, adaptive fuzzy processing is performed on the container behavior feature set to generate an adaptive fuzzy feature set.

[0075] Optionally, adaptive fuzzy processing refers to dynamically adjusting the mapping rules of fuzzy logic and the quantization granularity of deterministic values ​​in the feature space based on the contextual information of the load pattern, in order to eliminate the risk of mismatch between static processing and dynamic scenarios. In implementation, the evaluation terminal can quantify the fluctuation characteristics of the container service load pattern, calculate the posterior probability range of its probability distribution as a load fluctuation sensitivity parameter, and reconstruct the peak position and coverage of the membership function based on this parameter to achieve adaptive calibration of the fuzzy logic. The evaluation terminal can calculate the matrix entropy value of the load probability distribution to measure the uncertainty of the system, and dynamically set the number of levels for feature hierarchical quantization accordingly. Based on this number of levels and the probability distribution, the evaluation terminal can perform probability-driven non-uniform hierarchical quantization of deterministic behavioral features, and perform topological remapping of fuzzy behavioral features using the adjusted membership function to make the feature expression more consistent with the current load context. The evaluation terminal can then perform feature space splicing and fusion of the remapped fuzzy features and the hierarchically quantized deterministic features to generate an adaptive fuzzy feature set that balances deterministic accuracy and fuzzy fault tolerance, providing a highly robust input foundation for subsequent dynamic trust calculation.

[0076] S05. Based on the adaptive fuzzy feature set and the dynamic sequence of container behavior, the dynamic trust score of the container is obtained through dynamic weighted calculation, and the trust status label of the container is set based on the dynamic trust score of the container.

[0077] Optionally, the evaluation terminal can parse the deterministic and fuzzy components in the adaptive fuzzy feature set, and simultaneously extract historical trend features and future prediction features from the dynamic sequence of container behavior. Based on the identified container service load pattern, the evaluation terminal can construct a dynamic weight allocation function. This function can automatically increase the fault-tolerant weight of fuzzy features under high load fluctuations or enhance the discriminative weight of deterministic features under low load steady-state conditions, according to the load fluctuation sensitivity parameter. The evaluation terminal can employ a multi-dimensional feature fusion operator to aggregate the weighted adaptive fuzzy features and temporal features, outputting a container dynamic trust score that quantifies the current security status of the container. Based on a preset trust level threshold range, the evaluation terminal can map continuous trust scores to discrete container trust status labels, such as trustworthy, suspicious, and untrustworthy, achieving precise definition of trust status and providing a decision-making basis for subsequent network access control.

[0078] S06. Based on the dynamic sequence of container behavior and the trusted state label of the container, a dynamic trust evaluation of the container network is generated according to the trust evaluation rules.

[0079] Optionally, the evaluation terminal can extract corresponding trust constraint parameters based on the container's trusted state label, construct a label constraint set, and perform temporal slicing and segmentation processing on the container's dynamic behavior sequence according to the constraint set to obtain a set of behavior segments to be evaluated. The evaluation terminal can calculate the behavior similarity between each behavior segment and the predefined template behavior in the trust evaluation rules. This similarity calculation can be achieved based on various measurement methods such as Euclidean distance, dynamic time warping, or cosine of the angle between feature vectors. The evaluation terminal can compare the calculated behavior similarity with the preset trust level threshold range and set a corresponding segment trust level for each behavior segment. The evaluation terminal can adopt a temporal voting mechanism or a Bayesian inference framework to integrate the trust level of each segment and its temporal continuity, eliminate misjudgments caused by instantaneous jitter, and generate a dynamic trust evaluation that can reflect the overall security status of the container network, providing decision support for subsequent access control and anomaly response.

[0080] The aforementioned dynamic trust assessment method for container networks collects container behavior feature sets, covering multi-dimensional behavioral data under dynamic operating scenarios, thus solving the problem of single-dimensional static rule collection. It performs temporal modeling on the feature sets to obtain dynamic sequences of container behavior, capturing the temporal evolution of container behavior and overcoming the limitation of discrete sampling in reflecting continuous behavioral changes. Inputting these dynamic sequences into a machine learning network identifies container service load patterns, distinguishing behavioral differences under different loads. Based on load patterns, the feature sets undergo adaptive fuzzy processing to generate adaptive fuzzy feature sets, achieving dynamic fusion of fuzzy and deterministic behaviors, solving the problem of traditional methods struggling to handle fuzzy features. Through the adaptive fuzzy feature sets and dynamic sequences of container behavior, a weighted dynamic trust score is calculated, and a trusted state label is set, improving the accuracy of trust assessment and reducing false positives and false negatives. Based on the dynamic sequences and trusted state labels, a dynamic trust evaluation is generated according to rules, achieving real-time security protection adapted to the elasticity of container networks.

[0081] In one embodiment, based on the operational status information of the container network, a set of container behavior features of the container network is collected, including:

[0082] S11. Based on the operational status information of the container network, set the collection parameters for container behavior data to obtain a collection rule set. The collection parameters include collection dimension, collection granularity, collection range, collection frequency, and collection threshold.

[0083] Optionally, the evaluation terminal can combine runtime status information such as container network computing resource usage, network communication behavior, process call chain, and file system operations, and configure the collection dimensions, granularity, scope, frequency, and threshold of container behavior data according to the business attributes and security protection objectives of the container cluster, forming a standardized collection rule set. The collection dimensions can cover key dimensions such as system call sequences, north-south network traffic characteristics, and container process behavior. The collection granularity can be set to a millisecond-level sampling interval according to the real-time requirements of the business. The collection scope can be limited to the target namespace or container group. The collection frequency and threshold are dynamically adjusted in combination with the elastic scaling characteristics of container instances, so as to achieve a high degree of adaptation between the collection rules and the container network operation scenario.

[0084] S12, Collect container behavior dataset according to the collection rule set.

[0085] Optionally, the evaluation terminal can use collection tools such as host monitoring, container runtime interface, eBPF kernel probe or Sidecar agent to perform full or incremental data collection on the target container according to the collection rule set to obtain the original container behavior dataset.

[0086] S13, use the membership function to calculate the membership value of each container behavior data in the container behavior dataset, and obtain the membership value set.

[0087] Optionally, the evaluation terminal can use the membership function in the field of fuzzy mathematics to calculate the membership value for each behavioral data in the container behavior dataset and generate a membership value set.

[0088] S14. Based on the membership value set and combined with the membership threshold, the container behavior dataset is classified to obtain fuzzy behavior data and definite behavior data.

[0089] Optionally, the evaluation terminal can compare the membership values ​​of each behavioral data with a preset membership threshold to determine whether the data has a stable membership value higher than the threshold and clear behavioral attributes. Data with a membership value in the threshold range, vague behavioral boundaries, and cannot be directly categorized can be categorized as fuzzy behavioral data. For example, a triangular membership function can be used to calculate the membership value of each behavioral data. The preset membership threshold is 0.6. A membership value ≥ 0.6 is considered definite behavioral data, and < 0.6 is considered fuzzy behavioral data.

[0090] S15, perform fuzzification mapping on the fuzzy behavior data to obtain fuzzy behavior features.

[0091] Optionally, the evaluation terminal can preserve the uncertain semantic features of the segmented fuzzy behavioral data through fuzzification mapping, for example, mapping "high CPU utilization" to a fuzzy interval of [0.8, 1.0], and transforming it into fuzzy behavioral features that can be used for model calculation.

[0092] S16, Perform numerical processing on the determined behavioral data to obtain the determined behavioral characteristics.

[0093] Optionally, the evaluation terminal can use numerical processing methods such as normalization and standardization to encode features of the defined behavioral data, generating quantitatively accurate defined behavioral features.

[0094] S17, fused fuzzy behavioral features and deterministic behavioral features to obtain the container behavioral feature set.

[0095] Optionally, the evaluation terminal can align and fuse fuzzy behavioral features with deterministic behavioral features in the spatiotemporal dimension, integrating the advantages of both types of features to construct a container behavioral feature set that combines deterministic discrimination capability with fuzzy fault tolerance capability.

[0096] In one embodiment, temporal modeling is performed on the container behavior feature set to obtain a dynamic sequence of container behavior, including:

[0097] S21. Based on deterministic behavioral data, a dynamic sliding time window is set, and based on the dynamic sliding time window, a bidirectional long short-term memory network model based on the attention mechanism is constructed. The bidirectional long short-term memory network model includes an input layer, a hidden layer, and an output layer.

[0098] Optionally, the evaluation terminal can set a dynamic sliding time window. The size and step size of this window are not fixed, but are adaptively adjusted according to the statistical characteristics of the deterministic behavioral data. For example, the window length can be dynamically determined by calculating the mean and variance of the data to adapt to the multi-timescale changes of the container behavior. The evaluation terminal can construct a bidirectional long short-term memory network (BiLSTM) model containing an input layer, a hidden layer, and an output layer based on this dynamic sliding time window. The input layer is responsible for receiving the aligned fuzzy behavioral features and the deterministic behavioral data within the time window. The hidden layer consists of forward and backward LSTM units to capture the temporal dependencies of the past and future. The output layer is used to generate prediction results.

[0099] S22 extracts time-series correlation features of fuzzy behavioral features through an attention mechanism.

[0100] Optionally, during model training and application, the evaluation terminal can process the input sequence through an attention mechanism. This mechanism can assign differentiated weights to features at different time steps, such as giving higher weights to moments of abnormal fluctuations, thereby accurately extracting time-series correlation features of fuzzy behavioral features and quantifying the dependence strength between behaviors at different times.

[0101] S23. Input the time series correlation features into the hidden layer, perform nonlinear transformation to obtain transformed features, and encode the transformed features into time series features to obtain a high-order time series feature vector.

[0102] Optionally, the evaluation terminal can input the time series associated features into the hidden layer, perform nonlinear transformation through the gating unit to filter redundant information, obtain transformed features, and then encode the transformed features with time sequence numbers through the embedding layer or convolutional layer to generate a high-order time series feature vector containing deep time series patterns.

[0103] S24 inputs the high-order temporal feature vector into the output layer to predict the fuzzy behavioral feature value of the next dynamic sliding time window.

[0104] Optionally, the evaluation terminal can input high-order temporal feature vectors into the output layer, train the model using loss functions such as mean squared error, predict fuzzy behavioral feature values ​​within the next dynamic sliding time window, and infer the future trend of container behavior.

[0105] S25, extract historical behavioral trend features of time series correlation features.

[0106] Optionally, the evaluation terminal can extract historical behavioral trend features from time series correlation features, for example, by calculating the mean change trend or slope within a sliding window to characterize the direction of behavioral evolution over time.

[0107] S26, by integrating historical behavioral trend features and fuzzy behavioral feature values, a dynamic sequence of container behavior is obtained.

[0108] Optionally, the evaluation terminal can perform spatiotemporal fusion of the extracted historical behavioral trend features and the predicted fuzzy behavioral feature values. For example, by feature splicing or weighted summation, a dynamic sequence of container behavior that contains both historical evolution patterns and future prediction information can be generated, providing a data foundation with both temporal continuity and predictability for subsequent load pattern recognition.

[0109] In one embodiment, a dynamic sequence of container behavior is input into a machine learning network to identify container service load patterns, including:

[0110] S31, based on the dynamic sequence of container behavior, statistically analyzes the amplitude of behavior fluctuations and the frequency of behavior changes.

[0111] Optionally, the evaluation terminal can extract two types of statistics based on the dynamic sequence of container behavior: the amplitude of behavior fluctuation and the frequency of behavior change. The amplitude of behavior fluctuation can be achieved by calculating the variance or range of the feature values ​​within the sliding window, which is used to quantify the severity of container behavior. The frequency of behavior change can be achieved by counting the number of jumps or trend reversals of feature values ​​per unit time, which is used to reflect the activity level of container behavior.

[0112] S32, based on the behavior fluctuation amplitude sequence and change frequency sequence, set the load level, and calculate the load level distribution parameters based on the load level; the load levels include low load, medium load and high load.

[0113] Optionally, the evaluation terminal can combine the behavioral fluctuation amplitude sequence and the change frequency sequence to form a two-dimensional load representation vector, and preset load level classification standards according to business scenario requirements. For example, fluctuation amplitude less than 0.2 and frequency less than 5 times / second are defined as low load, fluctuation amplitude between 0.2 and 0.5 and frequency between 5 and 15 times / second are defined as medium load, and fluctuation amplitude greater than 0.5 or frequency greater than 15 times / second are defined as high load. Then, the mean, variance and other distribution parameters corresponding to each load level are calculated.

[0114] S33, input the load level distribution parameters into the Gaussian mixture model and set the log-likelihood function.

[0115] Optionally, the evaluation terminal can input the load level distribution parameters into a Gaussian mixture model (GMM), which assumes that the data for different load levels follow a multivariate Gaussian distribution with different parameters and sets the log-likelihood function as the optimization objective.

[0116] S34 uses the expectation-maximization algorithm to iteratively train the Gaussian mixture model until the log-likelihood function converges, thus obtaining the probability density function parameter set corresponding to each load level.

[0117] Optionally, the evaluation terminal can use the expectation-maximization (EM) algorithm to iteratively train the model: the E-step calculates the expectation of each data point belonging to each Gaussian component, the M-step updates the mean, covariance and mixing coefficient of each Gaussian component, until the log-likelihood function converges, and obtains the probability density function parameter set corresponding to each load level.

[0118] S35. Based on the probability density function parameter set, calculate the posterior probability of each container behavior dynamic sequence belonging to each load level, and obtain the container business load probability distribution matrix.

[0119] Optionally, the evaluation terminal can use a trained Gaussian mixture model and Bayes' theorem to calculate the posterior probability that each container's dynamic behavior sequence belongs to the low, medium, or high load levels, forming a container business load probability distribution matrix.

[0120] S36. Calculate the similarity between the container service load probability distribution matrix and the template matrix of each load pattern tag in the load pattern template library to obtain the similarity calculation result.

[0121] Optionally, the evaluation terminal can perform similarity calculations between the probability distribution matrix and the template matrix in the pre-built load pattern template library, for example, by using cosine similarity or Euclidean distance to obtain the similarity calculation results.

[0122] S37, verify the temporal continuity of historical behavior trend characteristics and similarity calculation results. When the temporal continuity meets the verification rules, the corresponding load mode label is determined as the container business load mode.

[0123] Optionally, the evaluation terminal can extract historical behavioral trend features from the dynamic sequence of container behavior, such as the trend slope obtained by linear regression fitting, and verify its temporal continuity with the similarity calculation results: if the load mode label at the current moment is consistent with the trend at the previous moment (such as three consecutive time windows all pointing to high load, and the similarity value exceeding the preset threshold of 0.8), then it is determined that the temporal continuity meets the verification rules, and the corresponding load mode label is determined as the business load mode of the current container.

[0124] In one embodiment, based on the container service load pattern, an adaptive fuzzy feature set is generated by performing adaptive fuzzy processing on the container behavior feature set, including:

[0125] S41, calculate the posterior probability range of the load probability distribution matrix corresponding to the container service load mode, and use the range as the load fluctuation sensitivity parameter.

[0126] Optionally, the evaluation terminal can calculate the posterior probability range of the corresponding load probability distribution matrix for the identified container service load patterns, that is, the difference between the maximum and minimum posterior probability values ​​of each load level. This range can directly reflect the severity of the current load fluctuation and can be defined as a load fluctuation sensitivity parameter to quantify the uncertainty level of the load pattern.

[0127] S42, based on the load fluctuation sensitivity parameter, the membership function is reconstructed to obtain the adjusted membership function. The parameter reconstruction operation includes adjusting the position of the membership peak and adjusting the membership coverage.

[0128] Optionally, the evaluation terminal can reconstruct the membership function based on the sensitivity parameter: when the sensitivity parameter is high, it indicates that the load fluctuates drastically. In this case, the peak position of the membership function can be adjusted to shift towards the current dominant load level, while expanding the membership coverage to accommodate more uncertain behaviors; when the sensitivity parameter is low, the membership coverage can be narrowed to improve the distinguishability of deterministic behaviors, resulting in an adjusted membership function that dynamically matches the current load pattern.

[0129] S43, calculate the matrix entropy value of the load probability distribution matrix, and set the number of feature stratification levels based on the matrix entropy value.

[0130] Optionally, the evaluation terminal can calculate the matrix entropy value of the load probability distribution matrix. This entropy value is calculated using the information entropy formula and is used to measure the degree of disorder in the probability distribution. The higher the entropy value, the more uncertain the load pattern. Based on this, the number of feature stratification levels can be dynamically set. For example, 5 quantization levels are set when the entropy value is greater than 1.5, 3 levels are set when the entropy value is between 0.8 and 1.5, and 2 levels are set when the entropy value is less than 0.8.

[0131] S44, based on the feature hierarchical quantization level and combined with the load probability distribution matrix, performs probability-driven hierarchical quantization on the determined behavioral features to obtain the quantized determined features.

[0132] Optionally, the evaluation terminal can perform probability-driven hierarchical quantization of the determined behavioral features based on the feature hierarchical quantization level and the probability weight of each level in the load probability distribution matrix: the value range of the determined behavioral features is divided into intervals corresponding to the number of levels, and the boundary of each interval is adaptively adjusted according to the probability density distribution, so that the quantization granularity of the high probability region is finer and the quantization granularity of the low probability region is coarser, thus obtaining the quantized determined features.

[0133] S45. The adjusted membership function is used to remap the fuzzy behavioral features to obtain the topologically reconstructed fuzzy behavioral features.

[0134] Optionally, for fuzzy behavioral features, the evaluation terminal can use the adjusted membership function for remapping, that is, recalculate the original fuzzy behavioral features in the adjusted membership function space to obtain the topology-reconstructed fuzzy behavioral features, so that its membership distribution matches the behavioral uncertainty under the current load mode.

[0135] S46. The fuzzy behavioral features after topological reconstruction and the deterministic features after quantization are concatenated to generate an adaptive fuzzy feature set.

[0136] Optionally, the evaluation terminal can concatenate the fuzzy behavioral features after topology reconstruction and the quantized deterministic features, for example, by concatenating them along the feature dimension or by weighted fusion, to generate an adaptive fuzzy feature set that simultaneously contains accurate quantization information and adaptive fuzzy semantics. This adaptive fuzzy feature set can effectively eliminate the mismatch between static feature processing and dynamic load scenarios, providing a highly robust input foundation for subsequent dynamic trust calculation.

[0137] In one embodiment, S51, the posterior probability is calculated as follows:

[0138]

[0139] in, Let x be the posterior probability that the dynamic sequence of container behavior belongs to load level k, where K is the total number of load levels, K=1 for low load, K=2 for medium load, and K=3 for high load. Let x be the mixing coefficient for load level k, and let x be the dynamic sequence of container behavior. Let k be the mean vector of the Gaussian distribution corresponding to load level k. Let k be the Gaussian distribution covariance matrix corresponding to load level k. This is a weighting coefficient for the amplitude of behavioral fluctuations. The weighting coefficients are the frequency of behavioral changes. The variation amplitude of the container behavior dynamic sequence x under load level k. Let x be the frequency of behavior change of the container's dynamic sequence at load level k. Let be the multivariate Gaussian probability density function corresponding to load level k.

[0140] Optionally, this calculation formula provides a precise quantitative basis for load pattern recognition by integrating the probability distribution characteristics of the Gaussian mixture model with the temporal fluctuation characteristics of container behavior: the calculation formula is based on Bayesian inference, and the numerator consists of the mixing coefficients of load level k. , corresponding multivariate Gaussian probability density function value and fluctuation frequency correction term It consists of three parts, with the denominator being the sum of the numerators for all possible load levels j, and the final output is... This represents the probability confidence that a given dynamic sequence of container behavior x belongs to load level k. The mixing coefficient is... The mixing coefficients can be obtained through expectation-maximization training of a Gaussian mixture model. This reflects the prior occurrence frequency of each load level in historical operating data; and The high-dimensional feature mean vector and covariance matrix of load level k are respectively used to define the central tendency and discrete range of the behavioral features under this load mode; α and β are domain-adjustable hyperparameters that control the amplitude of behavioral fluctuations, respectively. With frequency of change The adjustment intensity of the probability calculation, and the values ​​of both, can be calibrated using historical monitoring data from the container cluster to achieve adaptability to different business scenarios. Behavioral fluctuation amplitude. This can be achieved by calculating the eigenvalue range or variance of the dynamic sequence of container behavior x within a sliding time window, thus quantifying the intensity of container resource consumption or network activity; and the frequency of behavior changes. The activity level of business requests can be obtained by counting the number of feature value jumps or trend reversals within a unit time window. The input container behavior dynamic sequence x is directly derived from the container behavior dynamic sequence generated by the time-series modeling module. The output posterior probability matrix serves as the core input of the load identification module. It is matched with a pre-built load pattern template library using cosine similarity and combined with temporal continuity verification of historical behavior trend features to determine the current container's business load pattern. Compared to the limitations of traditional Gaussian mixture models that rely solely on feature distribution similarity, this formula introduces... The correction incorporates the dynamic fluctuation characteristics of container behavior into probability calculation, enabling the load identification results to not only reflect the static matching degree of feature distribution, but also capture the dynamic trend of behavior evolution, effectively solving the identification oscillation problem caused by the instantaneous change of load mode in container elastic scaling scenarios.

[0141] In one embodiment, such as Figure 2 As shown, based on the dynamic sequence of container behavior and the container trusted state label, a dynamic trust evaluation of the container network is generated according to the trust evaluation rules, including:

[0142] S61. Based on the container's trusted state label, extract the trust constraint parameters according to the trust evaluation rules to obtain the label constraint set.

[0143] Optionally, the evaluation terminal can extract trust constraint parameters from the trust judgment dimension, behavior compliance boundary, and anomaly judgment condition corresponding to the container's trust status label according to the preset parameter extraction specifications in the trust evaluation rules. The extracted constraint parameters are then integrated by type to form a standardized label constraint set. This label constraint set is used to limit the execution boundary of subsequent behavior segmentation and trust evaluation, so that the evaluation logic is highly adapted to the current trust status of the container.

[0144] S62, based on the label constraint set, segment the dynamic sequence of container behavior to obtain a set of behavior fragments to be evaluated.

[0145] Optionally, the evaluation terminal can perform time-domain segmentation processing on the dynamic sequence of container behavior based on parameters such as time constraints, feature constraints, and threshold constraints in the label constraint set. It can also adaptively adjust the window length and segmentation step size in combination with the constraint parameters, remove redundant data and interference segments in the sequence that do not meet the constraint conditions, extract continuous behavioral units with independent evaluation value, and form a set of behavioral segments to be evaluated. Each segment is a temporal behavioral unit that can be used independently for trust determination.

[0146] S63, calculate the behavioral similarity between the behavior of each fragment in the set of behavioral fragments to be evaluated and the predefined template behavior in the trust evaluation rules.

[0147] Optionally, the evaluation terminal can use a dynamic time warping algorithm or a cosine similarity measurement method to calculate the feature matching degree between the feature vector of the behavior segment and the predefined normal template behavior, suspicious template behavior, and abnormal template behavior in the trust evaluation rules for each behavior segment in the set of behavior segments to be evaluated, so as to obtain the quantitative similarity value of each behavior segment corresponding to different template behaviors, and provide an objective quantitative basis for trust level classification.

[0148] S64 sets the trust level of container behavior based on behavioral similarity and the trust level threshold range.

[0149] Optionally, the evaluation terminal can match and compare the calculated behavioral similarity value with the preset trust level threshold range of the trust evaluation rules. This threshold range is divided into three levels: trustworthy, suspicious, and untrustworthy, based on the container network security protection requirements. Behavioral segments whose similarity values ​​fall into the corresponding range are labeled as the corresponding container behavior trust levels, so that the level determination conforms to the preset security standards and evaluation logic.

[0150] S65 uses a time-series voting mechanism to determine the trust status based on the segment trust level, thus obtaining a dynamic trust evaluation of the container network.

[0151] Optionally, the evaluation terminal can use a time-series voting mechanism to determine the overall trust status based on the trust level of each segment. This mechanism uses the temporal sequence of behavioral segments as the weight to statistically vote on the trust levels of segments within a continuous time period, prioritizing the retention of continuous and stable trust level results, filtering out abnormal judgments caused by instantaneous behavioral fluctuations, and comprehensively determining the overall trust status of the container by combining the temporal continuity and voting results. This results in a dynamic trust evaluation of the container network that can comprehensively and accurately reflect the real-time security status of the container network, providing reliable decision support for access control, security isolation, and anomaly response of the container network.

[0152] The aforementioned dynamic trust assessment method for container networks sets a collection rule set based on the operational status information of the container network, defining the collection dimensions, granularity, scope, frequency, and thresholds. It collects container behavior datasets and classifies them into fuzzy and deterministic behavior data using a membership function combined with membership thresholds. After fuzzification mapping and numerical processing, a container behavior feature set is obtained, covering multi-dimensional behavior data in dynamic operational scenarios, thus solving the problem of single-dimensional static rule collection. By setting a dynamic sliding time window for the deterministic behavior data and constructing a bidirectional long short-term memory network model based on an attention mechanism, it extracts time-series correlation features and performs nonlinear transformation and temporal feature encoding. It then fuses historical behavior trend features with predicted next-window fuzzy behavior feature values ​​to obtain a dynamic sequence of container behavior, capturing the temporal evolution of container behavior and overcoming the deficiency of discrete sampling in reflecting continuous behavior changes. Finally, by inputting the dynamic sequence into a Gaussian mixture model and combining the behavior fluctuation amplitude and change frequency... The system calculates posterior probabilities and identifies container service load patterns through similarity matching with a load pattern template library and temporal continuity verification. This distinguishes behavioral differences under different loads, avoiding misjudging normal load fluctuations as anomalies. It reconstructs membership functions based on the posterior probability range of the load probability distribution matrix and sets the feature hierarchical quantization level by matrix entropy. It performs probability-driven hierarchical quantization on definite behavioral features and remaps fuzzy behavioral features before concatenating them to generate an adaptive fuzzy feature set. This achieves dynamic fusion of fuzzy and definite behaviors, solving the problem of traditional methods struggling to handle fuzzy features. It calculates container dynamic trust scores and sets trusted status labels based on dynamically weighted adaptive fuzzy feature sets and dynamic sequences, improving the accuracy of trust assessment and reducing false positives and false negatives. Finally, it extracts trust constraint parameters based on trusted status labels, performs similarity matching and temporal voting on the set of behavioral segments to be evaluated, and generates a dynamic trust evaluation for the container network, achieving real-time security protection adapted to the elasticity of the container network.

[0153] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0154] Based on the same inventive concept, this application also provides a container network dynamic trust assessment system for implementing the container network dynamic trust assessment method described above. The solution provided by this system is similar to the implementation described in the above method; therefore, the specific limitations of one or more embodiments of the container network dynamic trust assessment system provided below can be found in the limitations of the container network dynamic trust assessment method described above, and will not be repeated here.

[0155] In one exemplary embodiment, such as Figure 3 As shown, a dynamic trust assessment system for container networks is provided, including:

[0156] The feature acquisition module 101 can be used to collect the container behavior feature set of the container network based on the running status information of the container network.

[0157] The temporal modeling module 102 can be used to perform temporal modeling on the container behavior feature set to obtain the dynamic sequence of container behavior.

[0158] The load identification module 103 can be used to input the dynamic sequence of container behavior into a machine learning network to identify the container business load pattern.

[0159] The fuzzing module 104 can be used to perform adaptive fuzzing processing on the container behavior feature set based on the container business load mode, and generate an adaptive fuzzy feature set.

[0160] The trust calculation module 105 can be used to obtain the dynamic trust score of the container by dynamically weighting the adaptive fuzzy feature set and the dynamic sequence of container behavior, and set the trust status label of the container based on the dynamic trust score of the container.

[0161] The trust evaluation module 106 can be used to generate dynamic trust evaluations of container networks based on container behavior dynamic sequences and container trust status labels, according to trust evaluation rules.

[0162] In one embodiment, the feature acquisition module 101 can also be used for:

[0163] Based on the operational status information of the container network, the collection parameters of container behavior data are set to obtain the collection rule set. The collection parameters include collection dimension, collection granularity, collection range, collection frequency and collection threshold.

[0164] Collect a container behavior dataset based on the collection rule set;

[0165] The membership function is used to calculate the membership value of each container behavior data in the container behavior dataset, and the membership value set is obtained.

[0166] Based on the membership value set and the membership threshold, the container behavior dataset is classified to obtain fuzzy behavior data and definite behavior data.

[0167] Fuzzy behavior data is fuzzified and mapped to obtain fuzzy behavior features;

[0168] Numerical processing is performed on the data representing specific behaviors to obtain specific behavioral characteristics.

[0169] By fusing fuzzy behavioral features and deterministic behavioral features, a set of container behavioral features is obtained.

[0170] In one embodiment, the timing modeling module 102 can also be used for:

[0171] Based on deterministic behavioral data, a dynamic sliding time window is set, and based on the dynamic sliding time window, a bidirectional long short-term memory network model based on the attention mechanism is constructed. The bidirectional long short-term memory network model includes an input layer, a hidden layer, and an output layer.

[0172] By employing an attention mechanism, time-series correlation features of fuzzy behavioral characteristics are extracted.

[0173] The time series correlation features are input into the hidden layer, nonlinear transformation is performed to obtain transformed features, and the transformed features are encoded into time series features to obtain a high-order time series feature vector.

[0174] The high-order temporal feature vector is input into the output layer to predict the fuzzy behavior feature value of the next dynamic sliding time window;

[0175] Extracting historical behavioral trend features from time-series correlation features;

[0176] By integrating historical behavioral trend features and fuzzy behavioral feature values, a dynamic sequence of container behavior is obtained.

[0177] In one embodiment, the load identification module 103 can also be used for:

[0178] Based on the dynamic sequence of container behavior, the amplitude of behavior fluctuations and the frequency of behavior changes are statistically analyzed.

[0179] Based on the behavioral fluctuation amplitude sequence and change frequency sequence, load levels are set, and load level distribution parameters are calculated based on the load levels; load levels include low load, medium load, and high load.

[0180] Input the load level distribution parameters into the Gaussian mixture model and set the log-likelihood function;

[0181] The Gaussian mixture model is iteratively trained using the expectation-maximization algorithm until the log-likelihood function converges, thus obtaining the probability density function parameter set corresponding to each load level.

[0182] Based on the probability density function parameter set, the posterior probability of each container behavior dynamic sequence belonging to each load level is calculated, and the container business load probability distribution matrix is ​​obtained.

[0183] The similarity calculation results are obtained by comparing the container service load probability distribution matrix with the template matrix of each load pattern tag in the load pattern template library.

[0184] Verify the temporal continuity of historical behavior trend characteristics and similarity calculation results. When the temporal continuity meets the verification rules, determine the corresponding load mode label as the container business load mode.

[0185] In one embodiment, the blurring module 104 can also be used for:

[0186] Calculate the posterior probability range of the load probability distribution matrix corresponding to the container business load mode, and use the range as a load fluctuation sensitivity parameter.

[0187] Based on the load fluctuation sensitivity parameter, the membership function is reconstructed to obtain the adjusted membership function. The parameter reconstruction operation includes adjusting the position of the membership peak and adjusting the membership coverage.

[0188] Calculate the matrix entropy value of the load probability distribution matrix, and set the number of feature stratification levels based on the matrix entropy value;

[0189] Based on the feature-based hierarchical quantization level, combined with the load probability distribution matrix, probability-driven hierarchical quantization is performed on the determined behavioral features to obtain the quantized determined features.

[0190] The fuzzy behavioral features are remapped using the adjusted membership function to obtain the topologically reconstructed fuzzy behavioral features.

[0191] The fuzzy behavioral features after topological reconstruction and the deterministic features after quantization are concatenated to generate an adaptive fuzzy feature set.

[0192] In one embodiment, the trust evaluation module 106 can also be used for:

[0193] Based on the container's trusted state label, trust constraint parameters are extracted according to the trust evaluation rules to obtain the label constraint set;

[0194] Based on the set of label constraints, the dynamic sequence of container behavior is segmented to obtain a set of behavior fragments to be evaluated.

[0195] Calculate the behavioral similarity between the behavior of each fragment in the set of behavioral fragments to be evaluated and the predefined template behavior in the trust evaluation rules;

[0196] Based on behavioral similarity and combined with trust level threshold range, a trust level for container behavior is set.

[0197] Based on the segment trust level, a time-series voting mechanism is used to determine the trust status, thereby obtaining a dynamic trust evaluation of the container network.

[0198] In one embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of the container network dynamic trust assessment method as described above.

[0199] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0200] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The components described as separate parts may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this disclosure according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0201] The above-described embodiments are merely illustrative of several implementation methods of the embodiments of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the embodiments of this application, and these modifications and improvements all fall within the protection scope of the embodiments of this application.

Claims

1. A method for dynamic trust assessment in container networks, characterized in that, The method includes: Based on the operational status information of the container network, a set of container behavior features of the container network is collected; Temporal modeling is performed on the container behavior feature set to obtain a dynamic sequence of container behavior; The dynamic sequence of container behavior is input into a machine learning network to identify the container service load pattern. Based on the container service load mode, the container behavior feature set is subjected to adaptive fuzzy processing to generate an adaptive fuzzy feature set; Based on the adaptive fuzzy feature set and the container behavior dynamic sequence, a container dynamic trust score is obtained through dynamic weighted calculation, and a container trust status label is set based on the container dynamic trust score. Based on the container behavior dynamic sequence and the container trusted state label, a container network dynamic trust evaluation is generated according to the trust evaluation rules.

2. The method according to claim 1, characterized in that, The container network-based operational status information, which collects the container network's container behavior feature set, includes: Based on the operational status information of the container network, the collection parameters of container behavior data are set to obtain a collection rule set. The collection parameters include collection dimension, collection granularity, collection range, collection frequency and collection threshold. Collect a container behavior dataset based on the aforementioned collection rule set; The membership function is used to calculate the membership value of each container behavior data in the container behavior dataset to obtain the membership value set. Based on the membership value set and combined with the membership threshold, the container behavior dataset is classified to obtain fuzzy behavior data and definite behavior data. The fuzzy behavior data is fuzzified and mapped to obtain fuzzy behavior features; The determined behavior data is numerically processed to obtain the determined behavior features; The fuzzy behavioral features and the deterministic behavioral features are fused to obtain the container behavioral feature set.

3. The method according to claim 2, characterized in that, The step of performing time-series modeling on the container behavior feature set to obtain a dynamic sequence of container behavior includes: Based on the determined behavioral data, a dynamic sliding time window is set, and based on the dynamic sliding time window, a bidirectional long short-term memory network model based on the attention mechanism is constructed. The bidirectional long short-term memory network model includes an input layer, a hidden layer, and an output layer. The attention mechanism is used to extract the time-series correlation features of the fuzzy behavioral features; The time series correlation features are input into the hidden layer, and a nonlinear transformation is performed to obtain the transformed features. The transformed features are then encoded with temporal features to obtain a high-order temporal feature vector. The higher-order temporal feature vector is input into the output layer to predict the fuzzy behavior feature value of the next dynamic sliding time window; Extract the historical behavioral trend features of the time series correlation features; By integrating the historical behavioral trend features and the fuzzy behavioral feature values, the dynamic sequence of container behavior is obtained.

4. The method according to claim 3, characterized in that, The step of inputting the dynamic sequence of container behavior into a machine learning network to identify the container service load pattern includes: Based on the dynamic sequence of container behavior, the amplitude of behavior fluctuations and the frequency of behavior changes are statistically analyzed. Based on the behavior fluctuation amplitude sequence and change frequency sequence, load levels are set, and load level distribution parameters are calculated based on the load levels; the load levels include low load, medium load, and high load. The load level distribution parameters are input into the Gaussian mixture model, and the log-likelihood function is set. The Gaussian mixture model is iteratively trained using the expectation-maximization algorithm until the log-likelihood function converges, thereby obtaining the probability density function parameter set corresponding to each load level. Based on the probability density function parameter set, the posterior probability of each container behavior dynamic sequence belonging to each load level is calculated to obtain the container service load probability distribution matrix. The similarity calculation is performed between the container service load probability distribution matrix and the template matrix of each load pattern tag in the load pattern template library to obtain the similarity calculation result. Verify the temporal continuity between the historical behavior trend features and the similarity calculation results. When the temporal continuity meets the verification rules, determine the corresponding load mode label as the container service load mode.

5. The method according to claim 4, characterized in that, The step of performing adaptive fuzzy processing on the container behavior feature set based on the container service load mode to generate an adaptive fuzzy feature set includes: Calculate the posterior probability range of the load probability distribution matrix corresponding to the container service load mode, and use the range as a load fluctuation sensitivity parameter; Based on the load fluctuation sensitivity parameter, the membership function is reconstructed to obtain the adjusted membership function. The parameter reconstruction operation includes adjusting the position of the membership peak and adjusting the membership coverage. Calculate the matrix entropy value of the load probability distribution matrix, and set the number of feature stratification levels based on the matrix entropy value; Based on the number of quantization levels of the aforementioned features, and combined with the load probability distribution matrix, the determined behavioral features are subjected to probability-driven quantization to obtain the quantized determined features. The adjusted membership function is used to remap the fuzzy behavioral features to obtain the topologically reconstructed fuzzy behavioral features. The fuzzy behavioral features after topological reconstruction and the quantized deterministic features are concatenated to generate the adaptive fuzzy feature set.

6. The method according to claim 4, characterized in that, The formula for calculating the posterior probability is: in, Let x be the posterior probability that the dynamic sequence of container behavior belongs to load level k, where K is the total number of load levels, K=1 for low load, K=2 for medium load, and K=3 for high load. Let x be the mixing coefficient for load level k, and let x be the dynamic sequence of container behavior. Let k be the mean vector of the Gaussian distribution corresponding to load level k. Let k be the Gaussian distribution covariance matrix corresponding to load level k. This is the weighting coefficient for the amplitude of the behavioral fluctuations. The weighting coefficient is the frequency of the behavior change. The behavior fluctuation range of the container behavior dynamic sequence x under load level k. The frequency of behavior change of the container's dynamic sequence x under load level k. Let be the multivariate Gaussian probability density function corresponding to load level k.

7. The method according to claim 1, characterized in that, The step of generating a dynamic trust evaluation for the container network based on the container behavior dynamic sequence and the container trust status label, according to trust evaluation rules, includes: Based on the container's trusted state label, trust constraint parameters are extracted according to the trust evaluation rules to obtain a label constraint set; Based on the set of label constraints, the dynamic sequence of container behavior is segmented to obtain a set of behavior segments to be evaluated; Calculate the behavioral similarity between the behavior of each fragment in the set of behavioral fragments to be evaluated and the behavior of the predefined template behavior in the trust evaluation rules; Based on the behavioral similarity and combined with the trust level threshold range, a trust level for container behavior is set. Based on the trust level of the fragment, a time-series voting mechanism is used to determine the trust status, thereby obtaining the dynamic trust evaluation of the container network.

8. A dynamic trust assessment system for container networks, characterized in that, The system includes: The feature acquisition module is used to collect the container behavior feature set of the container network based on the runtime status information of the container network. The temporal modeling module is used to perform temporal modeling on the container behavior feature set to obtain a dynamic sequence of container behavior. The load identification module is used to input the dynamic sequence of container behavior into the machine learning network to identify the container business load pattern; The fuzzy processing module is used to perform adaptive fuzzy processing on the container behavior feature set based on the container business load mode, and generate an adaptive fuzzy feature set. The trust calculation module is used to obtain a dynamic trust score for the container by dynamically weighting the adaptive fuzzy feature set and the container behavior dynamic sequence, and to set a trust status label for the container based on the dynamic trust score. The trust evaluation module is used to generate a dynamic trust evaluation of the container network based on the container behavior dynamic sequence and the container trust status label, according to the trust evaluation rules.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images