A security-resilient edge-cloud collaborative service deployment method

Abstract

This invention discloses a method for deploying edge-cloud collaborative services with security resilience, belonging to the field of network and security technology. The method divides system runtime into multiple time slots. First, the business service provider constructs a business service graph by combining business requests and microservice dependencies. Then, the security service provider determines security service information based on attack patterns and microservice characteristics. Next, the edge-cloud service provider collects state information to construct a network topology graph and establishes a mathematical model with business throughput and security resilience as objectives. Then, a Transformer-based deep reinforcement learning algorithm is used to obtain and decide on deployment schemes. Finally, according to the decision, business services and some security services are deployed to the edge side, and the remainder is deployed to the cloud side. Security services record security events for attack pattern assessment in the next time slot. This invention addresses the competitive and cooperative relationship between business services using a microservice architecture and security services based on eBPF, achieving comprehensive optimization of business and security objectives.

Description

Technical Field

[0001] This invention relates to the field of network and security technology, and specifically to a method for deploying edge-cloud collaborative services with security resilience. Background Technology

[0002] With the deep integration of new-generation information technology and industry, the Industrial Internet of Things (IIoT) has become a crucial infrastructure supporting the digitalization, networking, and intelligentization of industry. The IIoT collects massive amounts of data by widely deploying sensors in industrial environments. This data is transmitted via network to computing platforms for processing and analysis, and the results are used to provide highly reliable, low-latency business services. In this context, microservice architecture breaks down a complex service into multiple single-function, collaborative microservices. Combined with container technology, microservices can be deployed independently and scaled rapidly. Even if one microservice fails, others can still function normally, improving the reliability of business services. Edge computing deploys servers close to data sources and users, pushing computing and storage resources to the network edge, reducing the load on the core network and lowering the latency of business services. Therefore, the combination of microservice architecture and edge computing offers a highly reliable, low-latency business service solution. The problem lies in the fact that a business request typically requires processing by multiple microservices, which may be deployed on different edge servers. When a large number of business requests arrive, frequent interactions between microservices can cause requests to repeatedly jump between edge servers, exceeding the response time threshold.

[0003] The Industrial Internet of Things (IIoT) faces increasingly severe security threats, and security incidents can have serious consequences. For example, denial-of-service attacks can reduce the availability of industrial systems, causing production stoppages; attacks targeting vulnerabilities can reduce the integrity of industrial systems, leading to product scrapping. Microservice architecture also brings new security challenges. Each microservice can interact with users or other microservices through standardized interfaces. The increase in service entry points leads to a wider attack surface. Furthermore, once an attacker compromises a microservice, they can leverage the dependencies between microservices and the weak isolation of containers to move laterally, expanding the attack scope. In this context, the extended Berkeley Packet Filter (eBPF), as an emerging technology, has attracted widespread attention due to its security potential. eBPF supports the execution of custom programs in kernel space: custom programs are compiled into bytecode, the bytecode is security-verified and compiled into machine code, the machine code is mounted to a specified location, and when a specific event occurs, the machine code is executed. Custom programs can also exchange data with user space through mapping mechanisms. In other words, eBPF-based security services can capture system calls and network traffic in kernel space through eBPF programs, and pass the relevant data to user space for security analysis. At the same time, security rules can be published to eBPF programs to prevent abnormal behavior and traffic.

[0004] Due to resource constraints on edge servers, deploying business and security services presents resource allocation challenges. On one hand, business services require sufficient resources to maintain low latency and high throughput; on the other hand, security services require continuous kernel-mode monitoring and user-mode detection. This is a non-zero-sum game, where over-allocating resources to one side leads to insufficient capacity in the other, potentially negatively impacting the system. For example, favoring business services may slow down security detection, making business services more vulnerable to attacks and potentially negating any initial increase in throughput.

[0005] In recent years, security resilience has gradually gained attention as a new security concept. Security resilience lies not only in a system's ability to defend against attacks, but also in its ability to maintain operation and recover after an attack. Cloud servers possess abundant resources that can be used for in-depth analysis of security services; edge servers may crash due to attacks, while cloud servers can ensure the availability of security services. Therefore, deploying security services on cloud servers can alleviate resource pressure on edge servers while ensuring the security of business services. However, eBPF programs need to be mounted on the kernel data path to capture network traffic and block abnormal traffic. This transforms the aforementioned resource allocation problem into a trade-off between computing, storage, and network resources. Deploying security services to edge servers consumes computing and storage resources, while deploying them to cloud servers consumes network resources for transmitting traffic data.

[0006] Different edge servers have varying resource conditions, and their workloads fluctuate over time. Furthermore, different business services have varying susceptibility to attacks. For edge servers with high computing or storage loads, and for business services with low attack sensitivity or tolerance for certain latency, security services can be deployed to the cloud. For edge servers with high network loads, and for business services emphasizing continuity, security services need to be deployed at the edge for timely detection.

[0007] The existing service deployment methods have the following shortcomings: (1) Most existing service deployment methods focus on business objectives. Some service deployment methods statically deploy security services and dynamically deploy business services. When the business load or security threat is low, it is easy to cause the resources of security services to be idle. The idle resources could have been used for business services, and the business objective is not actually optimal. Some service deployment methods treat security as a type of business and deploy it as a unified service. They only consider the competitive relationship and ignore the cooperative relationship between business services and security services, which makes it difficult to achieve comprehensive optimization of business objectives and security objectives.

[0008] (2) Security resilience is still in the qualitative stage and lacks quantitative analysis. Although some service deployment methods introduce cloud migration mechanisms, they are often based on experience or thresholds for decision-making. When resource conditions change, business load fluctuates, and security threats evolve, it is difficult to adjust decisions in a timely manner and maintain high security resilience.

[0009] (3) Most existing service deployment methods adopt metaheuristic algorithms and reinforcement learning algorithms. Although metaheuristic algorithms are good at global search for candidate solutions, they have a long computation time and are difficult to meet the online decision-making requirements of dynamic requests. When the state space and action space are large, reinforcement learning algorithms tend to converge slowly when training the model, which is not suitable for complex service deployment, and lacks a multi-objective weight adjustment mechanism. Summary of the Invention

[0010] Purpose of the invention: In view of the competitive and cooperative relationship between business services using a microservice architecture and security services based on eBPF, this invention aims to provide a security-resilient edge-cloud collaborative service deployment method to achieve comprehensive optimization of business and security objectives.

[0011] Technical solution: A method for deploying edge-cloud collaborative services with security and resilience, comprising the following steps: S1. Divide the system's runtime into multiple time slots. Business requests arrive at the beginning of each time slot, carrying microservice chain, arrival rate, and tolerable latency information. The business service provider obtains the business request information and, in conjunction with the microservice and its dependency information, constructs a business service graph. S2. The security service provider obtains the business service graph, generates the sensitivity of the microservice to attacks based on the current attack situation, microservice characteristics, and the criticality of the microservice, and determines the security service information. S3. The edge cloud service provider collects the status information of the edge cloud network, constructs a network topology map, and obtains the business service map and security service information to establish a mathematical model with business throughput and security resilience as optimization objectives and considering constraints. The mathematical model described uses variables To represent microservices Is it deployed to an edge server? Above, through variables To represent edge servers Deploy to security services At the edge or cloud side, on the edge server, business requests need to enter a queue and wait for transmission until the business requests that arrived before them have been transmitted. The modeling process includes considering that if any security service is deployed on a cloud server, the eBPF program will also queue the traffic data it needs to transmit to the cloud server. The security resilience in the optimization objective is defined as the system's ability to maintain and restore business throughput after being attacked; S4. Edge cloud service providers use Transformer-based deep reinforcement learning algorithms to obtain edge deployment solutions for multiple business services and edge cloud collaborative deployment solutions for security services, and make decisions based on business or security level requirements. S5. Based on the aforementioned decision, the edge-cloud service provider deploys business services and some security services to the edge side and the remaining security services to the cloud side. Within the current time slot, the security services record the occurrence of security events for attack posture assessment in the next time slot.

[0012] Further, in step S1, the business service is defined as ,in Represents a collection of microservices. A collection representing the dependencies between microservices. Microservices Resources needed ,in Represents computing resources. This indicates storage resources. microservices Processing speed. microservices microservices The dependencies between them indicate that microservices Calling microservices To execute the function. Because in this call, the microservice and microservices Both involve data input and output, so we use a unified approach. This indicates the amount of data exchanged between the two parties.

[0013] The set of business requests is Business Request Described as . This represents a microservice chain, and . This represents the arrival rate, which is the average number of times a service request arrives per unit of time. This event follows a Poisson distribution. This indicates the tolerance latency, meaning the business request is expected to be completed within this timeframe.

[0014] Furthermore, in step S2, the set of attacks is: The collection of security services is ,in This indicates an attack. Security services Detection successful. Security service. Resources needed ,in Represents computing resources. This indicates storage resources. Indicates security services The accuracy of the detection Indicates security services The detection speed. The sensitivity of microservices to attacks is:

[0015] Furthermore, in step S3, the edge-cloud network is defined as ,in Represents a collection of edge servers. Indicates cloud server, using This represents a set of links between servers.

[0016] Edge server Having resources , Represents computing resources. This indicates storage resources. Represents edge server The bandwidth. Represents edge server and edge servers The link between them Represents edge server and cloud servers The link between them and This indicates the bandwidth of the corresponding link. and This indicates the propagation delay of the corresponding link.

[0017] Furthermore, in step S3, the definition of the target service throughput for optimization is as follows: variable The definition is as follows:

[0018] variable The definition is as follows:

[0019] The total latency of a service request includes transmission latency, propagation latency, processing latency, and queuing latency.

[0020] For business requests Its transmission delay is calculated as:

[0021] Its propagation delay is calculated as:

[0022] Its processing latency is calculated as follows:

[0023] On the edge server, business requests need to be queued and wait for transmission until the business requests that arrived before them have been transmitted. If any security service is deployed on the cloud server, eBPF programs that need to transmit traffic data to the cloud server will also enter the queue.

[0024] According to the M / D / 1 queuing model, business requests The queuing delay is calculated as follows: Indicates the edge server within a unit of time. The amount of data to be transmitted is calculated as follows: Indicates whether security services are being used by edge servers. Deployed on a cloud server, it is calculated as: This represents the ratio of metadata to network traffic, as eBPF programs typically extract features from network traffic for security analysis.

[0025] Therefore, business requests The total latency is calculated as follows:

[0026] Business throughput is defined as the number of business requests that can be completed within the expected time, and is calculated as follows: Indicates a business request Whether it can be completed within the expected time is calculated as follows:

[0027] Furthermore, in step S3, the definition of optimizing the target safety resilience is as follows: Under attack After that, microservices The processing speed dropped to This can lead to increased processing delays for business requests, potentially causing the overall latency of business requests to exceed the tolerable latency. This indicates a business request under these circumstances. Can it be completed within the expected timeframe?

[0028] For microservices attack Continue until it is secured by security services Successful detection, duration depends on security service. Detection accuracy And detection time, for business requests It is calculated as: Indicates security services The detection time depends on the security service. Location and detection speed It is calculated as:

[0029] Security resilience is defined as the ability of a system to maintain and restore business throughput after being attacked.

[0030] In microservices Attacked Subsequently, the safety resilience was calculated as follows:

[0031] The overall safety resilience was calculated as follows:

[0032] Furthermore, the constraints in step S3 are defined as follows:

[0033] This constraint ensures that each microservice is deployed on an edge server, guaranteeing the normal operation of business services.

[0034]

[0035] This constraint ensures that the resources required by a service deployed on each edge server do not exceed the resources it has available.

[0036]

[0037] This constraint prevents the transmission wait queue of each edge server from extending indefinitely.

[0038] Furthermore, in step S4, the Transformer-based deep reinforcement learning algorithm specifically includes: S41: Designing Multi-Objective Weights , , Weights representing business throughput The weights represent the resilience of the security system. During training, the neural network parameters of the previous multi-objective weights are used as the initial neural network parameters for the next multi-objective weights.

[0039] S42: The Transformer encoder encodes edge cloud network information, business services and business request information, and security service information.

[0040] S43: The Transformer decoder decodes the encoded information to generate the probability of each microservice being deployed to each edge server, and the probability of each security service being deployed to the edge side for each edge server.

[0041] S44: During training, the policy network selects deployments based on a random policy, while the baseline network selects deployments based on a greedy policy. In each batch, the parameters of the policy network are updated using the policy gradient method. The deployment schemes of the policy network and the baseline network are compared using a T-test. If the policy network outperforms the baseline network at a high confidence level, the parameters of the baseline network are updated using the parameters of the policy network.

[0042] Furthermore, in step S42, the encoding process specifically includes: S42.1: By embedding edge cloud network information, business service and business request information, and security service information into a high-dimensional space through a linear layer, specifically: , , These represent the Layer 0 edge servers. microservices Security services Embedded information, Represents a linear transformation. This indicates that information with the same dimension is connected.

[0043] , , These represent the embedded information of the Layer 0 edge cloud network, business services and business requests, and security services, respectively.

[0044] S42.2: By using a multi-head attention layer, residual connection layer, batch normalization layer, and fully connected feedforward layer, the embedded information of the edge-cloud network includes contextual information, specifically:

[0045] Multi-head attention layer has Head. For each head, Indicates a query. Indicates key, The attention values ​​are represented by the query and key, and the attention weights are calculated. The sum of the attention weights and the attention values ​​is then calculated to obtain the attention value. The attention values ​​from multiple heads constitute the embedding information of the edge cloud network, making it contain contextual information.

[0046]

[0047] The residual connection layer enables the embedded information of the edge cloud network to include the original information. The batch normalization layer and the fully connected feedforward layer enhance the expressive power of the embedded information of the edge cloud network.

[0048] S42.3: By using a multi-head attention layer, residual connection layer, batch normalization layer, and fully connected feedforward layer, the embedded information of business services and business requests includes contextual information.

[0049] S42.4: By using a multi-head attention layer, residual connection layer, batch normalization layer, and fully connected feedforward layer, the embedded information of security services includes contextual information.

[0050] S42.5: Embedded information connecting edge cloud networks, business services, and business requests, which includes contextual information from both sides through a multi-head attention layer, residual connection layer, batch normalization layer, and fully connected feedforward layer.

[0051] S42.6: The embedded information of the edge cloud network, business services and business requests, and security services is incorporated into the context information of the three parties through a multi-head attention layer, residual connection layer, batch normalization layer, and fully connected feedforward layer to form the final embedded information.

[0052] Furthermore, in step S43, the decoding process specifically includes: S43.1: For each microservice, connect the overall embedding information, the microservice's embedding information, and the multi-objective weight information to generate a query. Generate keys and values ​​based on the edge server's embedding information and calculate the compatibility between the microservice and each edge server.

[0053] The masking rules are designed to exclude edge servers that do not meet the deployment requirements:

[0054] Based on the compatibility between the microservice and each edge server, and the masking rules, generate the probability that each edge server will be selected by the microservice:

[0055] S43.2: For each edge server, connect the overall embedding information, the edge server's embedding information, and the multi-target weight information to generate a query. Generate keys and values ​​based on the security service's embedding information, and calculate the compatibility between the edge server and each security service.

[0056] The masking rules are designed to exclude security services that do not meet the deployment requirements:

[0057] Based on the compatibility between the edge server and each security service, and the masking rules, generate the probability that each security service will be selected by the edge server:

[0058] Beneficial effects: Compared with the prior art, the substantive features and significant effects of the present invention include: 1) achieving collaborative modeling and joint optimization of business services and security services, avoiding business or security imbalance caused by single-direction deployment; 2) introducing quantifiable security resilience indicators and integrating them into deployment decisions to achieve adaptive optimization in response to changes in attack posture; 3) adopting intelligent optimization algorithms suitable for complex edge cloud service scenarios to improve the speed and quality of deployment decisions. Attached Figure Description

[0059] Figure 1 This is a schematic diagram illustrating the deployment of business and security services by the edge-cloud service provider of this invention. Figure 2 This describes the encoding process for edge-cloud network information, service services and service request information, and security service information in this invention. Figure 3 The solution process for the deployment scheme of the business services and security services of this invention; Figure 4 This is a comparison curve of the throughput of the present invention and the comparison algorithm under different numbers of service requests; Figure 5 The curves show the security resilience of the present invention and the comparison algorithm under different numbers of business requests. Detailed Implementation

[0060] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0061] Example 1: Workflow of security services based on eBPF.

[0062] like Figure 1 As shown, in the user space of the edge server, the container engine is responsible for the unified management of business containers and security containers. Business containers are used to host business microservice instances, while security containers are used to host security services. In the kernel space, the eBPF program is mounted at a critical location in the network protocol stack to capture and perform preliminary processing of business traffic. The eBPF program can collect packet metadata without affecting packet forwarding and pass it to the user-space security service through a mapping mechanism. When the security service detects abnormal traffic, it can publish the blocking policy to the kernel-space eBPF program, which then performs traffic filtering at the fast data path or traffic control point.

[0063] This embodiment supports two modes for deploying security services. In Mode I, the security service is deployed on the edge, meaning the security container and the business container run together on the edge server. In this mode, business traffic can be detected and handled without crossing the cloud link, improving the system's response speed to attacks. In Mode II, the security service is deployed on the cloud, with only the kernel-level eBPF program remaining on the edge for traffic collection and rapid blocking. In this mode, the eBPF program transmits traffic characteristics over the network to the cloud-side security service for in-depth analysis, and the cloud returns security rules. This reduces the load on the user-space security analysis on the edge, but it additionally consumes bandwidth on the edge server and introduces transmission latency.

[0064] Based on these two models, business microservice instances require computing and storage resources on edge servers to ensure low-latency processing, while security services require computing and storage resources to perform traffic analysis, or consume bandwidth resources when deployed on the cloud side. Therefore, resource allocation issues arise between business services and security services at the edge. Over-allocation of resources to business containers may lead to a decrease in security detection capabilities, making the system more vulnerable to attacks; conversely, over-protecting security service resources may crowd out business processing capabilities, resulting in increased request latency and decreased business throughput.

[0065] Therefore, the technical problem to be solved by this invention is: how to adaptively determine the collaborative deployment mode of eBPF-based security services between the edge and the cloud in the face of limited heterogeneous edge resources, continuously changing business loads and attack situations, and to coordinate and optimize with the deployment strategy of business microservices, so as to improve security resilience while ensuring business throughput.

[0066] Example 2: Based on a microservice architecture, eBPF security service, and edge-cloud collaboration scenario, the implementation environment and parameters are set as follows: System time slot division: The system runtime is divided into fixed-length time slots. At the beginning of each time slot, business requests are received, and at the end of each time slot, the attack situation and deployment strategy are updated.

[0067] Business services and microservices: A collection of microservices is represented as These are data collection, traffic parsing, and business computation, respectively. The dependency relationship is represented as follows: , indicating the call chain Resource requirements , Configure it according to the standard microservice load settings. It involves two-way requests, follows a Poisson arrival pattern, and carries a microservice chain with tolerance for latency.

[0068] Attacks and Security Services: Attack sets are represented as This refers to traffic surge attacks and unauthorized access attacks. The security service is represented as... These correspond to the detection of the aforementioned attacks, based on eBPF kernel traffic capture. Sensitivity Matrix The value is (0, 1), representing the percentage of performance degradation after a microservice is attacked. Security service parameter: Detection accuracy. Detection speed Resource requirements .

[0069] Edge network: Edge servers are represented as It has limitations in CPU, memory, and bandwidth resources. Cloud server Sufficient resources are allocated to support in-depth analysis of some security services. Inter-edge links are represented as follows: The edge-cloud link is respectively This includes bandwidth and propagation delay.

[0070] Combination Figure 1-3 As shown, the encoding process for edge-cloud network information, business services and business request information, and security service information is as follows: Figure 2 As shown. The solution process for the deployment scheme of business services and security services is as follows. Figure 3 As shown.

[0071] The method provided by this invention has the following implementation steps: Step 1: Construct the business service graph The service provider begins receiving service requests in the time slot. , Extract microservice chains and reach rates Tolerance delay Combining microservice dependencies Construct a directed acyclic business service graph Clearly define the service call order and data exchange volume. .

[0072] Step 2: Determine security service information

[0073] Security service providers read the business service graph, assess the current attack posture based on historical security incidents, and generate a microservice-attack sensitivity matrix by combining the functions and criticality of microservices. .

[0074] Match a corresponding eBPF security service to each type of attack. Determine the needs for security service resources and detection speed. With detection accuracy .

[0075] Step 3: Constructing the edge cloud topology and multi-objective mathematical model

[0076] Edge cloud service providers collect data on edge node resources, link bandwidth, propagation latency, and other statuses to construct the edge cloud network topology. Introduce 0 and 1 to deploy variables, and use variables microservices Is it deployed to an edge server? Above, using variables Represents edge server Should security services be deployed? To the side of the clouds.

[0077] The calculations include: transmission delay Based on microservice deployment location and link bandwidth. Propagation delay. Based on the bidirectional propagation latency between servers. Handling latency. Based on data volume and microservice processing speed When attacked, it is reduced to Queue delay Based on the M / D / 1 queuing model, the eBPF traffic backhaul overhead caused by the deployment of security services in the cloud is included. Overall latency :satisfy The business request was successful. Business throughput. Statistics on the number of requests successfully completed within a time slot. Attack duration. Safety resilience With overall resilience : Business throughput maintenance and recovery capability under quantitative attacks.

[0078] The constraints are set as follows: Each microservice is uniquely deployed: .

[0079] Edge resources are not exceeded: CPU / memory usage ≤ available resources.

[0080] Queue stability: To avoid congestion and crashes.

[0081] Ultimately, a constrained mixed-integer optimization model is formed with the objectives of maximizing business throughput and maximizing security resilience.

[0082] Step 4: Solve using deep reinforcement learning based on Transformer.

[0083] Multi-objective weights: setting They control throughput and resilience preference respectively.

[0084] Transformer encoding embeds edge cloud information, business information, and security information into a high-dimensional space, and extracts contextual features through multi-head attention, residual, normalization, and feedforward layers.

[0085] Transformer Decoding: Outputs the probability of deployment to each edge for each microservice. Outputs the probability of edge / cloud deployment for each edge service. Candidate locations that do not meet resource / bandwidth constraints are eliminated using a mask. Policy Iteration: The policy network randomly explores, the baseline network greedily selects, the policy gradient is updated, and the baseline is updated using a T-test to quickly converge to the optimal deployment scheme.

[0086] Step 5: Perform deployment and situation update

[0087] Execution based on decision results: All business microservices are deployed to edge servers. High real-time security services are deployed at the edge; resource-intensive security services requiring in-depth analysis are deployed on the cloud, with only the eBPF data collection program remaining at the edge. Within the current time slot, security services record data such as attack events, detection duration, and traffic anomalies, which are used for attack posture assessment and sensitivity matrix updates in the next time slot, enabling dynamic iterative optimization.

[0088] Example 3: Deployment of edge-cloud collaborative services in the context of a smart factory.

[0089] This embodiment uses a smart factory as a case study. Its production line needs to run multiple microservices simultaneously, such as process parameter control services, quality inspection services, equipment status monitoring services, equipment fault diagnosis services, and production scheduling services. These microservices are deployed on edge nodes to meet the requirements of high reliability and low latency. Common network attacks, such as port scanning attacks, denial-of-service attacks, and data theft attacks, can lead to resource consumption on edge nodes, increased latency in business service responses, and even service interruptions. Therefore, in a smart factory scenario, it is necessary to collaboratively deploy business services and security services on both the edge and cloud sides to improve system security resilience while ensuring business performance.

[0090] The simulated network consists of 10 edge servers and 1 cloud server. The edge servers have 8-16 CPU cores, 16-32GB of memory, and 4-8Gbps bandwidth. The edge link has a bandwidth of 4-8Gbps and a propagation latency of 0.5-2.5ms; the edge-cloud link has a bandwidth of 2-4Gbps and a propagation latency of 2.5-7.5ms.

[0091] The simulation service includes 50 microservices and 5 types of security services. Each microservice requires 1-2 CPU cores and 2-4GB of memory, processing 100-200MB of data per second, and exchanging 0.1-1MB of data with other microservices per call. The security service also requires 1-2 CPU cores and 2-4GB of memory, with a detection accuracy of 0.75-0.95, and can detect 25-75MB of metadata per second. The microservices have an attack sensitivity of 0.3-0.9.

[0092] The simulation requests consist of 50-350 business requests. Each business request is processed by 2-8 microservices, arriving 1-9 times per second, and needs to be processed within 5-50ms.

[0093] The Transformer-based deep reinforcement learning algorithm of this invention will be compared with the Non-Dominated Sorting Genetic Algorithm-II (NSGA-II), the Decomposition-Based Multi-Objective Evolutionary Algorithm (MOEA / D), the Deep Q-Network Algorithm (DQN), and the Proximal Policy Optimization Algorithm (PPO).

[0094] Simulation results are as follows Figure 4 and Figure 5 As shown in the figure, the throughput of all algorithms increases with the number of requests. TDRL's throughput increases almost linearly with the number of requests and maintains the highest throughput across all request scales. When the number of requests reaches 350, TDRL's throughput is significantly higher than other algorithms, demonstrating superior resource scheduling capabilities. The figure also shows that TDRL maintains the highest security resilience across all request scales. NSGA-II and MOEA / D maintain relatively stable security resilience, but their overall levels are low, indicating that traditional multi-objective optimization algorithms struggle to adapt to dynamic environments. DQN and PPO perform better in most cases, demonstrating that reinforcement learning algorithms can learn deployment strategies through environmental interaction and adapt to dynamic environments. DQN is slightly better than PPO, possibly because DQN is more suitable for discrete decision-making problems such as service deployment and routing. As the number of requests increases, the security resilience of DQN and PPO decreases significantly, while TDRL's decrease is the slowest, indicating that TDRL can effectively allocate resources under high load.

[0095] TDRL achieves the highest throughput while maintaining the highest security resilience, successfully balancing business needs and security, rather than increasing throughput at the expense of security resilience. In contrast, some algorithms may increase throughput by reducing the on-premises deployment of security services, but this leads to reduced security resilience.

Claims

1. A security-resilient edge-cloud collaborative service deployment method, characterized in that, Includes the following steps: S1. Divide the system's runtime into multiple time slots. Business requests arrive at the beginning of each time slot, carrying microservice chain, arrival rate, and tolerable latency information. The business service provider obtains the business request information and, in conjunction with the microservice and its dependency information, constructs a business service graph. S2. The security service provider obtains the business service graph, generates the sensitivity of the microservice to attacks based on the current attack situation, microservice characteristics, and the criticality of the microservice, and determines the security service information. S3. The edge cloud service provider collects the status information of the edge cloud network, constructs a network topology map, and obtains the business service map and security service information to establish a mathematical model with business throughput and security resilience as optimization objectives and considering constraints. The mathematical model described uses variables To represent microservices Is it deployed to an edge server? Above, through variables To represent edge servers Deploy to security services At the edge or cloud side, on the edge server, business requests need to enter a queue and wait for transmission until the business requests that arrived before them have been transmitted. The modeling process includes considering that if any security service is deployed on a cloud server, the eBPF program will also queue the traffic data it needs to transmit to the cloud server. The security resilience in the optimization objective is defined as the system's ability to maintain and restore business throughput after being attacked; S4. Edge cloud service providers use Transformer-based deep reinforcement learning algorithms to obtain edge deployment solutions for multiple business services and edge cloud collaborative deployment solutions for security services, and make decisions based on business or security level requirements. S5. Based on the aforementioned decision, the edge-cloud service provider deploys business services and some security services to the edge side and the remaining security services to the cloud side. Within the current time slot, the security services record the occurrence of security events for attack posture assessment in the next time slot.

2. The edge-cloud collaborative service deployment method for security and resilience according to claim 1, characterized in that, Step S1, constructing the business service graph, includes the following modeling representation: Business services are defined as ,in Represents a collection of microservices. A set representing the dependencies between microservices; microservices Resources needed ,in Represents computing resources. Indicates storage resources, microservices microservices Dependencies between them; The set of business requests is Business Request Described as ,use This represents a microservice chain, and , This represents the arrival rate, which is the average number of times a service request arrives per unit of time. This event follows a Poisson distribution. This indicates the tolerance latency, meaning the business request is expected to be completed within this timeframe.

3. The edge-cloud collaborative service deployment method for security and resilience according to claim 1, characterized in that, The process of determining security service information in step S2 includes: The set of attacks is represented as The collection of security services is ,in This indicates an attack. Security services Successful detection; Security Services Resources needed ,in Represents computing resources. Indicates storage resources; The sensitivity of microservices to attacks set Represented as: ； In the formula, Represents a collection of microservices. Represents a set of attack types. It is a microservice index. It is an attack type index.

4. The edge-cloud collaborative service deployment method for security and resilience according to claim 1, characterized in that, The mathematical model construction of the network topology graph in step S3 includes the following process: Edge-cloud network is defined as ,in Represents a collection of edge servers. Indicates cloud server, Represents a set of links between servers; The process of defining the target service throughput optimization is as follows: variable ; variable ; For business requests Its transmission delay The calculation is as follows: In the formula, microservices microservices Dependency relationship between them Indicates edge server, To represent microservices Calling microservices The amount of data exchanged Represents edge server and edge servers The bandwidth of the link between them; Calculation of propagation delay ; Processing delay ; In the formula, Represents edge server and edge servers The propagation delay of the link between them and These represent microservices. and microservices Processing speed; On the edge server, business requests need to enter a queue and wait for transmission until the business requests that arrived before them have been transmitted. According to the M / D / 1 queuing model, business requests... Queuing delay The calculation is as follows: Indicates the edge server within a unit of time. The amount of data to be transmitted Represents edge server bandwidth, , Indicates whether security services are being used by edge servers. Deployed on a cloud server, the calculation is as follows: This represents the ratio of metadata to network traffic. Indicates security services A set; Business Request The overall delay is calculated as follows: Business throughput is defined as the number of business requests that can be completed within the expected time, and is calculated as follows: Indicates a business request Can it be completed within the expected timeframe? This represents the average number of service requests arriving per unit of time; this event follows a Poisson distribution. ； In the formula, This indicates the tolerance latency, meaning the business request is expected to be completed within this timeframe.

5. The edge-cloud collaborative service deployment method for security and resilience according to claim 1, characterized in that, In microservices Attacked After that, microservices The processing speed dropped to ,definition This indicates that a business request was made after an attack. Can it be completed within the expected timeframe? Computational attack Duration: Indicates security services The detection time depends on the security service. Location and detection speed , Indicates security services The accuracy of the detection; In microservices Attacked The calculation expression for safety resilience in the optimization objective is as follows: Overall safety resilience , Indicates a business request Can it be completed within the expected timeframe without being attacked? Indicates arrival rate, Indicates a business request and microservices Under attack Duration of the attack.

6. The edge-cloud collaborative service deployment method for security and resilience according to claim 3, characterized in that, The constraints set in the mathematical model in step S3 include: (1) Ensure that each microservice is deployed on an edge server to guarantee the normal operation of business services. The constraints are set as follows: (2) Ensure that the resources required by the services deployed on each edge server do not exceed the resources available to them. The constraint is set as follows: (3) To prevent the transmission waiting queue of each edge server from extending indefinitely, the following constraints are set: .

7. The edge-cloud collaborative service deployment method for security and resilience according to claim 1, characterized in that, In step S4, the deep reinforcement learning algorithm performs the following steps: S41. Designing Multi-Objective Weights , , Weights representing business throughput The weights representing security resilience are used during training, with the neural network parameters of the previous multi-objective weights being used as the initial neural network parameters for the next multi-objective weights. S42, the Transformer encoder encodes edge-cloud network information, business services and business request information, and security service information; S43, The Transformer decoder decodes the information based on the encoding information, generates the probability of each microservice being deployed to each edge server, and generates the probability of each security service being deployed to the edge side for each edge server; S44. During training, the policy network selects deployments based on a random policy, while the baseline network selects deployments based on a greedy policy. In each batch, the parameters of the policy network are updated using the policy gradient method. The deployment schemes of the policy network and the baseline network are compared using a T-test. If the policy network outperforms the baseline network at a high confidence level, the parameters of the baseline network are updated using the parameters of the policy network.

8. The edge-cloud collaborative service deployment method for security and resilience according to claim 7, characterized in that, In step S42, the encoding process specifically includes: S42.

1. By embedding edge cloud network information, business service and business request information, and security service information into a high-dimensional space through a linear layer, the embedded information of edge cloud network, business service and business request, and security service at layer 0 is obtained. S42.

2. By using a multi-head attention layer, residual connection layer, batch normalization layer, and fully connected feedforward layer, the embedded information of the edge cloud network includes contextual information. S42.

3. By using a multi-head attention layer, residual connection layer, batch normalization layer, and fully connected feedforward layer, the embedded information of business services and business requests includes context information. S42.

4. By using a multi-head attention layer, residual connection layer, batch normalization layer, and fully connected feedforward layer, the embedded information of the security service includes contextual information. S42.5, The embedded information of connecting edge cloud network, business services and business requests is made to include the context information of both parties through multi-head attention layer, residual connection layer, batch normalization layer and fully connected feedforward layer; S42.6 The embedded information of the edge cloud network, business services and business requests, and security services is incorporated into the context information of the three parties through a multi-head attention layer, residual connection layer, batch normalization layer, and fully connected feedforward layer to form the final embedded information.

9. The edge-cloud collaborative service deployment method for security and resilience according to claim 7, characterized in that, In step S43, the decoding process specifically includes: S43.1 For each microservice, connect the overall embedding information, the microservice's embedding information, and the multi-target weight information to generate a query. Generate keys and values ​​based on the edge server's embedding information. Calculate the compatibility between the microservice and each edge server. Design masking rules to exclude edge servers that do not meet the deployment conditions. Based on the compatibility and masking rules, generate the probability that each edge server will be selected by the microservice. S43.2 For each edge server, connect the overall embedding information, the edge server's embedding information, and the multi-target weight information to generate a query. Generate keys and values ​​based on the embedding information of the security service. Calculate the compatibility between the edge server and each security service. Design masking rules to exclude security services that do not meet the deployment conditions. Based on the compatibility and masking rules, generate the probability that each security service will be selected by the edge server.

Images