A resource cooperative scheduling and task allocation method across heterogeneous target field platforms

Abstract

The application discloses a kind of resource cooperation scheduling and task allocation methods across heterogeneous target platform, comprising: the unified resource semantic model across heterogeneous platform is constructed, heterogeneous resource unit is abstracted as standard node object and generates resource description vector, forms global resource atlas;In response to the task request of drill, it is disassembled into atomic task set and the task demand vector is defined;Based on global resource atlas and atomic task set, simulation pre-play environment is constructed, and evaluation index is generated by simulating execution to multiple initial scheduling schemes;Using intelligent decision engine, in combination with global resource atlas, task demand vector and evaluation index, the target scheduling strategy defined by the mapping relationship between task and resource is determined;The target scheduling strategy is converted into the execution instruction suitable for each platform and is issued for execution, while real-time monitoring and trusted notarization are carried out.The application breaks the resource island, reduces the scheduling failure risk through pre-play, improves the intelligentization, security and credibility of scheduling.

Description

Technical Field

[0001] This invention relates to the field of network resource scheduling technology, specifically to a method for resource collaborative scheduling and task allocation across heterogeneous test range platforms. Background Technology

[0002] Currently, network range construction commonly suffers from architectural heterogeneity, with different sub-platforms potentially employing virtualization, container orchestration, hardware-in-the-loop physical connectivity, and network simulation technologies. These heterogeneous platforms typically lack a unified resource description standard and management interface, leading to severe resource silos and hindering unified and efficient collaborative scheduling.

[0003] Existing scheduling technologies have the following main drawbacks: First, they cannot bridge the semantic gap between heterogeneous resources. For example, the port mapping relationships of physical switches cannot be directly and equivalently converted into the configuration parameters of virtual bridges, resulting in ineffective cross-platform resource coordination. Second, scheduling strategies are mostly static rule matching, lacking the ability to adapt to dynamic scenarios such as sudden traffic surges and node failures during network attack and defense exercises, resulting in poor robustness. Third, they lack a pre-verification mechanism for scheduling results. Directly issuing configurations can easily lead to connectivity breaks or latency inconsistencies between the logical topology and the physical mapping topology, affecting the realism and success rate of the exercises. Summary of the Invention

[0004] The main objective of this invention is to provide a resource collaborative scheduling and task allocation method across heterogeneous test range platforms, in order to solve the problems of resource scheduling difficulties, lack of dynamic adaptability and pre-verification mechanism caused by platform heterogeneity in the prior art.

[0005] To achieve the above objectives, this invention provides a method for resource collaborative scheduling and task allocation across heterogeneous test range platforms, comprising the following steps: constructing a unified resource semantic model across heterogeneous platforms, abstracting heterogeneous resource units from different underlying architectures into standard node objects, and generating resource description vectors describing the characteristics of the standard node objects based on preset attribute dimensions, forming a dynamically updated global resource graph; responding to user-submitted exercise task requests, parsing the macro-level task intent, decomposing it into a set of atomic tasks with dependencies, and defining a task requirement vector including resource requirement attributes for each atomic task; based on the global resource graph... A simulation pre-running environment is constructed using the atomic task set to simulate and execute multiple initial scheduling schemes in parallel, generating simulation pre-running data. Based on this data, evaluation indicators reflecting scheduling quality are generated. Using an intelligent decision engine, combined with the real-time status of the global resource graph, the task requirement vector, and the evaluation indicators, a target scheduling strategy is determined through multi-stage collaborative computation. This target scheduling strategy defines the mapping relationship between atomic tasks and specific heterogeneous resource units, as well as configuration instructions. The target scheduling strategy is then converted into execution instructions adapted to various underlying heterogeneous platforms and issued for execution, while the execution process is monitored in real-time and reliably stored.

[0006] Optionally, in the step of constructing a unified resource semantic model across heterogeneous platforms, a resource description vector describing the characteristics of the standard node object is generated based on a preset attribute dimension to form a dynamically updated global resource graph. Specifically, this includes: constructing a multi-dimensional encoding system including functional attributes, performance attributes, and constraint attributes; mapping the functional characteristics of heterogeneous resources to standard functional labels to generate functional codes; quantifying the physical and logical performance indicators of heterogeneous resources to generate performance codes; extracting the deployment boundary conditions and compatibility restrictions of heterogeneous resources to generate constraint codes; combining the functional codes, performance codes, and constraint codes to form the resource description vector, and using a heterogeneous adapter to convert the original state data of the underlying platform into the resource description vector in real time to update the global resource graph.

[0007] Optionally, in the step of parsing the macro task intent, it is decomposed into a set of atomic tasks with dependencies. Specifically, this includes: extracting key constraints from the exercise task request using natural language processing or structured template parsing; decomposing the macro task into a sequence of atomic tasks in a directed acyclic graph structure, where each atomic task represents the smallest deployable unit; defining the pre-dependencies and data flow between atomic tasks, identifying the critical paths that affect the overall task execution efficiency, and assigning high priority weights to atomic tasks located on the critical paths.

[0008] Optionally, in the step of constructing the simulation pre-running environment, multiple initial scheduling schemes are simulated and executed in parallel. Specifically, this includes: instantiating a lightweight digital twin model based on the current state of the global resource graph and the logical topology of the tasks to be assigned, wherein the lightweight digital twin model uses queuing theory or statistical flow model to simulate node behavior and link characteristics; generating multiple initial scheduling schemes, including a rule-based baseline scheme and a randomly generated exploration scheme; running the various initial scheduling schemes in parallel in the lightweight digital twin model to simulate resource contention, link congestion, and node failure scenarios under high load; calculating the connectivity score, latency jitter variance, resource fragmentation degree, and resilience index of various initial scheduling schemes, and converting each indicator into reward signals to guide intelligent decision-making.

[0009] Optionally, the intelligent decision engine adopts a hierarchical multi-agent architecture, comprising a global coordinator agent and multiple domain manager agents. The global coordinator agent is used for macro-level load balancing and overall policy formulation across domain resources. The domain manager agents are deployed on various heterogeneous sub-platforms and are used to perform fine-grained scheduling within local constraints. The multi-stage collaborative computation includes: in the offline training stage, the global coordinator agent centrally collects experience data from each of the domain manager agents to update the shared policy network; in the online execution stage, the global coordinator agent outputs coordinated actions based on the global observation state, and each of the domain manager agents outputs execution actions based on its local observation state, with the two working together to achieve distributed scheduling.

[0010] Furthermore, when determining the target scheduling strategy, the intelligent decision engine also includes a security game mechanism: constructing a composite reward function that includes service quality, cost overhead, migration overhead, and security score; wherein, the security score is dynamically calculated based on the importance of the task and the exposure risk of the current resource node, and a positive reward is given when a high-value task is scheduled to a resource node with mimicry defense characteristics or strong concealment; when a sudden change in the environmental state due to an attack is detected, a rescheduling mechanism is triggered to migrate the critical task to a backup resource or a decoy resource.

[0011] Optionally, the target scheduling policy is converted into execution instructions adapted to various underlying heterogeneous platforms. Specifically, this includes: identifying the heterogeneous platform type to which the target resource involved in the target scheduling policy belongs; calling a dedicated adapter corresponding to the heterogeneous platform type to convert general scheduling instructions into application programming interface call commands or configuration messages specific to that platform; and performing resource creation, network connectivity configuration, and task loading operations to achieve unified control across virtualization environments, containerized clusters, physical hardware devices, and network emulators.

[0012] Optionally, the execution process is monitored and reliably stored in real time. Specifically, this includes: collecting actual load, network latency, and packet loss rate indicators through probes deployed on resource nodes and links, and comparing them with simulation data; when the deviation between the measured indicators and the simulation data exceeds a set threshold, an emergency rescheduling mode is automatically triggered to execute a circuit breaker plan that isolates the damaged area, activates cold backup resources, or degrades non-critical tasks; and using blockchain technology, the hash value of the scheduling decision, resource usage details, task execution result summary, and operator identity are packaged and stored on the blockchain, and the compliance of the scheduling process is verified through smart contracts.

[0013] Furthermore, the matching calculation of the resource description vector adopts a weighted scoring mechanism: the functional similarity between the task requirement vector and the resource description vector is calculated, and the functional similarity is obtained based on the cosine similarity of the semantic embedding vector; the performance satisfaction rate between the actual performance index of the resource and the minimum performance threshold of the task is calculated; the constraint compliance of the resource is determined to meet all hard constraints; the weight coefficients of functional similarity, performance satisfaction rate and constraint compliance are dynamically adjusted according to the goal of the current exercise stage, and the final matching score is calculated to determine the candidate resource set.

[0014] Optionally, the method further includes an adaptive evolution mechanism: during the attack and defense exercise, continuously collect deviation information between the actual scheduling effect data and the expected target; feed the deviation information back to the intelligent decision engine as a new training sample; and adopt a course learning mechanism to gradually increase the node scale, number of heterogeneous types and attack complexity of the training scenario, guiding the intelligent decision engine to update the policy network parameters so that it can adapt to a more complex dynamic adversarial environment.

[0015] The present invention, through the above technical solution, has the following beneficial effects: This invention constructs a unified resource semantic model, abstracting heterogeneous resource units into standard node objects and generating unified resource description vectors. This breaks down the semantic gap and technical barriers between different platforms, achieving a unified view and management of various resources such as virtualization, containerization, and physical devices, effectively solving the resource silo problem. By constructing a simulation pre-deployment environment, multiple scheduling schemes are simulated and evaluated before actual deployment, enabling the prediction and avoidance of potential resource conflicts, network congestion, or connectivity issues in advance, significantly reducing the risk of scheduling failure and improving the reliability and robustness of scheduling strategies. By adopting an intelligent decision-making engine based on a multi-agent architecture and combining it with a secure game mechanism, scheduling decisions can comprehensively consider multiple dimensions such as performance, cost, and security, and can adaptively adjust and reschedule according to dynamic environmental changes, improving the intelligence level of resource allocation and its survivability in adversarial environments. By using blockchain for trusted storage of key information such as scheduling decisions, execution processes, and results, the transparency, immutability, and traceability of the entire scheduling process are ensured, providing reliable technical guarantees for responsibility identification and auditing in multi-party collaborative scenarios. Attached Figure Description

[0016] The features and advantages of the invention will be more clearly understood by referring to the accompanying drawings, which are schematic and should not be construed as limiting the invention in any way. In the drawings: Figure 1 This is a flowchart of the resource collaborative scheduling and task allocation method for cross-heterogeneous test range platforms of the present invention. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Before providing a further detailed description of the embodiments of the present invention, the nouns and terms involved in the embodiments of the present invention will be explained, and the nouns and terms involved in the embodiments of the present invention shall be interpreted as follows.

[0019] Heterogeneous test range platform: refers to a comprehensive network simulation and training environment that integrates multiple different underlying technical architectures. These technical architectures may include, but are not limited to, resource pools based on virtualization technology (such as VMware and OpenStack), clusters based on containerization technology (such as Docker and Kubernetes), hardware-in-the-loop systems directly composed of physical servers or network devices, and network simulation environments built using discrete event simulation software (such as NS-3 and GNS3). Heterogeneity is the main characteristic and management difficulty of such platforms.

[0020] Resource semantic model: refers to a standardized and abstract data model established to eliminate the description differences between heterogeneous resources. It transforms resource information from different sources and in different formats into a universal, machine-understandable language by defining a unified vocabulary, attributes and relationships, thereby achieving unified cognition and management of heterogeneous resources.

[0021] Standard node object: In the resource semantic model, it refers to the abstract representation of a specific, smallest resource unit. Whether it is a virtual machine, a container, a physical switch, or a virtual router in a simulated network, they are all uniformly regarded as a standard node object in this method, with standard attributes and interfaces.

[0022] Resource description vector: This refers to a mathematical representation used to quantitatively describe the characteristics of a standard node object. It is usually a multi-dimensional vector, with each dimension corresponding to a specific attribute of the resource (such as the number of CPU cores, memory size, whether it supports a specific function, etc.). By vectorizing the various characteristics of the resource, it is easier to perform subsequent similarity calculations, matching, and optimization decisions.

[0023] Global Resource Graph: This refers to a dynamic, global resource database that stores all standard node objects in the network range, as well as their connections and dependencies, in the form of a graph data structure. This graph reflects the resource inventory, status, and topology of the entire range in real time and is the core data foundation for intelligent scheduling.

[0024] Atomic task: refers to the smallest indivisible execution unit that is broken down from the macro-level exercise intent during the task decomposition process. For example, "deploying a web server" or "configuring a firewall rule" can be regarded as an atomic task. Each atomic task has clear resource requirements and execution goals.

[0025] Task requirement vector: In contrast to resource description vector, it is a mathematical representation used to quantitatively describe the resource requirements of an atomic task. It is also a multi-dimensional vector that defines the functions, performance and constraints that the resources required to execute the task should have, and serves as the basis for achieving precise matching between tasks and resources.

[0026] Intelligent decision engine: This refers to the core component responsible for calculating scheduling strategies in this method. Unlike traditional schedulers based on static rules, it can comprehensively utilize real-time data, historical experience, and predictive models to dynamically generate optimal or near-optimal resource scheduling schemes through complex algorithms (such as machine learning, operations research, etc.).

[0027] Target scheduling strategy: refers to the complete scheme output by the intelligent decision engine that guides the actual allocation and configuration of resources. It clearly defines which specific heterogeneous resource unit should carry each atomic task and includes all necessary configuration parameters and execution instruction sequences.

[0028] Lightweight digital twin models are simplified simulation models built for rapid simulation and evaluation of scheduling strategies. They do not aim for 100% accurate reproduction of the physical world, but rather simulate the key dynamic behaviors of the system (such as resource contention and network congestion) through mathematical abstractions (such as queuing theory and statistical models), thereby achieving millisecond-level rapid simulation while ensuring sufficient prediction accuracy.

[0029] See Figure 1 The present invention aims to provide a resource collaborative scheduling and task allocation method across heterogeneous test range platforms to solve the problems of resource silos, low scheduling efficiency, lack of dynamic adaptability and reliable auditing caused by the heterogeneous resource architecture of network test ranges in the prior art. The method shields the underlying differences by constructing a unified semantic layer, improves the foresight of decision-making by using digital twin pre-simulation, and achieves optimal resource allocation in dynamic environments by using intelligent algorithms.

[0030] In a specific implementation scenario, the method first executes step S1, which involves building a unified resource semantic model across heterogeneous platforms. The purpose of this step is to establish a globally unified resource view. In traditional network testbeds, administrators need to log into the OpenStack console, Kubernetes dashboard, and physical switch command line separately to view and manage resources, resulting in completely fragmented information. This method, by deploying a data acquisition adapter, actively pulls raw resource information from various heterogeneous platforms and uniformly converts it into standard node objects. For example, a virtual machine instance on OpenStack and a physical server are both abstracted in the model as "compute node" objects with standard attributes such as CPU, memory, and disk. These objects and their connections together constitute a global resource graph. In this way, the problem of semantic incompatibility among heterogeneous resources is solved, laying the data foundation for unified scheduling at the upper layer. Next, step S2 is executed, which responds to user-submitted exercise task requests and parses the macro-level task intent. Users typically describe tasks in high-level language, such as "simulate an APT attack against a banking system." Such descriptions cannot be directly executed. The purpose of this step is to transform this vague intent into a set of machine-executable instructions. The system parses and breaks it down into... The process involves a series of interdependent atomic tasks, such as deploying a "bank core database" server, deploying a "web portal" server, configuring an "internal and external network isolation firewall," and launching an "attacker botnet." Simultaneously, a task requirement vector is generated for each atomic task, precisely defining its required resource specifications. For example, the database server requires at least 4 CPU cores, 16GB of memory, and high IOPS storage. This step translates the macro-level intent into specific, quantifiable scheduling objectives. Subsequently, step S3 is executed: based on the global resource graph and the set of atomic tasks, a simulation pre-run environment is constructed and evaluated, and the scheduling scheme is directly deployed to the real environment. There are risks involved, such as inaccurate resource estimates that could lead to exercise failure. This step involves rehearsing multiple possibilities before execution. The system generates several initial scheduling schemes, such as Scheme A deploying all services on a virtualization platform and Scheme B deploying the database on a high-performance physical machine. Then, these schemes are simulated in a lightweight simulation environment to observe potential resource bottlenecks or network congestion. Based on the simulation data, evaluation indicators for scheduling quality are generated, such as the estimated transaction response time of Scheme A being 200ms and Scheme B being 50ms. In this way, quantitative and forward-looking data support is provided for the final decision, avoiding the risks of blind scheduling.Then, step S4 is executed, which utilizes the intelligent decision engine to determine the target scheduling strategy. Simple rule-based scheduling cannot adapt to complex dynamic environments. This step selects the optimal scheduling strategy from numerous possibilities in a more intelligent way. The intelligent decision engine comprehensively considers three inputs: the real-time status of the global resource graph, the task requirement vector, and the evaluation metrics generated in step S3. Internally, the engine performs multi-stage collaborative calculations through optimization algorithms to ultimately determine a target scheduling strategy. This strategy is a detailed execution plan that clarifies the mapping relationship and configuration instructions between each atomic task and specific heterogeneous resource units. For example, it maps the "bank core database" task to physical server P01 and includes a configuration script for installing the Oracle database. This achieves a leap from "feasible" to "optimal." Finally, step S5 is executed, which involves converting instructions and issuing execution and monitoring commands. After determining the target scheduling strategy, it needs to be converted into commands that various heterogeneous platforms can understand and execute. This step is the bridge connecting decision-making and execution. The system converts general scheduling instructions (such as "create a virtual machine") into platform-specific API calls (such as OpenStack's Nova). After the API call command is issued, the system will also monitor the task's execution status and resource load in real time through deployed probes. Simultaneously, to ensure the credibility of the process, especially in multi-party exercises, key information from the scheduling process will be reliably stored. Through this series of operations, not only is cross-platform automated execution achieved, but the reliability and traceability of the execution process are also guaranteed.

[0031] In a preferred embodiment, in step S1, a multi-dimensional coding system including functional attributes, performance attributes, and constraint attributes is constructed to decouple and quantify the "what can be done," "how well it can be done," and "what limitations it has" of a resource. Specifically, firstly, the functional characteristics of heterogeneous resources are mapped to standard functional labels to generate functional codes. For example, whether it is the ACL function of a Cisco ASA firewall or the iptables firewall on a Linux server, their core function is packet filtering, so they can be uniformly mapped to a standard label such as "std:net:packet_filter," and a vector representation is generated through semantic embedding technology. Secondly, the physical and logical performance indicators of heterogeneous resources are quantified to generate performance codes. For example, CPU computing power is standardized to GFLOPS and network bandwidth is normalized to Gbps. Finally, the deployment boundary conditions and compatibility constraints of heterogeneous resources are extracted to generate constraint codes, such as the physical location of the server, its security domain, and whether it supports hot migration, etc., which are Boolean or enumerated attributes. By combining these three codes, a comprehensive resource description vector is formed. The original state data of the underlying platform (such as CPU utilization and memory usage) is collected in real time through the heterogeneous adapter and converted into an updated resource description vector, thereby ensuring the dynamism and accuracy of the global resource map. This multi-dimensional coding system solves the matching error problem caused by incomplete resource description in traditional scheduling and realizes a deep insight into resource capabilities.

[0032] In another preferred embodiment, a weighted scoring mechanism is used for matching resource description vectors. When the system needs to find suitable resources for a task, a quantitative method is needed to evaluate the matching degree. This embodiment achieves this through comprehensive scoring: First, the functional similarity between the task requirement vector and the resource description vector is calculated. This is usually based on the cosine similarity of their semantic embedding vectors encoded by their functions. The higher the similarity, the more the resource's function meets the task requirements. Second, the performance satisfaction rate between the actual performance indicators of the resource and the minimum performance threshold of the task is calculated. For example, if the task requires a 2GHz clock speed and the resource has 4GHz, the satisfaction rate is 200%, which ensures that the resource performance is sufficient to support the task operation. Third, it is determined whether the resource is suitable for the task. Whether the resource meets all hard constraints is determined by a Boolean decision. If any hard constraint (such as the requirement to deploy in a specific security domain) is not met, the resource is discarded. Finally, the weight coefficients of functional similarity, performance satisfaction rate, and constraint compliance are dynamically adjusted according to the objectives of the current exercise phase to calculate the final matching score. For example, in the early stages of an exercise emphasizing rapid response, the weight of performance satisfaction rate may be higher; in the adversarial phase emphasizing security, the weight of security-related constraint compliance will be increased. Through this weighted scoring mechanism, the resource selection process is no longer a simple "yes / no" judgment, but can dynamically select the "most suitable" resource based on the task context, significantly improving the flexibility and intelligence of scheduling.

[0033] Furthermore, in step S2, natural language processing or structured template parsing is used to extract key constraints from the exercise task request, such as "latency less than 50ms" and "must use domestically produced equipment." More importantly, the macro-task is decomposed into a sequence of atomic tasks in a directed acyclic graph (DAG) structure. In this graph structure, each atomic task represents a minimum deployable unit, like a node in the graph. The precedence relationships between tasks are represented by directed edges in the graph. For example, the database service node must point to the application service node, indicating that the database must start before the application. Simultaneously, the data flow between atomic tasks is defined. The principle behind this design is that it models complex task flows in a structured and visual way, making it easier for computers to analyze and optimize. Based on this directed acyclic graph, the system can automatically identify the critical path that affects the overall task execution efficiency using graph theory algorithms. The critical path is the longest execution path in the graph, and its total time determines the final completion time of the entire task. By assigning high priority weights to atomic tasks located on the critical path, the scheduling system will prioritize meeting the needs of these critical tasks when allocating resources, thereby effectively shortening the preparation and execution time of the overall exercise and achieving global optimization of the task execution flow.

[0034] In an optional implementation, instead of employing a heavyweight full-system simulation in step S3, a lightweight digital twin model is instantiated based on the current state of the global resource graph and the logical topology of the tasks to be assigned. The core idea of ​​this model is to replace the real system behavior with a mathematical model. Specifically, it uses queuing theory or statistical flow models to simulate node behavior and link characteristics. For example, a web server is modeled as an M / M / k queuing system, whose service rate is determined by its performance coding; the network link is modeled as a channel with a specific delay distribution and packet loss rate. The system generates multiple initial scheduling schemes, including baseline schemes generated based on expert rules and randomly generated schemes to explore better solutions. The system explores different scenarios and then runs them in parallel within the lightweight digital twin model. These scenarios simulate resource contention under high load (such as CPU queue overflow), link congestion, and node failure after an attack. Through this rapid simulation, the system can calculate a series of key performance indicators for each scenario, including connectivity score, latency jitter variance, resource fragmentation degree, and resilience index. These indicators are ultimately transformed into reward signals to guide the intelligent decision engine's learning (e.g., high score for low latency, low score for high fragmentation). This lightweight digital twin pre-simulation mechanism can predict the consequences of different decisions at extremely low cost and high efficiency without touching the real system, greatly enhancing the foresight and scientific nature of scheduling.

[0035] Furthermore, the intelligent decision engine adopts a layered multi-agent architecture. This architecture balances the breadth of global optimization with the depth of local execution. Specifically, the intelligent decision engine includes a global coordinator agent and multiple domain manager agents deployed on various heterogeneous sub-platforms. The global coordinator agent is responsible for macro-level load balancing and overall strategy formulation across domain resources from a global perspective. For example, it determines which heterogeneous sub-platforms or groups of heterogeneous platforms a complex task should be decomposed for execution. Each domain manager agent, within its managed platform, performs fine-grained scheduling based on the macro-level instructions issued by the global coordinator, combined with local resource status and constraints. For example, it determines which virtual machine or container a task should use. This multi-level... The collaborative computing process is divided into two stages: offline training and online execution. In the offline training stage, the global coordinator agent centrally collects the experience data (such as state, action, reward, etc.) generated by each domain manager agent in the past when performing tasks, and uses this data to update a shared policy network. In the online execution stage, the global coordinator agent outputs coordinated actions based on its global observation of the entire target range, while each domain manager agent outputs the final execution action based on its more refined local observation. Through this centralized learning and distributed execution mode, the two work together to ensure the global optimality of the decision and achieve low-latency distributed response, which greatly improves the scalability and robustness of the scheduling system.

[0036] In a preferred embodiment, based on the aforementioned multi-agent architecture, the intelligent decision engine introduces a security game mechanism when determining the target scheduling strategy. Traditional scheduling systems often only focus on performance and cost, while this embodiment takes security as a core optimization objective. The system constructs a composite reward function that includes Quality of Service (QoS), cost overhead, migration overhead, and security score. Among these, the security score is a key innovation, dynamically calculated based on the importance of the task and the exposure risk of the current resource node. For example, when an atomic task marked as "high-value" (such as the core database) is scheduled to a resource node with mimicry defense characteristics or network stealth... When a powerful resource node is assigned, the system provides a significant positive reward; conversely, if it is assigned to a node known to have vulnerabilities or exposed to the public network, a negative penalty is imposed. This mechanism guides the agent to proactively seek advantages and avoid disadvantages when making decisions, achieving intrinsic security scheduling. In addition, the mechanism also has dynamic response capabilities. When a sudden change in the environmental state due to a network attack is detected (for example, a node is compromised and its performance drops sharply), a rescheduling mechanism is immediately triggered to automatically and quickly migrate the affected critical tasks to safe backup resources or preset decoy resources, thereby gaining the initiative in the game and ensuring the continuity and security of the exercise tasks.

[0037] In a preferred embodiment, in step S5, the target scheduling policy output by the intelligent decision engine is a platform-independent general description, such as "run the 'nginx:latest' image on the node with resource ID 'vm-0a3b'". To enable execution on a specific platform, this must be translated. This embodiment first identifies the heterogeneous platform type of the target resource (e.g., 'vm-0a3b') involved in the target scheduling policy. For example, querying the global resource graph reveals that it belongs to an OpenStack platform. Then, the system calls a dedicated adapter corresponding to this heterogeneous platform type. This adapter converts the general scheduling instructions into platform-specific application programming interface (API) call commands or configuration messages. For example, for the OpenStack platform, the adapter generates JSON requests conforming to its Neutron API specification to configure the network, and generates Nova... The API specification requests to create virtual machines. For Kubernetes clusters, the adapter generates YAML-formatted Deployment and Service definition files. In this way, the system can perform resource creation, network connectivity configuration, and task loading operations without discrimination, realizing unified control and orchestration of various environments such as virtualization environments, containerized clusters, physical hardware devices, and network emulators, and completely bridging the "last mile" from decision-making to execution.

[0038] In another preferred embodiment, in step S5, lightweight probes deployed on resource nodes and links are used to collect real-time key performance indicators such as actual system load, network latency, and packet loss rate. The system compares these measured indicators with the predicted data generated in the simulation pre-running phase of step S3 in real time. When the deviation between the measured indicators and the pre-running data exceeds a preset threshold (e.g., the actual latency is 30% higher than the predicted value), the system determines that an anomaly has occurred and automatically triggers an emergency rescheduling mode. In this mode, the system executes a predefined circuit breaker plan, such as automatically isolating the damaged network area, enabling cold backup resource takeover services, or degrading non-critical tasks. To ensure the operation of core businesses, this embodiment also employs blockchain technology for trusted evidence storage in order to address trust issues in multi-party collaboration. Key information for each scheduling decision, including the hash value of the decision itself, details of resource usage involved, a summary of task execution results, and the digital identity of the operator, is packaged into a transaction, broadcast to the consortium blockchain, and stored in encryption. By leveraging the immutability and decentralization of blockchain, and through smart contracts to automatically verify the compliance of the scheduling process, an absolutely credible basis can be provided for post-event auditing, accountability, and resource billing. This has extremely high application value in scenarios such as cross-agency joint exercises.

[0039] Furthermore, this embodiment of the invention also provides an adaptive evolution mechanism, enabling the entire scheduling system to continuously learn and improve itself. During attack and defense exercises, the system continuously collects deviation information between actual scheduling performance data (such as task completion time, resource utilization, security incident occurrence rate, etc.) and expected goals. This deviation information, whether positive (exceeding expectations) or negative (failing to achieve the goal), is considered valid feedback data. The system uses this deviation information as new training samples and feeds it back to the intelligent decision engine. More specifically, the intelligent decision engine employs curriculum learning... The system trains the agent using a learning mechanism that mimics the human learning process, progressing from easy to difficult. In the early stages of training, the system provides the agent with simple scenarios characterized by small node size, homogeneous resource types, and no attacks. Once the agent's policy network converges in these simple scenarios, the complexity of the training scenarios is gradually increased. For example, the node size is increased, the types of heterogeneous resources are increased, and more complex and covert network attack methods are introduced. Through this gradual training approach, the intelligent decision engine can be effectively guided to update its policy network parameters, preventing it from getting trapped in local optima too early in a complex solution space. This allows the agent to gradually learn to handle more complex dynamic adversarial environments, ultimately achieving adaptive evolution of scheduling capabilities.

[0040] The following is a complete embodiment to illustrate the specific application of the method of the present invention: Assume a network security attack and defense exercise scenario where the red team needs to penetrate a typical three-tier application system deployed by the blue team, which includes web services, application services, and database services. The blue team has deployed heterogeneous defense resources, including a VMware-based virtual firewall, a physical security gateway with mimicry defense capabilities, and a Kubernetes-based honeypot cluster.

[0041] First, the system executes step S1 to build a unified resource semantic model. Through adapter scanning, virtual firewalls in VMware, security gateways in physical racks, and Pod resources in Kubernetes clusters are all abstracted into standard node objects, and resource description vectors containing three dimensions of function, performance, and constraints are generated for them. For example, the function code of a physical security gateway is marked with the label "mimic_defense", and its high security level is marked in the constraint code. This information is gathered into a global resource map, forming an all-knowing panoramic view of resources.

[0042] Next, the exercise organizers submitted a task request, and the system executed step S2 to parse the macro-level task intent. The system decomposed tasks such as "deploying three-tier applications" and "deploying honeypots" into a series of atomic tasks such as deploying databases, deploying web applications, and configuring network policies, and constructed a directed acyclic graph of their dependencies. At the same time, a requirement vector was defined for each task. For example, the database task was marked as "high value" and had high requirements for security and performance.

[0043] In step S3, the system builds and evaluates a simulation pre-run environment. The system generates at least two initial scheduling schemes: Scheme A deploys all blue team services in a VMware virtualization environment; Scheme B, based on task value, plans to deploy high-value databases behind a physical security gateway with mimicry defense capabilities and expose web services in a relatively isolated area. The simulation is conducted using a lightweight digital twin model. The simulation results show that under simulated DDoS attacks, the database service latency jitter of Scheme B is much lower than that of Scheme A, and its evaluation index score is higher.

[0044] Subsequently, the core step S4 is taken, where the intelligent decision engine determines the target scheduling strategy. The intelligent decision engine is a hierarchical multi-agent system. After receiving the evaluation indicators from the simulation, the global coordinator agent, combined with its composite reward function, especially the security score item, discovers that scheduling high-value databases to the mimicry defense node can obtain extremely high security rewards. Therefore, it adopts a similar approach to scheme B and issues macro-scheduling instructions to the domain manager agent responsible for the physical device domain and another domain manager agent responsible for the VMware domain. Each domain manager agent completes specific resource selection and configuration within its own domain, ultimately forming a complete target scheduling strategy.

[0045] Finally, in step S5, the system performs instruction conversion, execution, and monitoring. The system calls the physical device adapter and configures the physical security gateway policy through the Netconf protocol. Simultaneously, it calls the VMware adapter and creates the virtual machines required for the Web service and application service through the vCenterAPI. During the exercise, probes deployed in the network detect the red team's scanning behavior on the Web service. This anomaly is compared with the pre-exercise data, and a deviation in the traffic model is found. The system triggers dynamic rescheduling, automatically diverting a portion of non-critical business traffic to the Kubernetes honeypot cluster to confuse the attacker and collect their attack behavior. All key decisions and state changes in the entire scheduling and rescheduling process are reliably stored on the blockchain, ensuring the transparency and non-repudiation of the exercise process. After the exercise, the system collects the deviation data of this successful capture of attack behavior as new training samples. Through an adaptive evolution mechanism, the system optimizes the policy network of the intelligent decision engine, enabling it to more proactively utilize honeypot resources in the future.

[0046] This invention can be applied to various specific scenarios. For example, in national-level cybersecurity attack and defense exercises, multiple participating units may bring their own different technology stacks and equipment. This method can quickly integrate these heterogeneous resources to form a unified exercise battlefield and provide a reliable basis for billing and liability determination. In cybersecurity teaching and training in universities or enterprises, this method helps teachers build complex, dynamic, and highly realistic experimental environments, allowing students to learn and practice under near-real-world conditions. For cloud service providers, this method can be used to launch "Cyber ​​Range as a Service," providing customers with a flexible and intelligent security product testing and verification platform. For security operations teams within large enterprises, this method can be used for routine "red team / blue team exercises" and "employee security awareness training," continuously testing and improving the overall security protection level of the enterprise through automation.

[0047] It should be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0048] The various embodiments in this invention are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0049] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this disclosure (including the claims) is limited to these examples; within the framework of this disclosure, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of one or more embodiments of the present invention as described above, which are not provided in detail for the sake of brevity.

[0050] Although this disclosure has been described in conjunction with specific embodiments thereof, many substitutions, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description.

[0051] One or more embodiments of the present invention are intended to cover all such substitutions, modifications, and variations falling within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of one or more embodiments of the present invention should be included within the scope of this disclosure.

Claims

1. A method for resource collaborative scheduling and task allocation across heterogeneous test range platforms, characterized in that, Includes the following steps: S1: Construct a unified resource semantic model across heterogeneous platforms, abstract heterogeneous resource units from different underlying architectures into standard node objects, and generate resource description vectors describing the characteristics of the standard node objects based on preset attribute dimensions to form a dynamically updated global resource graph. S2: In response to the user's submitted exercise task request, the macro task intent is parsed, broken down into a set of atomic tasks with dependencies, and a task requirement vector including resource requirement attributes is defined for each atomic task. S3: Based on the global resource map and the atomic task set, construct a simulation pre-run environment, perform parallel simulation execution of multiple initial scheduling schemes, generate simulation pre-run data, and generate evaluation indicators reflecting scheduling quality based on the simulation pre-run data; S4: Using an intelligent decision engine, combined with the real-time status of the global resource map, the task requirement vector, and the evaluation indicators, a target scheduling strategy is determined through multi-stage collaborative computation. The target scheduling strategy defines the mapping relationship between atomic tasks and specific heterogeneous resource units and configuration instructions. S5: Convert the target scheduling strategy into execution instructions adapted to various underlying heterogeneous platforms and issue them for execution, while performing real-time monitoring and reliable evidence storage of the execution process.

2. The resource collaborative scheduling and task allocation method for cross-heterogeneous test range platforms according to claim 1, characterized in that, In step S1, "generating resource description vectors describing the characteristics of the standard node objects based on preset attribute dimensions, forming a dynamically updated global resource graph" specifically includes: Construct a multi-dimensional coding system that includes functional attributes, performance attributes, and constraint attributes; Map the functional characteristics of heterogeneous resources to standard functional labels to generate functional codes; Quantify the physical and logical performance indicators of heterogeneous resources and generate performance codes; Extract the deployment boundary conditions and compatibility constraints of heterogeneous resources, and generate constraint codes; The function encoding, performance encoding, and constraint encoding are combined to form the resource description vector, and the original state data of the underlying platform is converted into the resource description vector in real time through a heterogeneous adapter to update the global resource graph.

3. The resource collaborative scheduling and task allocation method for cross-heterogeneous test range platforms according to claim 1, characterized in that, In step S2, "analyzing the macro-level task intent and breaking it down into a set of atomic tasks with dependencies" specifically includes: Key constraints are extracted from the exercise task request using natural language processing or structured template parsing methods. The macroscopic task is decomposed into a sequence of atomic tasks in a directed acyclic graph structure, where each atomic task represents the smallest deployable unit. Define the prerequisite dependencies and data flow between atomic tasks, identify the critical paths that affect the overall task execution efficiency, and assign high priority weights to atomic tasks located on the critical paths.

4. The resource collaborative scheduling and task allocation method for cross-heterogeneous test range platforms according to claim 1, characterized in that, In step S3, "constructing a simulation pre-running environment and performing parallel simulations of multiple initial scheduling schemes" specifically includes: Based on the current state of the global resource graph and the logical topology of the tasks to be assigned, a lightweight digital twin model is instantiated, wherein the lightweight digital twin model uses queuing theory or statistical flow model to simulate node behavior and link characteristics. Generate multiple initial scheduling schemes, including a rule-based baseline scheme and a randomly generated exploration scheme; Various initial scheduling schemes are run in parallel in the lightweight digital twin model to simulate resource contention, link congestion and node failure scenarios under high load. Calculate the connectivity score, latency jitter variance, resource fragmentation degree, and resilience index for each of the initial scheduling schemes, and convert each index into a reward signal to guide intelligent decision-making.

5. The resource collaborative scheduling and task allocation method for cross-heterogeneous test range platforms according to claim 1, characterized in that, In step S4, the intelligent decision engine adopts a hierarchical multi-agent architecture, which includes a global coordinator agent and multiple domain manager agents. The global coordinator agent is used for macro-level load balancing and overall strategy formulation for cross-domain resources; The domain manager agent is deployed on each heterogeneous sub-platform side and is used to perform fine-grained scheduling within local constraints; The multi-stage collaborative computing includes: during the offline training phase, the global coordinator agent centrally collects experience data from each of the domain manager agents to update the shared policy network; During the online execution phase, the global coordinator agent outputs coordination actions based on the global observation state, and each of the domain manager agents outputs execution actions based on the local observation state. The two work together to achieve distributed scheduling.

6. The resource collaborative scheduling and task allocation method for cross-heterogeneous test range platforms according to claim 5, characterized in that, In step S4, the intelligent decision engine further includes a secure game theory mechanism when determining the target scheduling strategy: Construct a composite reward function that includes service quality, cost, migration cost, and security score; The security score is dynamically calculated based on the importance of the task and the exposure risk of the current resource node. When a high-value task is scheduled to a resource node with mimicry defense characteristics or strong concealment, a positive reward is given. When an attack is detected that the environmental state has changed drastically, a rescheduling mechanism is triggered to migrate critical tasks to backup resources or decoy resources.

7. The resource collaborative scheduling and task allocation method for cross-heterogeneous test range platforms according to claim 1, characterized in that, In step S5, "converting the target scheduling strategy into execution instructions adapted to various underlying heterogeneous platforms" specifically includes: Identify the heterogeneous platform types to which the target resources involved in the target scheduling strategy belong; Invoke the dedicated adapter corresponding to this heterogeneous platform type to convert general scheduling instructions into application programming interface call commands or configuration messages specific to this platform; It performs resource creation, network connectivity configuration, and task loading operations, enabling unified control across virtualized environments, containerized clusters, physical hardware devices, and network emulators.

8. The resource collaborative scheduling and task allocation method for cross-heterogeneous test range platforms according to claim 1, characterized in that, In step S5, "real-time monitoring and trusted evidence storage of the execution process" specifically includes: The actual load, network latency, and packet loss rate indicators are collected by probes deployed on resource nodes and links, and compared with the simulation data in step S3. When the deviation between the measured indicators and the pre-simulation data exceeds the set threshold, the emergency rescheduling mode is automatically triggered to execute the circuit breaker plan, which includes isolating the damaged area, activating cold backup resources, or downgrading non-critical tasks. By using blockchain technology, the hash value of the scheduling decision, resource usage details, task execution result summary, and operator identity are packaged and stored on the chain, and the compliance of the scheduling process is verified through smart contracts.

9. The resource collaborative scheduling and task allocation method for cross-heterogeneous test range platforms according to claim 2, characterized in that, The matching calculation of the resource description vector adopts a weighted scoring mechanism: Calculate the functional similarity between the task requirement vector and the resource description vector, wherein the functional similarity is obtained based on the cosine similarity of the semantic embedding vectors; The performance satisfaction rate between the actual performance indicators of computing resources and the minimum performance threshold of the task; Determine whether the resource meets all hard constraints; The weighting coefficients of functional similarity, performance satisfaction rate, and constraint compliance are dynamically adjusted based on the objectives of the current exercise phase, and the final matching score is calculated to determine the candidate resource set.

10. The resource collaborative scheduling and task allocation method for cross-heterogeneous test range platforms according to any one of claims 1 to 9, characterized in that, The method also includes an adaptive evolution mechanism: During the offensive and defensive drills, we continuously collect data on the deviation between the actual scheduling effect and the expected goals. The deviation information is fed back to the intelligent decision engine as a new training sample. By adopting a course learning mechanism, the node scale, number of heterogeneous types, and attack complexity of the training scenario are gradually increased to guide the intelligent decision engine to update the policy network parameters, so that it can adapt to a more complex dynamic adversarial environment.

Images