A method for adaptive control of the running state of a comprehensive application security gateway

Abstract

The application belongs to the technical field of network security, and particularly relates to a kind of adaptive control method for operating state of comprehensive application security gateway, comprising: collecting packet processing rate and in-queue depth of security detection engine with fixed period, and calibrating in-queue depth baseline value and rate lower bound;The packet processing rate is input into Holt double exponential smoothing algorithm, the horizontal smoothing coefficient is dynamically adjusted to predict the packet processing rate at the next moment, and the backlog pressure compensation amount is calculated by combining the in-queue depth and the in-queue depth baseline value, and the integrated load demand prediction value is obtained by superposition;The remaining core is allocated to the security detection engine according to the demand ratio to execute core pre-scheduling;Calculate the prediction deviation, and perform bidirectional calibration on the base value of horizontal smoothing coefficient.The application eliminates the security detection blind window under the flow mutation scene, and improves the utilization balance of computing power among multiple engines.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and specifically relates to an adaptive control method for the operating status of a comprehensive application security gateway. Background Technology

[0002] As core boundary protection devices for information networks in industries such as transportation and communications, integrated security gateways need to run multiple independent security detection engines concurrently on the same hardware platform, including intrusion prevention, virus protection, web application protection, VPN encryption / decryption, and traffic control. These engines handle security tasks at different protocol layers, collectively constituting the device's data plane processing load. With the continuous integration of video private networks, industrial control systems, and business systems in the transportation industry, the scale of concurrent sessions and traffic types handled by a single security gateway are becoming increasingly complex. Efficiently allocating multi-core CPU resources to ensure the processing performance of all engines has become a core technical challenge for device operation and maintenance.

[0003] Patent document CN115098267B discloses a load balancing method, system, device, and computer-readable storage medium applied to load balancing scenarios. The method involves: acquiring target data to be allocated; determining overloaded and unloaded computing engines in a multi-core device at the current moment; selecting a computing engine among the unloaded computing engines that has not been allocated data as the target computing engine at the current moment; allocating the target data to the target computing engine at the current moment; marking overloaded computing engines among the unloaded computing engines as overloaded computing engines; and marking unloaded computing engines among the overloaded computing engines as unloaded computing engines. This patent avoids the load imbalance among multiple computing engines caused by re-allocating target data to overloaded computing engines. Furthermore, it allows for timely updates to the overload and unloaded states of computing engines, facilitating accurate data allocation based on these states in the next moment, thus enabling load balancing.

[0004] Existing technologies typically employ a static resource allocation architecture that separates the data plane from the control plane. This means that during device initialization, a portion of CPU cores are pre-allocated to each security detection engine, while the remaining cores are dedicated to the control plane for task management. During device operation, threshold alarms are triggered based on key metrics such as CPU utilization, memory usage, concurrent sessions, and overall system traffic. When any metric exceeds a preset limit, an alarm is activated to notify maintenance personnel for intervention. This approach can maintain basic operational status under stable traffic conditions.

[0005] However, the control model based on static allocation and threshold alarms has a fundamental scheduling blind spot within the time window when traffic characteristics change abruptly. Take the video private network access scenario in the transportation industry as an example: when a large-scale port scanning attack suddenly launches, the packet detection rate of the intrusion prevention engine (IPE) spikes dramatically within seconds, while the core resources statically allocated to the IPE have reached their processing limit. Packet queuing depth continues to accumulate, and compliant packets are discarded in large quantities before alarms are triggered and manual intervention or rule switching is completed. Simultaneously, the core resources allocated to the VPN encryption / decryption engine and traffic control engine are under low load, their computing resources idle and unable to be dynamically replenished to the IPE. This fundamental contradiction lies in the fact that the static allocation model can only passively respond to existing overload conditions, but cannot perform predictive resource pre-scheduling at the beginning of a steep load increase, resulting in unacceptable processing gaps in security detection at the most critical moments of traffic mutation. Summary of the Invention

[0006] This invention provides an adaptive control method for the operating status of a comprehensive application security gateway, in order to solve the technical problem of security detection blind spots caused by the inability of static resource allocation to predict traffic change trends in multi-engine concurrent processing scenarios.

[0007] This invention provides an adaptive control method for the operational state of a comprehensive application security gateway, comprising: S1 collects the message processing rate and queuing depth of the security detection engine at fixed intervals, and calibrates the baseline value of queuing depth, the lower limit of rate, and the basic value of horizontal smoothing coefficient in combination with the device's idle state. S2, input the message processing rate into the Holt double exponential smoothing algorithm, dynamically adjust the horizontal smoothing coefficient based on the prediction error and rate lower bound at the current moment to predict the message processing rate at the next moment, and calculate the backlog pressure compensation amount by combining the queuing depth and the queuing depth baseline value, and then superimpose to obtain the comprehensive load demand prediction value. S3 calculates the demand ratio of the security detection engine among all active engines based on the comprehensive load demand forecast. Under the premise of retaining the minimum number of core guarantees, it allocates the remaining cores to the security detection engine according to the demand ratio to perform core pre-scheduling. S4. In the next cycle, the actual message processing rate is collected, the actual message processing rate is compared with the comprehensive load demand forecast value to calculate the forecast deviation, and the base value of the horizontal smoothing coefficient is calibrated bidirectionally based on the sliding statistical characteristics of the forecast deviation.

[0008] Its effect is that by completing core redistribution at the beginning of the load increase trend, the pre-scheduling action fundamentally eliminates the processing gap between alarm triggering and manual intervention, so that the security detection engine has sufficient computing power support before the attack traffic reaches its peak, and eliminates the security detection blind window in the scenario of sudden traffic changes.

[0009] Furthermore, the packet processing rate and queuing depth of the security detection engine are collected at fixed intervals, and the baseline value of the queuing depth, the lower bound of the rate, and the base value of the horizontal smoothing coefficient are calibrated in the device's idle state. This includes: obtaining the packet processing rate differentially from the internal packet counter of the security detection engine, and obtaining the queuing depth from the difference between the head pointer and the tail pointer of the bound software queue; continuously collecting queuing depth samples for multiple periods in the device's idle state to calculate the mean, and using the mean as the baseline value of the queuing depth; extracting the minimum non-zero value of the packet processing rate among multiple sampling points in the device's idle state to finally obtain the lower bound of the rate; taking the sample mean of the ratio of the absolute value of the prediction error of each engine to the mean of the packet processing rate in the device's idle state as the steady-state disturbance reference; and the base value of the horizontal smoothing coefficient is the initial reference value for idle calibration.

[0010] Its effects are as follows: it clarifies the underlying hardware reading methods for message processing rate and queuing depth; it relies on idle steady-state samples to batch calibrate three core benchmark parameters: queue baseline, rate lower bound, and smoothing coefficient base value; it uses real steady-state data under no service load as the calculation benchmark, avoiding the problem of mismatch between manually preset parameters and actual equipment operating conditions, and providing a unified benchmark that fits the underlying hardware operating characteristics for subsequent load prediction, backlog compensation, and coefficient adaptive adjustment, ensuring that the calculated values ​​throughout the process have physical practical significance, and avoiding scheduling deviations in prediction and scheduling logic due to benchmark value distortion.

[0011] Furthermore, the message processing rate is input into the Holt double exponential smoothing algorithm, and the horizontal smoothing coefficient is dynamically adjusted based on the prediction error and the lower bound of the rate at the current moment to predict the message processing rate at the next moment, including: Calculate the average message processing rate within the current historical window. If the average rate is less than the lower bound of the rate, replace the average rate with the lower bound of the rate. The prediction error is obtained by subtracting the predicted value corresponding to the previous moment from the actual message processing rate. The absolute value of the prediction error is calculated as the ratio of the mean value of the message processing rate. The ratio is then subtracted from the steady-state disturbance reference calibrated under no-load conditions. The non-negative difference value is then added to the base value to obtain the horizontal smoothing coefficient. The smoothing level term is updated using the horizontal smoothing coefficient, and the smoothing trend term is updated using a fixed trend smoothing coefficient, ultimately yielding the message processing rate for the next time step.

[0012] Its effect is that by introducing an adaptive calculation method for the horizontal smoothing coefficient, the sensitivity is automatically increased to quickly track new data when the prediction error ratio exceeds the no-load steady-state disturbance reference. When the error falls back to the steady-state disturbance reference range, it returns to the basic value, avoiding the oscillation problem of repeated jumps due to small fluctuations near the threshold, and improving the smoothness and accuracy of the prediction.

[0013] Furthermore, the backlog pressure compensation is calculated by combining the queuing depth with the baseline value of the queuing depth, and then superimposed to obtain the comprehensive load demand forecast value, including: Determine if the enqueue depth exceeds the baseline value for enqueue depth; If it exceeds the limit, calculate the difference between the queuing depth and the baseline value of the queuing depth, and divide the difference by the sampling period to obtain the backlog pressure compensation amount; The backlog pressure compensation amount is added to the message processing rate at the next moment to obtain the final comprehensive load demand forecast.

[0014] Furthermore, based on the comprehensive load demand forecast, the demand ratio of the security detection engine among all active engines is calculated. While retaining the minimum core guarantee, the remaining cores are allocated to the security detection engine according to the demand ratio to perform core pre-scheduling, including: The overall load demand forecast of all activated engines is aggregated to calculate the total demand. The overall load demand forecast of the security detection engine is divided by the total demand to obtain the demand ratio. The remaining cores are obtained by subtracting the minimum core guarantee number for all activated engines from the total number of available cores on the data plane. Multiply the total number of remaining cores by the demand ratio and round down to obtain the number of dynamically scheduled cores for the engine. Add the minimum core guarantee number of the engine itself to each security detection engine to finally obtain the target number of cores allocated to the security detection engine for core pre-scheduling.

[0015] Its effect is that by dynamically allocating idle cores according to the predicted demand ratio, the redundant computing power of low-load engines can be transferred to high-load engines in real time, which significantly improves the core resource utilization efficiency in multi-engine concurrent scenarios and improves the balance of computing power utilization among multiple engines.

[0016] Furthermore, in the next cycle, the actual message processing rate is collected, and the actual message processing rate is compared with the overall load demand forecast to calculate the forecast deviation, including: At the end of the next sampling period, read the actual packet processing rate of the security detection engine; The prediction deviation is obtained by subtracting the overall load demand forecast from the actual message processing rate. The prediction bias is added to the prediction error sliding statistical window to finally obtain the error sequence containing historical prediction bias.

[0017] Furthermore, a two-way calibration is performed on the baseline value of the horizontal smoothing coefficient based on the sliding statistical characteristics of the prediction bias, including: The mean squared error of the error sequence is calculated as a moving statistical feature, and it is determined whether the absolute value of the prediction deviation exceeds twice the mean squared error. If it exceeds the limit, the step size is adjusted to increase the base value based on the ratio of the absolute value of the prediction deviation to the average current message processing rate. If the value is not exceeded, the base value is reduced by a fixed step size until it returns to the no-load calibration value, and finally the base value after bidirectional calibration is obtained.

[0018] Its effect is that the bidirectional calibration design enables the system to automatically recover to steady-state sensitivity after the attack ends, avoiding excessive scheduling response caused by unidirectional parameter drift after long-term operation, and enhancing the continuous stability of security protection in complex attack and defense scenarios.

[0019] Furthermore, the packet processing rate and queuing depth of the security detection engine are collected at fixed intervals, including: The fixed period is determined based on the gateway message forwarding clock cycle; Construct a sliding history window to continuously store the status data of multiple sampling points; The length of the sliding history window is ultimately determined by the number of samples required for the message processing rate of the device to naturally oscillate from a trough to a peak under no-load calibration conditions.

[0020] Furthermore, the final target number of cores allocated to the security detection engine for core pre-scheduling is obtained, including: By leveraging the CPU affinity interface of the operating system, the core set corresponding to the target number of cores is obtained; Following the locality principle of non-uniform memory access architecture, local cores that reside on the same node as the security detection engine are selected; The processing thread of the security detection engine is bound to the local core, eventually achieving a pre-scheduled running state.

[0021] Further, the calculation of the upward adjustment step size to increase the base value includes: determining whether the ratio of the absolute value of the prediction deviation to the average message processing rate at the next time step is greater than the base value; if it is greater, subtracting the base value from the ratio to obtain the upward adjustment step size; and adding the base value and the upward adjustment step size to finally obtain the increased base value.

[0022] The beneficial effects are as follows: This invention breaks through the limitations of traditional static resource allocation architecture. By introducing a feedforward pre-scheduling method, the system can accurately capture the load increase trend in the early stages of traffic surges and complete the dynamic reorganization of core resources in advance. This proactive defense solution effectively avoids the dropping of compliant packets due to resource bottlenecks, and significantly improves the gateway's throughput and protection reliability under extreme traffic impacts.

[0023] Furthermore, this method achieves adaptive calibration of prediction parameters without human intervention, with the dynamic adjustment of the base values ​​entirely based on the statistical characteristics of the engine's historical errors. This approach eliminates the need for pre-setting any manual experience parameters, making the solution directly applicable to different gateway models and deployment scenarios with significantly different traffic characteristics. This greatly reduces equipment maintenance costs and ensures the long-term stable operation of security gateways under repeated attack and defense scenarios. Attached Figure Description

[0024] Figure 1 This is a flowchart illustrating the adaptive control method for the operational status of a security gateway, which is comprehensively applied in an embodiment of the present invention.

[0025] Figure 2 This is a comparison chart of packet loss pressure index of intrusion prevention engine at different traffic stages in an embodiment of the present invention. Detailed Implementation

[0026] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] An embodiment of the adaptive control method for the operating state of the integrated application security gateway provided by the present invention: like Figure 1 As shown, the adaptive control method for the operational status of a comprehensive security gateway includes the following steps: S1 collects message processing rate and queuing depth and completes baseline calibration.

[0028] In an optional embodiment, the data plane of the security gateway includes several concurrently running security detection engines, denoted as... One engine is ,in , This represents the total number of currently active engines. The system operates at a fixed period. Three types of raw state variables are periodically collected for each engine. For example, The value is determined based on the gateway message forwarding clock cycle, and can be from 500ms to 1s.

[0029] The specific meanings and acquisition methods of the three types of primitive state variables are as follows. The first type is the current message processing rate of the engine. The unit is packets per second, obtained differentially from the internal message counters of each engine, directly reflecting the real-time processing load intensity of that engine within the current sampling period. The second category is engine queuing depth. The current backlog length of the message queue waiting to be processed by the engine is obtained from the difference between the head and tail pointers of the software queue bound to each engine. It is direct physical evidence of whether the load pressure has been translated into actual backlog. The third category is the CPU utilization rate of the engine's allocated cores. It is read from the per-core performance counter of the operating system kernel, reflecting the percentage of time that the current core is busy during the sampling period.

[0030] Furthermore, the system internally constructs a length of The sliding history window continuously stores a total of Status data of each sampling point. The value is based on the gateway model under no-load calibration conditions. The typical number of samples required for natural fluctuations to rise from troughs to peaks is determined, ultimately leading to the length of the sliding historical window, ensuring that the window covers a complete natural flow oscillation cycle. Simultaneously, the system records the idle calibration baseline parameters for each engine: queuing depth baseline value. Continuous data collection under no-load calibration conditions of the equipment Each cycle Sample mean; lower bound of rate Take the no-load calibration state sampling points The minimum non-zero value. Under no-load conditions, take the ratio of the absolute value of the prediction error of each engine to the average message processing rate. The sample mean is used as the steady-state disturbance benchmark. The base value of the horizontal smoothing coefficient Initial reference value for no-load calibration Since CPU utilization reflects the current core busyness and cannot predict the load trend in the next moment; and enqueue depth only increases after a backlog has occurred, both alone will cause scheduling lag. and Only by incorporating both the data collection sequence and the current situation can we simultaneously perceive what is happening and whether pressure has begun to accumulate, providing complete physical input for subsequent trend prediction.

[0031] By collecting three types of quantities at fixed intervals and maintaining a sliding historical window and an idle calibration baseline, the system obtains a sequence of engine historical states covering the entire fluctuation cycle. This provides a continuous and complete input data foundation on the time axis and complementary in terms of physical quantities for subsequent prediction steps, fundamentally supporting the trend judgment capability required for feedforward pre-scheduling.

[0032] S2 uses a smoothing algorithm and backlog compensation to calculate the predicted load demand.

[0033] In an optional embodiment, with engine message processing rate As the core input sequence for trend prediction, it is fed into the Holt double exponential smoothing algorithm to predict its value at the next sampling time. The basic formula for Holt double exponential smoothing is:

[0034]

[0035]

[0036] in To smooth the horizontal terms, To smooth the trend term, This is a predicted value for the message processing rate at the next moment. and This is the smoothing coefficient.

[0037] Next, regarding the original formula and The inherent drawback of using static constants preset by humans, which cannot adapt to the actual working conditions where the prediction error increases sharply when the traffic of the security gateway changes abruptly, is that the horizontal smoothing coefficient is used in this invention. Introducing an adaptive calculation formula:

[0038] in The prediction error at the current moment. This is a predicted value for the message processing rate at the previous time step. For the engine Within the current historical window The mean. When At that time, according to the data collection steps, the data was calibrated. Alternative As the denominator, calculate the ratio of the absolute value of the prediction error to the mean of the message processing rate. Subtract the steady-state disturbance reference value calibrated under no-load conditions from this ratio, take the non-negative difference, and add it to the base value to obtain the horizontal smoothing coefficient. Furthermore, regarding Apply upper bound constraints This prevents trend items from completely degenerating into single-point tracking. Determined by the equipment in typical attack traffic calibration tests: The prediction error should be taken as... The minimum value corresponding to the decrease to the initial deviation value within a preset number of convergence periods. This value reflects the minimum sensitivity upper limit required for prediction convergence under the most severe known flow shock, and has a repeatable physical source. For example, the preset number of convergence periods can be 2 sampling periods, and the preset convergence ratio can be 50%.

[0039] The adjustment logic of this adaptive calculation formula is as follows: when the prediction error is relative to the engine... When the proportion of its own average speed increases, it indicates that the engine is in a phase of rapid speed change. Automatic boosting allows the level term to track new data more quickly; when the error proportion falls back to the normal disturbance level... return This avoids oversensitivity to normal oscillations. Compared to the step switching at the threshold of hard gating, this adaptive calculation method provides a gradual transition when the error ratio is within the critical range, avoiding excessive sensitivity to normal oscillations. An oscillation problem in which the value repeatedly jumps due to tiny fluctuations near a threshold.

[0040] Trend smoothing coefficient In this scheme, the value remains fixed and is determined by the relative stability of the trend term under the no-load calibration state of the equipment: it is the ratio of the average change amplitude of the trend term in adjacent sampling periods during the no-load calibration period to the average absolute value of the trend term. The smoothing level term is updated using the horizontal smoothing coefficient, and the smoothing trend term is updated in combination with the fixed trend smoothing coefficient, finally obtaining the message processing rate at the next moment.

[0041] Then, for each engine, combine its current enqueue depth... The predicted values ​​are corrected for backlog pressure compensation. Judgment. Does it exceed the baseline value for the in-queue depth specified in the data acquisition steps? If the value exceeds the limit, the difference between the queuing depth and the baseline value is calculated, and the difference is divided by the sampling period to obtain the backlog pressure compensation amount. :

[0042] in The unit is a package. The unit is seconds. The unit is packets per second, representing the additional packet processing rate required to clear the existing backlog within the current sampling period. The backlog compensation is added to the packet processing rate at the next moment to obtain the final engine value. Comprehensive load demand forecast :

[0043] like ,but This means there is no backlog compensation. By introducing backlog pressure compensation, the overall load demand forecast is considered. It also includes rate trend prediction and the need to digest existing backlog, so that subsequent core allocation can not only cope with the upcoming traffic increase, but also not ignore the current backlog processing pressure.

[0044] By adaptively improving the horizontal smoothing coefficient and correcting the backlog pressure, each engine obtains a quantitative prediction of the overall load demand for the next cycle at the current sampling time. This provides a driving signal for feedforward pre-scheduling, which automatically corrects the accuracy according to the actual error level. This allows the core reallocation action to be driven in the early stages of traffic surges, rather than passively responding after the backlog has further amplified.

[0045] S3 allocates the remaining cores for pre-scheduling according to demand ratio.

[0046] In an optional embodiment, based on the combined load demand forecast of each engine. Core reallocation is completed before the end of the current sampling period and the start of the next period, achieving feedforward pre-scheduling. The scheduling action is completed as soon as the load surge signal first appears, compressing the safety detection blind window to a single sampling period. Within.

[0047] The total number of available cores in the data plane is denoted as First, a minimum number of core safeguards are reserved for each activation engine. To prevent any engine from being completely stripped of its processing power due to scheduling issues, the minimum core guarantee number for each active engine is subtracted from the total available cores on the data plane, resulting in the remaining core count. Allocate the remaining cores according to the proportion of predicted demand for each engine:

[0048] in, The floor sign is used for rounding down, and the denominator is used for rounding down. This involves summing the overall load demand forecasts of all activated engines to calculate the total demand. The overall load demand forecast for the security detection engine is then divided by this total demand to obtain the demand ratio. The total number of remaining cores is multiplied by the demand ratio and rounded down to obtain the number of dynamically scheduled cores for that engine. For each security detection engine, after allocating the number of dynamically scheduled cores according to the demand ratio, the minimum core guarantee number for that engine is added. Ultimately, the target number of cores allocated to the security detection engine is obtained. To execute core pre-schedule. The larger the value, the higher the predicted load of the engine, and the more remaining cores it will be allocated. A smaller value indicates a lower predicted load for the engine, resulting in fewer remaining cores allocated. This allows redundant computing power from low-load engines to high-load engines in real-time. If rounding causes the total number of allocated cores to be less than the predicted load, the result is incorrect. If a difference exists, the difference will be added to the current balance. The largest engine ensures the total number of cores remains constant.

[0049] Furthermore, core reallocation is executed via the operating system's CPU affinity interface to obtain the core set corresponding to the target number of cores. For gateway hardware with a non-uniform memory access architecture, the locality principle of the non-uniform memory access architecture is prioritized, selecting local cores located on the same node as the security detection engine to reduce cross-node memory access overhead. The processing threads of the security detection engine are then bound to the local cores, ultimately achieving a pre-scheduled running state.

[0050] By allocating feedforward cores proportionally to predicted demand and ensuring a minimum core guarantee, each engine holds core resources matching its predicted load before the next round of packets arrives. This allows for resource expansion as soon as load spikes appear, compressing the time window for compliant packets to be backed up and discarded due to insufficient cores to a single sampling period. Within.

[0051] S4 calculates the prediction bias and performs a two-way calibration on the baseline value.

[0052] In an optional embodiment, after core reallocation is completed, the actual packet processing rate of the security detection engine is read at the end of the next sampling period. Subtract the predicted overall load demand from the actual message processing rate. Compare the results and calculate the prediction deviation for this pre-scheduling:

[0053] The obtained prediction biases are then appended to the prediction error sliding statistical window to finally obtain an error sequence containing historical prediction biases. The system maintains a length of [length missing] for each engine. The prediction error sliding statistical window, The method for determining this is as follows: Take the minimum number of samples required to satisfy the statistical significance of the error sequence, specifically determined based on the measured statistical characteristics of the error sequence under no-load calibration conditions. For example, The value can be .

[0054] Next, at the end of each sampling period, the system determines the absolute value of the latest prediction deviation of each engine. Does it exceed twice the standard deviation? The coefficient 2 in the trigger threshold comes from the two-sided 95% confidence interval of the normal distribution. The probability that the absolute value of the error exceeds twice the root mean square error is less than 5% in steady state. This is used as the boundary for judging abnormal errors, without the need for any empirical constants to be given manually. It is entirely composed of engines The predictions are calculated based on the operational statistics of their historical prediction errors: accurate predictions under steady-state flow. Keeping the error small, the system remains sensitive to persistent small drifts; errors are amplified during sudden attacks. The system dynamically expands as the historical window scrolls, preventing the system from frequently undergoing invalid calibrations due to errors continuously exceeding the threshold during the attack period.

[0055] like This will trigger an engine attack. Recalibration of the predicted parameters. The recalibration direction depends on the sign of the error and the current... The relative relationship is divided into upward adjustment path and downward adjustment path. Upward adjustment path: Determine whether the ratio of the absolute value of the prediction deviation to the average message processing rate at the next time step is greater than the base value. If the ratio is greater than the baseline value, it indicates that the current baseline sensitivity is insufficient to cover the actual error level. In this case, the baseline value is subtracted from the ratio to calculate the adjustment step size. To increase the base value, specifically:

[0056] Add the base value to the upward adjustment step size to obtain the increased base value:

[0057] Downgrade path: If Not exceeding If the error has fallen back to within the normal statistical range, indicating that the current attack disturbance has subsided, then a fixed step size will be used. Reduce the base value until it returns to the no-load calibration value. Finally, the baseline value after bidirectional calibration is obtained:

[0058] Until Return to no-load calibration value It must not be lower than this value. Because... The bidirectional adjustment is based entirely on the statistical characteristics of the historical errors of each engine. Upward adjustment ensures that the sensitivity gradually increases during the duration of the attack traffic, while downward adjustment ensures that the sensitivity automatically drops after the attack subsides, eliminating the risk of long-term scheduling oscillations caused by unidirectional accumulation.

[0059] After recalibration, the calculation loop for the trend prediction step is restarted with the updated... It participates in the adaptive calculation of the next cycle. Through a continuous cycle of collecting state sequences, predicting trends, feedforward pre-scheduling, and backtesting calibration, the security gateway forms a complete adaptive control loop for multi-engine resource allocation, enabling resource scheduling actions to be completed as soon as the load change signal appears, rather than passively responding after the queue backlog has already affected message processing.

[0060] In this way, by implementing bidirectional adaptive calibration of the prediction parameters based on statistical confidence intervals, the system can maintain sufficient prediction sensitivity during the duration of attack traffic and automatically recover to the basic value after the attack subsides, without the need for manual pre-setting of any empirical parameters. This ensures the long-term balance between prediction accuracy and scheduling stability of the security gateway in repeated attack and defense scenarios.

[0061] like Figure 2 As shown, it can be observed that during the three key stages of attack rise, peak and fall, the packet loss pressure index of the existing method is significantly higher than that of the method of the present invention. The method of the present invention effectively reduces the risk of queue backlog and packet loss during the attack through predictive resource pre-scheduling. During the recovery and stabilization stage, the packet loss pressure index of the existing static scheduling method surges again, while the adaptive pre-scheduling method of the present invention still maintains a low packet loss pressure index.

[0062] The above are all preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Therefore, all equivalent changes made in accordance with the structure, shape and principle of the present invention should be covered within the scope of protection of the present invention.

Claims

1. A method for adaptive control of the operating state of a comprehensive security gateway, characterized in that, include: S1 collects the message processing rate and queuing depth of the security detection engine at fixed intervals, and calibrates the baseline value of queuing depth, the lower limit of rate, and the basic value of horizontal smoothing coefficient in combination with the device's idle state. S2, input the message processing rate into the Holt double exponential smoothing algorithm, dynamically adjust the horizontal smoothing coefficient based on the prediction error and rate lower bound at the current moment to predict the message processing rate at the next moment, and calculate the backlog pressure compensation amount by combining the queuing depth and the queuing depth baseline value, and then superimpose to obtain the comprehensive load demand prediction value. S3 calculates the demand ratio of the security detection engine among all active engines based on the comprehensive load demand forecast. Under the premise of retaining the minimum number of core guarantees, it allocates the remaining cores to the security detection engine according to the demand ratio to perform core pre-scheduling. S4. In the next cycle, the actual message processing rate is collected, the actual message processing rate is compared with the comprehensive load demand forecast value to calculate the forecast deviation, and the base value of the horizontal smoothing coefficient is calibrated bidirectionally based on the sliding statistical characteristics of the forecast deviation.

2. The adaptive control method for the operating state of the integrated application security gateway according to claim 1, characterized in that, The packet processing rate and queuing depth of the security detection engine are collected at fixed intervals. The baseline value of the queuing depth, the lower bound of the rate, and the base value of the horizontal smoothing coefficient are calibrated in conjunction with the device's idle state. This includes: obtaining the packet processing rate differentially from the internal packet counter of the security detection engine, and obtaining the queuing depth from the difference between the head and tail pointers of the bound software queue; continuously collecting queuing depth samples for multiple periods in the device's idle state to calculate the mean, and using the mean as the baseline value of the queuing depth; extracting the minimum non-zero value of the packet processing rate from multiple sampling points in the device's idle state to finally obtain the lower bound of the rate; taking the sample mean of the ratio of the absolute value of the prediction error of each engine to the mean of the packet processing rate in the device's idle state as the steady-state disturbance reference; and using the base value of the horizontal smoothing coefficient as the initial reference value for idle calibration.

3. The adaptive control method for the operating state of the integrated application security gateway according to claim 2, characterized in that, The message processing rate is input into the Holt double exponential smoothing algorithm. Based on the prediction error and the lower bound of the rate at the current moment, the horizontal smoothing coefficient is dynamically adjusted to predict the message processing rate at the next moment, including: Calculate the average message processing rate within the current historical window. If the average rate is less than the lower bound of the rate, replace the average rate with the lower bound of the rate. The prediction error is obtained by subtracting the predicted value corresponding to the previous moment from the actual message processing rate. The absolute value of the prediction error is calculated as the ratio of the mean value of the message processing rate. The ratio is then subtracted from the steady-state disturbance reference calibrated under no-load conditions. The non-negative difference value is then added to the base value to obtain the horizontal smoothing coefficient. The smoothing level term is updated using the horizontal smoothing coefficient, and the smoothing trend term is updated using a fixed trend smoothing coefficient, ultimately yielding the message processing rate for the next time step.

4. The adaptive control method for the operating state of the integrated application security gateway according to claim 1, characterized in that, The backlog pressure compensation is calculated by combining the queuing depth with the baseline queuing depth value, and then superimposed to obtain the comprehensive load demand forecast value, including: Determine if the enqueue depth exceeds the baseline value for enqueue depth; If it exceeds the limit, calculate the difference between the queuing depth and the baseline value of the queuing depth, and divide the difference by the sampling period to obtain the backlog pressure compensation amount; The backlog pressure compensation amount is added to the message processing rate at the next moment to obtain the final comprehensive load demand forecast.

5. The adaptive control method for the operating state of the integrated application security gateway according to claim 1, characterized in that, Based on the comprehensive load demand forecast, the demand ratio of the security detection engine among all active engines is calculated. While retaining the minimum core guarantee, the remaining cores are allocated to the security detection engine according to the demand ratio to perform core pre-scheduling, including: The overall load demand forecast of all activated engines is aggregated to calculate the total demand. The overall load demand forecast of the security detection engine is divided by the total demand to obtain the demand ratio. The remaining cores are obtained by subtracting the minimum core guarantee number for all activated engines from the total number of available cores on the data plane. Multiply the total number of remaining cores by the demand ratio and round down to obtain the number of dynamically scheduled cores for the engine. Add the minimum core guarantee number of the engine itself to each security detection engine to finally obtain the target number of cores allocated to the security detection engine for core pre-scheduling.

6. The adaptive control method for the operating state of the integrated application security gateway according to claim 1, characterized in that, In the next cycle, the actual message processing rate is collected, and the actual message processing rate is compared with the overall load demand forecast to calculate the forecast deviation, including: At the end of the next sampling period, read the actual packet processing rate of the security detection engine; The prediction deviation is obtained by subtracting the overall load demand forecast from the actual message processing rate. The prediction bias is added to the prediction error sliding statistical window to finally obtain the error sequence containing historical prediction bias.

7. The adaptive control method for the operating state of the integrated application security gateway according to claim 6, characterized in that, A two-way calibration of the baseline value of the horizontal smoothing coefficient is performed based on the sliding statistical characteristics of the prediction bias, including: The mean squared error of the error sequence is calculated as a moving statistical feature, and it is determined whether the absolute value of the prediction deviation exceeds twice the mean squared error. If it exceeds the limit, the step size is adjusted to increase the base value based on the ratio of the absolute value of the prediction deviation to the average current message processing rate. If the value is not exceeded, the base value is reduced by a fixed step size until it returns to the no-load calibration value, and finally the base value after bidirectional calibration is obtained.

8. The adaptive control method for the operating state of the integrated application security gateway according to claim 1, characterized in that, The packet processing rate and queuing depth of the security detection engine are collected at fixed intervals, including: The fixed period is determined based on the gateway message forwarding clock cycle; Construct a sliding history window to continuously store the status data of multiple sampling points; The length of the sliding history window is ultimately determined by the number of samples required for the message processing rate of the device to naturally oscillate from a trough to a peak under no-load calibration conditions.

9. The adaptive control method for the operating state of the integrated application security gateway according to claim 5, characterized in that, The final target number of cores allocated to the security detection engine for core pre-scheduling is obtained, including: By leveraging the CPU affinity interface of the operating system, the core set corresponding to the target number of cores is obtained; Following the locality principle of non-uniform memory access architecture, local cores that reside on the same node as the security detection engine are selected; The processing thread of the security detection engine is bound to the local core, eventually achieving a pre-scheduled running state.

10. The adaptive control method for the operating state of the integrated application security gateway according to claim 7, characterized in that, The calculation of the upward adjustment step size to increase the base value includes: determining whether the ratio of the absolute value of the prediction deviation to the average message processing rate at the next time step is greater than the base value; if it is greater, subtracting the base value from the ratio to obtain the upward adjustment step size; and adding the base value and the upward adjustment step size to finally obtain the increased base value.

Images