US 12,003,528 B1 · Endogenous dynamic defense architecture-based multi-objective service function chain deployment method

Abstract

An endogenous dynamic defense architecture-based multi-objective service function chain deployment method solves a problem of multi-objective deployment by constructing an endogenous dynamic defense architecture, in which a basic mode includes using moving target defense to ensure the security of VNFs, and an enhanced mode includes using mimic defense to perform security protection on the VNFs; in a construction module, a sub-pool division algorithm is proposed to divide a heterogeneous replica pool into a plurality of sub-pools, and VNFs are selected from the sub-pools so as to constitute a heterogeneous replica set; in a scheduling module, a replica VNF dynamic scheduling deployment algorithm is proposed, a deployment set is selected from the heterogeneous replica set for deployment, and is sent to a processing module; the input module replicas an input and distributes same to the processing module.

An endogenous dynamic defense architecture-based multi-objective service function chain deployment method, comprising the following steps:

(1) constructing an endogenous dynamic defense architecture to solve a multi-objective service function chain (SFC) deployment problem, which comprises using a dynamic heterogeneous redundancy (DHR) architecture as a core architecture of mimic defense, wherein the endogenous dynamic defense architecture comprises a basic mode and an enhanced mode,
the basic mode comprises using moving target defense to guarantee the security of a virtualized network function (VNF), and shuffling the VNF, i.e. when the VNF is generated, dynamically changing an IP address, an execution code and a generation parameter, so that it is difficult for an attacker to perform prediction and attacks;
the enhanced mode comprises using mimic defense to perform security protection on a VNF, and using a dynamic heterogeneous redundancy architecture for a VNF vulnerable to attacks, so as to achieve the capability of active defense;
the multi-objective SFC deployment problem is described in detail as follows:
defining a vulnerability set as VN={vnz|z∈[1, |VN|]}, each VNF vulnerable to attacks containing α vulnerabilities;
and defining a heterogeneous replica VNF pool as FE={fe1|l∈[1, |FE|]}, each replica VNF also containing α vulnerabilities;
an objective function for the SFC deployment problem is as follows:
min
⁡
(
f
1
+
f
2
+
f
3
)
⁢
s
.
t
.
C
1
,
C
2
,
C
3
⁢
{
f
1
=
∑
r
μ
∈
R
D
μ
f
2
=
∑
r
μ
∈
R
⁢
1
❘
"\[LeftBracketingBar]"
A
μ
❘
"\[RightBracketingBar]"
⁢
∑
a
=
1
❘
"\[LeftBracketingBar]"
A
μ
❘
"\[RightBracketingBar]"
⁢
q
a
Q
f
3
=
C
⁢
(
τ
)
wherein C1, C2, and C3 represent a resource constraint, a bandwidth constraint, and a time delay constraint, respectively;
for f1, Dμ is a total response time delay with the expression as follows:
Dμ=Lμ+Pμ+Tμ+Wμ
where Lμ=Σehμ∈EμΣej∈ExehμejDej is a communication time delay,
P
μ
=
∑
f
v
μ
∈
F
μ
⁢
∑
n
i
∈
N
⁢
x
f
v
μ
n
i
·
1
η
m
i
μ
⁢
c
m
i
w
m
i
μ
-
λ
μ
+
ε
is a processing time delay,
T
μ
=
∑
f
v
μ
∈
F
μ
⁢
U
v
μ
is a transmission time delay, and
W
μ
=
∑
a
=
1
❘
"\[LeftBracketingBar]"
A
μ
❘
"\[RightBracketingBar]"
⁢
(
max
⁢
V
μ
K
f
ω
a
)
+
W
s
⁢
h
+
W
s
⁢
w
is an additional time delay brought by the dynamic defense architecture;
for
f
2
,
∑
r
μ
∈
R
⁢
1
❘
"\[LeftBracketingBar]"
A
μ
❘
"\[RightBracketingBar]"
⁢
∑
a
=
1
❘
"\[LeftBracketingBar]"
A
μ
❘
"\[RightBracketingBar]"
⁢
q
a
Q
is an average defense success rate, where q represents the number of defense successes, and Q represents the total number of attacks;
for f3, C(τ) represents total deployment costs with the expression as follows:
C(τ)=Coperational(τ)+Creplica(τ)
Coperational(τ) represents total operating costs, which is the sum of starting costs of a server and costs of successfully placing a VNF;
Coperational(T)=Σni∈NΣfvμ∈FμxfvμniζcCfvμ+Σej∈EΣehμ∈EμxehμejζBBμ+Σni∈NζO
xfvμni represents whether a VNF fvμ∈Fμ is deployed on a server node ni ∈N in a request rμ∈R, xehμej represents whether a virtual link ehμ∈Eμ is mapped onto a physical link ej ∈E in a request rμ∈R, ζc and ζB respectively represent the unit costs of resources and bandwidths, Cfvμ represents a resource requirement of the VNF fvμ∈Fμ, and ζO represents the starting costs of the server;
Creplica(τ)=Cpool(τ)+Cshuffling(τ)+Cswitching(τ) represents additional costs brought about by the endogenous dynamic defense architecture, where Cpool(τ)=Σf∈FE ζcCf represents costs of maintaining the heterogeneous replica VNF pool,
C
shuffling
(
τ
)
=
❘
"\[LeftBracketingBar]"
R
❘
"\[RightBracketingBar]"
x
⁢
C
s
⁢
h
represents costs of shuffling, and Cswitching(τ)=Σrμ∈R Csw (rμ) represents costs of switching;
(2) on the basis of the heterogeneity among replica VNFs, dividing the heterogeneous replica pool FE into different replica sub-pools according to common vulnerabilities, the specific division flow being as follows:
(21) selecting p VNFs with the maximum degree of heterogeneity with other replica VNFs as initial centers of the sub-pools;
(22) traversing the heterogeneous replica pool FE, calculating the degree of heterogeneity of a replica VNF i and the p centers of the sub-pools, and allocating i to the sub-pool with the minimum degree of heterogeneity with the replica VNF i;
(23) updating the centers of the sub-pools, setting the VNFs which have the minimum sum of the degree of heterogeneity of the remaining VNFs in each sub-pool as the centers of the sub-pools, and then repeating the operations of steps (22) and (23), and ending the operation until the centers of the sub-pools do not change or the maximum number of iterations is reached;
(3) on the basis of the degree of heterogeneity of the VNFs and a historical information table, respectively selecting suitable VNFs from the sub-pools to be deployed by means of a replica VNF dynamic scheduling deployment algorithm, the specific process being as follows:
(31) randomly selecting a VNF from a certain sub-pool and adding same to a heterogeneous replica set AE;
(32) sequentially traversing the VNFs in the remaining sub-pools, and if an enhanced mode-1 is adopted, selecting a replica with the maximum degree of heterogeneity with other VNFs in the AE and adding same to the AE;
if an enhanced mode-2 is adopted, selecting a replica with the maximum degree of heterogeneity with other VNFs in the AE and adding same into the AE in combination with the historical information table;
(33) traversing the heterogeneous replica set AE, and selecting a part of VNFs according to the degree of heterogeneity and adding same to a deployment set BE;
(34) if the basic mode is adopted, directly adding the original VNF to the deployment set BE;
(35) deploying the replica set BE by using a deep reinforcement learning (DRL)-based algorithm, and regularly shuffling the VNFs in the BE, wherein
the replica VNF dynamic scheduling deployment algorithm includes the following three modes:
1) the basic mode:
only using moving target defense (MTD), and only performing regular shuffling on the VNFs without adding extra replicas;
2) The enhanced mode-1:
using MTD and mimic defense to select a plurality of VNFs with equivalent functions according to the heterogeneity, and regularly shuffling the VNFs;
and
3) the enhanced mode-2:
using MTD and mimic defense, selecting a plurality of VNFs with equivalent functions according to the heterogeneity, performing dynamic switching according to historical information, and regularly shuffling the VNFs.

253 more elements

Endogenous dynamic defense architecture-based multi-objective service function chain deployment method

Life of this patent

Endogenous dynamic defense architecture-based multi-objective service function chain deployment method

Life of this patent

Abstract

Claims3