# US 12,003,528 B1 · Endogenous dynamic defense architecture-based multi-objective service function chain deployment method

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,003,528 B1
- Document ID: US12003528B1
- Status: Granted
- Kind: B1
- Application number: 18/581,424
- Filed: 2024-02-20
- Granted: 2024-06-04
- Earliest claimed: 2023-03-09
- Assignees: Nanjing University of Aeronautics and Astronautics
- Applicants: Nanjing University of Aeronautics and Astronautics
- Inventors: Ran Wang; Qiang Wu; Qi Zhu; Jie Hao; Xue Yu
- Web page: https://patentgrep.com/patent/US12003528B1

## CPC

- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- Y02D 30/50: in wire-line communication networks, e.g. low power modes or reduced link rate
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- Y02D: CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE

## Abstract

An endogenous dynamic defense architecture-based multi-objective service function chain deployment method solves a problem of multi-objective deployment by constructing an endogenous dynamic defense architecture, in which a basic mode includes using moving target defense to ensure the security of VNFs, and an enhanced mode includes using mimic defense to perform security protection on the VNFs; in a construction module, a sub-pool division algorithm is proposed to divide a heterogeneous replica pool into a plurality of sub-pools, and VNFs are selected from the sub-pools so as to constitute a heterogeneous replica set; in a scheduling module, a replica VNF dynamic scheduling deployment algorithm is proposed, a deployment set is selected from the heterogeneous replica set for deployment, and is sent to a processing module; the input module replicas an input and distributes same to the processing module.

## Claims

### Claim 1

An endogenous dynamic defense architecture-based multi-objective service function chain deployment method, comprising the following steps:
(1) constructing an endogenous dynamic defense architecture to solve a multi-objective service function chain (SFC) deployment problem, which comprises using a dynamic heterogeneous redundancy (DHR) architecture as a core architecture of mimic defense, wherein the endogenous dynamic defense architecture comprises a basic mode and an enhanced mode,
the basic mode comprises using moving target defense to guarantee the security of a virtualized network function (VNF), and shuffling the VNF, i.e. when the VNF is generated, dynamically changing an IP address, an execution code and a generation parameter, so that it is difficult for an attacker to perform prediction and attacks;
the enhanced mode comprises using mimic defense to perform security protection on a VNF, and using a dynamic heterogeneous redundancy architecture for a VNF vulnerable to attacks, so as to achieve the capability of active defense;
the multi-objective SFC deployment problem is described in detail as follows:
defining a vulnerability set as VN={vnz|z∈[1, |VN|]}, each VNF vulnerable to attacks containing α vulnerabilities; and defining a heterogeneous replica VNF pool as FE={fe1|l∈[1, |FE|]}, each replica VNF also containing α vulnerabilities;
an objective function for the SFC deployment problem is as follows:
min
⁡
(
f
1
+
f
2
+
f
3
)
⁢
s
.
t
.
C
1
,
C
2
,
C
3
⁢
{
f
1
=
∑
r
μ
∈
R
D
μ
f
2
=
∑
r
μ
∈
R
⁢
1
❘
"\[LeftBracketingBar]"
A
μ
❘
"\[RightBracketingBar]"
⁢
∑
a
=
1
❘
"\[LeftBracketingBar]"
A
μ
❘
"\[RightBracketingBar]"
⁢
q
a
Q
f
3
=
C
⁢
(
τ
)
wherein C1, C2, and C3 represent a resource constraint, a bandwidth constraint, and a time delay constraint, respectively;
for f1, Dμ is a total response time delay with the expression as follows:
Dμ=Lμ+Pμ+Tμ+Wμ
where Lμ=Σehμ∈EμΣej∈ExehμejDej is a communication time delay,
P
μ
=
∑
f
v
μ
∈
F
μ
⁢
∑
n
i
∈
N
⁢
x
f
v
μ
n
i
·
1
η
m
i
μ
⁢
c
m
i
w
m
i
μ
-
λ
μ
+
ε
is a processing time delay,
T
μ
=
∑
f
v
μ
∈
F
μ
⁢
U
v
μ
is a transmission time delay, and
W
μ
=
∑
a
=
1
❘
"\[LeftBracketingBar]"
A
μ
❘
"\[RightBracketingBar]"
⁢
(
max
⁢
V
μ
K
f
ω
a
)
+
W
s
⁢
h
+
W
s
⁢
w
is an additional time delay brought by the dynamic defense architecture;
for
f
2
,
∑
r
μ
∈
R
⁢
1
❘
"\[LeftBracketingBar]"
A
μ
❘
"\[RightBracketingBar]"
⁢
∑
a
=
1
❘
"\[LeftBracketingBar]"
A
μ
❘
"\[RightBracketingBar]"
⁢
q
a
Q
is an average defense success rate, where q represents the number of defense successes, and Q represents the total number of attacks;
for f3, C(τ) represents total deployment costs with the expression as follows:
C(τ)=Coperational(τ)+Creplica(τ)
Coperational(τ) represents total operating costs, which is the sum of starting costs of a server and costs of successfully placing a VNF;
Coperational(T)=Σni∈NΣfvμ∈FμxfvμniζcCfvμ+Σej∈EΣehμ∈EμxehμejζBBμ+Σni∈NζO
xfvμni represents whether a VNF fvμ∈Fμ is deployed on a server node ni ∈N in a request rμ∈R, xehμej represents whether a virtual link ehμ∈Eμ is mapped onto a physical link ej ∈E in a request rμ∈R, ζc and ζB respectively represent the unit costs of resources and bandwidths, Cfvμ represents a resource requirement of the VNF fvμ∈Fμ, and ζO represents the starting costs of the server;
Creplica(τ)=Cpool(τ)+Cshuffling(τ)+Cswitching(τ) represents additional costs brought about by the endogenous dynamic defense architecture, where Cpool(τ)=Σf∈FE ζcCf represents costs of maintaining the heterogeneous replica VNF pool,
C
shuffling
(
τ
)
=
❘
"\[LeftBracketingBar]"
R
❘
"\[RightBracketingBar]"
x
⁢
C
s
⁢
h
represents costs of shuffling, and Cswitching(τ)=Σrμ∈R Csw (rμ) represents costs of switching;
(2) on the basis of the heterogeneity among replica VNFs, dividing the heterogeneous replica pool FE into different replica sub-pools according to common vulnerabilities, the specific division flow being as follows:
(21) selecting p VNFs with the maximum degree of heterogeneity with other replica VNFs as initial centers of the sub-pools;
(22) traversing the heterogeneous replica pool FE, calculating the degree of heterogeneity of a replica VNF i and the p centers of the sub-pools, and allocating i to the sub-pool with the minimum degree of heterogeneity with the replica VNF i;
(23) updating the centers of the sub-pools, setting the VNFs which have the minimum sum of the degree of heterogeneity of the remaining VNFs in each sub-pool as the centers of the sub-pools, and then repeating the operations of steps (22) and (23), and ending the operation until the centers of the sub-pools do not change or the maximum number of iterations is reached;
(3) on the basis of the degree of heterogeneity of the VNFs and a historical information table, respectively selecting suitable VNFs from the sub-pools to be deployed by means of a replica VNF dynamic scheduling deployment algorithm, the specific process being as follows:
(31) randomly selecting a VNF from a certain sub-pool and adding same to a heterogeneous replica set AE;
(32) sequentially traversing the VNFs in the remaining sub-pools, and if an enhanced mode-1 is adopted, selecting a replica with the maximum degree of heterogeneity with other VNFs in the AE and adding same to the AE; if an enhanced mode-2 is adopted, selecting a replica with the maximum degree of heterogeneity with other VNFs in the AE and adding same into the AE in combination with the historical information table;
(33) traversing the heterogeneous replica set AE, and selecting a part of VNFs according to the degree of heterogeneity and adding same to a deployment set BE;
(34) if the basic mode is adopted, directly adding the original VNF to the deployment set BE;
(35) deploying the replica set BE by using a deep reinforcement learning (DRL)-based algorithm, and regularly shuffling the VNFs in the BE, wherein
the replica VNF dynamic scheduling deployment algorithm includes the following three modes:
1) the basic mode: only using moving target defense (MTD), and only performing regular shuffling on the VNFs without adding extra replicas;
2) The enhanced mode-1: using MTD and mimic defense to select a plurality of VNFs with equivalent functions according to the heterogeneity, and regularly shuffling the VNFs; and
3) the enhanced mode-2: using MTD and mimic defense, selecting a plurality of VNFs with equivalent functions according to the heterogeneity, performing dynamic switching according to historical information, and regularly shuffling the VNFs.

### Claim 2 (depends on 1)

The endogenous dynamic defense architecture-based multi-objective service function chain deployment method according to claim 1, wherein in step (1), for the enhanced mode, the DHR is used as the core architecture of mimic defense, which is composed of an input module, a processing module, an output module, a construction module and a scheduling module;
the input module is composed of a user input and a service scheduling agent, and after an SDA replicas the user input to obtain n user inputs so as to form n sub-inputs, the SDA distributes the n sub-inputs to the deployment set BE in the processing module;
the processing module is composed of the deployment set BE, and the replica VNFs in the deployment set process the n sub-inputs formed by the input module to form n sub-outputs, and then sends same to a mimic decision point for determination;
the output module is composed of a mimic decision point (MDP) and is used for determining n sub-outputs of the same input message, and if k or more than k results are consistent, then outputting the results, otherwise, stopping outputting;
the construction module comprises a heterogeneous replica pool FE and a heterogeneous replica set AE, divides the heterogeneous replica pool FE into p sub-pools according to a sub-pool division algorithm, and selects a replica from each sub-pool according to a scheduling algorithm, so as to form the heterogeneous replica set AE; and
the scheduling module selects n replicas from the heterogeneous replica set AE as the deployment set BE in the processing module according to the scheduling and deployment algorithm, and after a scheduling period, the scheduling module removes the BE, restores same to an initial state by shuffling, and reselects a deployment set for the next scheduling period according to the scheduling and deployment algorithm.

### Claim 3 (depends on 1)

The endogenous dynamic defense architecture-based multi-objective service function chain deployment method according to claim 1, wherein step (2) is performed to measure the heterogeneity between different replica VNFs by means of a Jaccard distance, the heterogeneity between a VNF fi and a VNF fj being expressed as follows:
Dist
⁡
(
α
i
,
α
j
)
=
1
-

α
i
+
α
j

❘
"\[LeftBracketingBar]"
α
i
+
α
j
❘
"\[RightBracketingBar]"
⁢
α
i
=
[
qvn
i
⁢
1
,
qvn
i
⁢
2
,
…
,
qvn
i
⁢
❘
"\[LeftBracketingBar]"
VN
❘
"\[RightBracketingBar]"
]
T
,
α
j
=
[
qvn
j
⁢
1
,
qvn
j
⁢
2
,
…
,
qvn
j
⁢
❘
"\[LeftBracketingBar]"
VN
❘
"\[RightBracketingBar]"
]
T
where αi and αj represent vulnerability vectors of the VNF fi and the VNF fj, when the VNF fi has a vulnerability vnz, qvnz=1, otherwise qvnz=0.