In traditional network environment, the attack topology of the network is usually obtained based on a graph traversal algorithm. It uses connection relationships to describe the process of the attack, thus completing the description of network security event. However, in the edge-cloud environment, the control logic and data forwarding of network devices are separated from each other. The control layer is responsible for the centralized management of network edge nodes. After acquiring the entire network topology, it can automatically generate a visualized network structure. This architecture extends traditional cloud computing architecture to the edge of the network, helping to handle some latency-sensitive service requirements, especially for most IoT applications. Therefore, security analysts can grasp the connection status of the devices on the entire network in the control domain. This network topology generation method based on the control layer information is directly and efficiently, which can greatly simplify the description of security events in the edge-cloud environment. At the same time, the separate structure also hides specific details of the underlying network device. Petri-net, as a formal description tool, can be used to describe such structure. Among existing security event description methods, the CORAS modeling tool has the advantages of graphical description, reusability and refinement description. And it also provides analysis guides to guide the operation steps. Based on the edge-cloud environment, this paper combines the advantages of CORAS modeling and analysis with Object-oriented Petri-net theory, and proposes a COP (CORAS-based Object-oriented Petri-net)-based Intelligent Applications security event description method. Experiments verify that this method is suitable for describing the complexity and dynamics of security events in edge cloud environment.

中文翻译：

---

边缘云环境中智能应用程序的安全事件描述

在传统的网络环境中，通常基于图遍历算法来获得网络的攻击拓扑。它使用连接关系来描述攻击的过程，从而完成对网络安全事件的描述。但是，在边缘云环境中，网络设备的控制逻辑和数据转发相互分离。控制层负责网络边缘节点的集中管理。获取完整的网络拓扑后，它可以自动生成可视化的网络结构。该架构将传统的云计算架构扩展到网络边缘，有助于处理一些对延迟敏感的服务要求，尤其是对于大多数物联网应用而言。因此，安全分析人员可以在控制域中掌握整个网络上设备的连接状态。这种基于控制层信息的网络拓扑生成方法是直接有效的，可以大大简化边缘云环境下安全事件的描述。同时，单独的结构还隐藏了底层网络设备的特定细节。Petri-net，作为正式的描述工具，可以用来描述这种结构。在现有的安全事件描述方法中，CORAS建模工具具有图形描述，可重用性和优化描述的优点。它还提供分析指南以指导操作步骤。基于边缘云环境，本文将CORAS建模和分析的优势与面向对象的Petri网理论相结合，提出了一种基于COP（基于CORAS的面向对象Petri网）的智能应用安全事件描述方法。实验证明，该方法适用于描述边缘云环境中安全事件的复杂性和动态性。