Distributed intrusion detection method and system for ad hoc network

Abstract

A distributed intrusion detection method and system for an ad hoc network. After the nodes in the ad hoc network are clustered, a cluster head node is selected, and a block chain system is configured on all the cluster head nodes to form a block chain network. The method includes: The node that updates the log sends a transaction request containing the local formatted log information record to its cluster head node; the cluster head node verifies that the transaction is legal and broadcasts the transaction in the blockchain network; each cluster head node consensus verifies the transaction, After passing, the transaction is packaged and recorded in the blockchain to form shared log data; each cluster head node performs intrusion detection in combination with local information and shared log data. Due to the consensus verification and recording of log information records, the authenticity and reliability of the detection data are guaranteed, and global and reliable shared information records and security audit data are provided for self-organized networks with no central weak trust to support global decision-making and response, making intrusion detection more accurate.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a distributed intrusion detection method and system for an ad hoc network. Background technique [0002] In recent years, ad hoc networks have developed rapidly. They have the characteristics of fast networking, easy deployment, and no dependence on fixed infrastructure. They have been widely used in military communications, mobile networks, and emergency services. Ad hoc networks such as wireless sensor networks and Internet of Vehicles. But with the rapid development of ad hoc networks, network security is becoming more and more important. Intrusion Detection System IDS (Intrusion Detection System) is the second line of defense to protect system security after the firewall. It collects and analyzes network logs and audit data to detect whether there are operations in violation of security policies and malicious attacks launched in the ad hoc network. Nodes, and notif...

AI Technical Summary

Problems solved by technology

Among them, the network-based intrusion detection system and the host-based intrusion detection system have relatively complex data types when the network scale is relatively large. and the ability to respond to intrusions

Therefore, distributed intrusion detection systems have been more widely studied and applied. However, most of the existing distributed intrusion detection methods are to set up detection components to collect information on each network node, and send the collected information to the central processing Nodes for analysis and processing, which rely on central processing nodes, limited processing and detection capabilities, and are not suitable for scenarios without central processing nodes

[0004] The invention patent with the application number of 200810041454.8 proposes a wireless self-organizing network intrusion detection method. This method implements intrusion detection by electing cluster heads as agents, which ensures the efficiency of intrusion detection and saves resources. However, this method assumes that The proxy node must be trustworthy, without considering the untrustworthy situation of the proxy node, there are certain security risks, and the information between the cluster heads cannot be shared globally

[0005] To sum up, the existing distributed intrusion detection methods do not consider the situation that untrustworthy nodes maliciously spread false report information to interfere with the intrusion detection system, resulting in wrong detection results, and lack the means of monitoring and auditing the collected information. In an ad-hoc network with weak trust in the center, the authenticity and reliability of detection data cannot be guaranteed, and global information cannot be shared, so the accuracy of intrusion detection is not high

Images