A method and system for defending against Sybil attacks in drone self-organizing networks

Abstract

The present invention relates to the field of drone technology, and specifically discloses a method and system for defending against Sybil attacks in a drone self-organizing network. The method comprises data collection and feature extraction, deep learning model training, Sybil attack detection, secure routing and network management, dynamic adjustment and feedback; the system comprises a routing module and a Sybil attack detection module. By introducing deep learning technology and a comprehensive security assessment mechanism, the method provides more intelligent, accurate and adaptive security protection for the drone self-organizing network, effectively improving the detection capability of Sybil attack behaviors and the overall security of the network, thereby solving the problem that nodes in the drone self-organizing network are vulnerable to Sybil attacks.

Description

Technical Field

[0001] The present invention relates to the technical field of unmanned aerial vehicles (UAVs), and more particularly, to a method and system for defending against Sybil attacks in a UAV self-organizing network. Background Art

[0002] A Sybil attack is defined as a malicious node illegally claiming to have multiple identities. This can disrupt the network's routing mechanism, data fusion mechanism, voting mechanism, and fair resource allocation. It often attacks the network directly. Malicious nodes use the Sybil node identity to steal data from the network and send false data to the network. Sybil attack nodes communicate directly with legitimate neighboring nodes. During indirect communication, Sybil nodes cannot directly communicate with legitimate nodes outside the communication radius. One or more intermediate nodes are required to transmit information to the legitimate nodes in a hop-by-hop manner. If Sybil nodes also exist among the intermediate nodes, the information leakage will be further expanded. The attacker obtains identity by forging false identities and stealing the real identities of legitimate nodes. Therefore, Sybil attacks can affect or even disrupt various operating mechanisms within the network, affecting the normal operation of the network and causing great harm to the network. In addition, Sybil attacks have multiple identities and are difficult to be detected by the network.

[0003] Flying Ad hoc Network (FANET) is a special type of Mobile Ad hoc Network (MANET) that enables different drone nodes in the network to spontaneously organize themselves without a central infrastructure. It uses open wireless channels and its routing management messages are transmitted in plain text. It does not verify the source of the message and the network members, and is unable to detect and remove malicious nodes in the network that do not comply with the routing protocol. Therefore, it is very vulnerable to attacks, especially Sybil attacks. Malicious nodes constantly change their IP addresses, forge their own identities, and send multiple control messages using different identities, which will cause the performance of the drone network to deteriorate or even paralyze the network.

[0004] Therefore, drone self-organizing networks urgently need methods and systems that can defend against Sybil attacks, set up scientific passive defense measures, use the characteristics of drone self-organizing networks to establish flexible and agile trust values, promptly detect malicious attacks from internal Sybil nodes and respond appropriately, and avoid internal Sybil nodes from continuously causing negative impacts on drone self-organizing networks. Summary of the Invention

[0005] In order to overcome the above-mentioned defects of the prior art, the present invention provides a method and system for defending against Sybil attacks in a drone self-organizing network, providing more intelligent, accurate and adaptive security protection for the drone self-organizing network, effectively improving the detection capability of Sybil attack behaviors and the overall security of the network, so as to at least solve one of the problems raised in the above-mentioned background technology.

[0006] To achieve the above objectives, according to one aspect of the present invention, a method for defending against Sybil attacks in a drone ad hoc network is provided, comprising:

[0007] Step S100, data collection and feature extraction: collect traffic feature data of each node in the UAV ad hoc network, including the number of data packets sent and received within the observation time window, the timestamps of data packet sending and receiving, the number of node communications, the number of node neighbor changes, and the number of node identity changes. Obtain node activity and node identity change frequency, and serialize the traffic feature data of each node.

[0008] Step S200, deep learning model training: using a long short-term memory network model to process serialized traffic feature data, and learn the behavioral differences between normal nodes and nodes performing Sybil attacks;

[0009] Step S300, Sybil attack detection: Use the trained long short-term memory network model to analyze the collected data, determine whether each node has participated in a Sybil attack, identify and mark nodes that use multiple identities to conduct malicious activities;

[0010] Step S400, secure routing and network management: Make decisions based on the information provided in step S300 to avoid routing data through marked malicious nodes, and regularly assess network security to adjust routing strategies and improve detection algorithms;

[0011] Step S500, dynamic adjustment and feedback: continuously adjust its detection strategy and routing decisions based on network conditions and Sybil attack detection results, collect feedback information during the detection process, and further train and optimize the long short-term memory network model;

[0012] UAV ad hoc networks exhibit unique characteristics when subjected to Sybil attacks, driven by their clustering and ad hoc network characteristics. Clustering is commonly used in UAV networks to improve network management and efficiency, while ad hoc networks are characterized by frequent changes in network topology and dynamic communication between nodes. In this environment, the specificity of Sybil attacks is reflected in dynamic topological changes, clustering behavior, and the diversity of communication patterns. UAV ad hoc networks often experience frequent topological changes due to the movement of drones, allowing Sybil attackers to exploit this dynamic nature and frequently switch their disguised identities to avoid detection. In clustered UAV networks, Sybil attackers attempt to control or influence one or more clusters, increasing their influence by masquerading as multiple nodes. This can severely impact routing protocols and resource allocation within the clusters. Due to the diverse mission types and communication patterns of drones, Sybil attackers can adapt their attack strategies to this diversity, launching attacks during data collection or distribution, causing even greater damage. Therefore, a security state assessment formula tailored to defending against Sybil attacks in UAV ad hoc networks is developed.

[0013] Specifically, in step S400, the evaluation formula for evaluating the security status in the network is:

[0014]

[0015] Where: S node The security score of the node, T node is the node trust obtained based on the long short-term memory network model analysis, A node is the activity of the node, F node is the frequency of node identity change, α, β, γ, and δ are weight coefficients, which are manually adjusted according to the network environment and security policy. node ) is the hyperbolic tangent function, used to smooth T node At extreme values, S node The growth effect of log(1+A node ) is the natural logarithm, which is used to emphasize the influence of node activity and avoid A node When the S node excessive punishment, Is the inverse of the exponential function, used to express the node The increase of F node To S node The negative impact will gradually decrease, but will not be completely eliminated. Is the square root function, used to increase the high F node Additional penalty for nodes.

[0016] By tanh(T node) smooths the trust level, which can flexibly adapt to the dynamic changes of network topology and maintain a stable trust evaluation even when the network structure changes frequently; A node It reflects the frequency and scope of node interactions in the network, can help identify Sybil attackers who attempt to control clusters or increase their influence in multiple clusters, and reflects clustering behavior; node This consideration allows the system to identify nodes that frequently change their identities, which is a typical behavior of a Sybil attack. and F node The combined use of α, β, γ, and δ can impose moderate penalties on behaviors that frequently change identities, thereby improving the ability to identify Sybil attacks. By adjusting the weight coefficients of α, β, γ, and δ, the influence of each factor can be fine-tuned according to the actual operating environment and security requirements of the UAV ad hoc network, thereby enhancing the ability to identify specific Sybil attack strategies.

[0017] Among them, T node The acquisition process includes the following steps:

[0018] Step Q1, data preparation: Obtain traffic characteristic data for each node in the UAV ad hoc network through the recorded data and work logs of the sensors and network monitoring software on the drone, including the number of packets sent and received, timestamps, number of communications, number of neighbor changes, and number of identity changes. Extract features that are important for node behavior from the collected data, convert the data into time series form, and perform normalization and standardization.

[0019] Step Q2, model training: Design a LSTM network architecture, including an input layer, one or more LSTM layers, and an output layer. The output layer uses a SoftMax layer for classification. Use the preprocessed time series data to train the LSTM model. The model learns the differences between normal nodes and Sybil attack nodes to identify and evaluate node behavior.

[0020] Step Q3, Feature Analysis and Trust Assessment: After training, real-time and historical node traffic feature data are input into the trained long-short-term memory network to identify node behavior patterns and potential Sybil attacks. The normal behavior output by the SoftMax classifier is directly used as the node's trustworthiness.

[0021] As a further solution of the present invention, in step S100, the formula for obtaining the node activity by observing the number of node communications and the number of changes in the node neighbors within the time window is:

[0022]

[0023] Where: C freq is the number of node communications within the observation time window, N changeis the number of node neighbor changes, λ and μ are the adjustment C freq and N change The weight coefficient of the importance of activity is set manually according to the network susceptibility and management strategy, and is calculated by the logarithmic function log(1+C freq ) reflects C freq To A node The impact of C freq For every unit increase in C freq The A node The improvement gradually decreases, showing a decreasing marginal effect, smoothing the extremely high C freq To A node The excessive impact of using Make sure that even N change The value is very large, which is node The impact of N change In A node The contribution of China's GDP is gradually increasing but at a decreasing rate.

[0024] As a further solution of the present invention, in step S100, the node identity change frequency is the number of times the node identity changes within the observation time window. The formula for the node identity change frequency is:

[0025]

[0026] Where: M change is the number of identity changes of the node in the observation time window, t obs The length of the observation time window.

[0027] As a further solution of the present invention, in step S100, the node communication activities recorded by each drone node are used to obtain the number and timestamps of sent and received data packets, capture and record network traffic information in real time, track the number of communications between nodes, data packet exchange information and the number of neighbor changes, and the observation time window is adaptively set according to the dynamics of the drone self-organizing network, the behavior pattern of the node, and the purpose of monitoring and detection.

[0028] As a further preferred solution of the present invention, the specific implementation process of step S200 includes:

[0029] Step 1, data preparation: Convert the traffic feature sequence of each node collected in step S100 into a time series format, normalize the data using the Min-Max normalization formula, and mark known normal nodes and nodes performing Sybil attacks separately;

[0030] Step 2: Deploy the LSTM network model: Match the serialized traffic feature data dimensions at the input layer, design appropriate hidden units in the LSTM network layer to capture long-term dependencies. The number of hidden units is set based on the traffic feature data dimensions of the UAV ad hoc network. Use the SoftMax classifier for binary classification at the output layer, and classify the prediction results into normal and Sybil attack scenarios. Set the model's learning rate, batch size, and number of iterations, and use the Adam optimizer.

[0031] Step 3: Model training, validation, and adjustment: Use labeled training data to perform supervised learning on the LSTM network model. Perform forward propagation on each batch of data, calculate the cross-entropy loss function, and then perform backpropagation to update the model parameters. Use the validation set to evaluate model performance. Based on the validation results, adjust the model's learning rate, batch size, and the number of hidden units in the LSTM network layer.

[0032] Step 4: Model testing and evaluation: After training is complete, the model is evaluated using an independent test set to confirm the model's ability to identify normal nodes and Sybil attack nodes.

[0033] As a further solution of the present invention, in step S300, a SoftMax classifier is used for judgment, wherein the initial threshold setting of the SoftMax classifier is adaptively set according to the security sensitivity and urgency of the UAV self-organizing network execution task. The initial threshold adaptive setting formula of the SoftMax classifier is:

[0034]

[0035] Where: K initial is the initial threshold of the SoftMax classifier, K base As the basic threshold, take 0.5, S sensitivity U is the sensitivity of the UAV to network security in the task performed by the UAV self-organizing network, and its value range is [0,1]. The closer it is to 1, the higher the sensitivity to network security. urgency is the urgency of the task, and its value range is [0,1]. The closer it is to 1, the more urgent the task is. is the adjustment factor used to determine the contribution of safety sensitivity and task urgency to the initial threshold, S sensitivity 、U urgency , σ and They are all set manually according to the specific circumstances of the UAV self-organizing network to perform tasks.

[0036] According to another aspect of the present invention, a system for defending against Sybil attacks in a drone self-organizing network is provided, which is used to implement the above-mentioned method for defending against Sybil attacks in a drone self-organizing network.

[0037] According to another aspect of the present invention, a UAV self-organizing network defense system for Sybil attacks is provided, comprising a routing module and a Sybil attack detection module, wherein the routing module comprises a data cache queue module, a traffic statistics module, a routing control module and a security assessment module, wherein:

[0038] The data cache queue module is connected to the traffic statistics module, and both the data cache queue module and the traffic statistics module are connected to the Sybil attack detection module. The traffic statistics module is connected to the routing control module and the security assessment module, and the security assessment module is connected to the routing control module and the Sybil attack detection module.

[0039] The data cache queue module is used to temporarily store incoming data packets and record data logs, process and forward data packets according to priority and routing policies, the traffic statistics module is used to analyze the data traffic passing through the node and record logs, monitor network conditions and traffic patterns, the routing control module is used to determine the routing path of the data packet based on traffic statistics and security assessment results, give priority to security and efficiency, and avoid passing data through nodes attacked by Sybil attacks, the security assessment module is used to receive the results of the Sybil attack detection module, evaluate the security of each node in the network, and adjust routing decisions based on the assessment results to isolate or restrict network access of malicious nodes.

[0040] According to another aspect of the present invention, there is provided a terminal comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method for defending against Sybil attacks in a drone self-organizing network as claimed in any one of claims 1 to 6 when executing the computer program.

[0041] According to another aspect of the present invention, a non-transitory computer-readable storage medium is provided, on which a computer program is stored, characterized in that when the computer program is executed by a processor, the method for defending against Sybil attacks in a drone self-organizing network as claimed in any one of claims 1 to 6 is implemented.

[0042] In general, the above technical solutions conceived by the present invention have the following beneficial effects compared with the prior art:

[0043] This application scheme collects network data of drone nodes in the self-organizing network, adopts a specifically set security assessment model, and comprehensively considers the trust, activity and identity change frequency of the nodes, integrates the Sybil detection results into the decision-making of the drone self-organizing network, and dynamically adjusts the routing strategy using the security score of the node to prevent the data flow from passing through unsafe nodes when the drone self-organizing network is attacked by a Sybil, which helps to improve the overall security and stability of the network and reduce the impact of Sybil attacks on network performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1This is a flow chart of a method for defending against Sybil attacks in a drone ad hoc network according to an embodiment of the present invention;

[0045] Figure 2 The figure is a schematic diagram of the composition of a UAV self-organizing network defense system for Sybil attacks according to an embodiment of the present invention. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and embodiments. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0047] like Figure 1 As shown, a method for defending against Sybil attacks in a drone self-organizing network according to an embodiment of the present application includes:

[0048] Step S100: data collection and feature extraction.

[0049] Collect traffic characteristic data of each node in the UAV self-organizing network, including the number of data packets sent and received within the observation time window, the timestamps of data packet sending and receiving, the number of node communications, the number of node neighbor changes, and the number of node identity changes. Obtain node activity and the frequency of node identity changes, and serialize the traffic characteristic data of each node.

[0050] Step S200: Perform deep learning model training.

[0051] Use the long short-term memory network model to process serialized traffic feature data and learn the behavioral differences between normal nodes and nodes performing Sybil attacks;

[0052] Step S300: Implement Sybil attack detection.

[0053] The collected data is analyzed using a trained long short-term memory network model. A SoftMax classifier is used to determine whether each node has participated in a Sybil attack. Nodes that use multiple identities for malicious activities are identified and marked.

[0054] Step S400: Perform secure routing and network management.

[0055] Make decisions based on the information provided in step S300 to avoid routing data through marked malicious nodes and regularly assess network security to adjust routing strategies and improve detection algorithms;

[0056] Step S500: dynamic adjustment and feedback.

[0057] Continuously adjust its detection strategy and routing decisions based on network conditions and Sybil attack detection results, collect feedback information during the detection process, and further train and optimize the long short-term memory network model;

[0058] As a preferred technical solution of the present invention, in step S400, the evaluation formula for evaluating the security status in the network is:

[0059]

[0060] Where: S node The security score of the node, T node is the node trust obtained based on the long short-term memory network model analysis, A node is the activity of the node, F node is the frequency of node identity change, α, β, γ, and δ are weight coefficients, which are manually adjusted according to the network environment and security policy. node ) is the hyperbolic tangent function, used to smooth T node At extreme values, S node The growth effect of log(1+A node ) is the natural logarithm, which is used to emphasize the influence of node activity and avoid A node When the S node excessive punishment, Is the inverse of the exponential function, used to express the node The increase of F node To S node The negative impact will gradually decrease, but will not be completely eliminated. Is the square root function, used to increase the high F node Additional penalty for nodes.

[0061] Among them, T node The acquisition process preferably includes the following steps:

[0062] Step Q1, data preparation: Obtain traffic characteristic data for each node in the UAV ad hoc network through the recorded data and work logs of the sensors and network monitoring software on the drone, including the number of packets sent and received, timestamps, number of communications, number of neighbor changes, and number of identity changes. Extract features that are important for node behavior from the collected data, convert the data into time series form, and perform normalization and standardization.

[0063] Step Q2, model training: Design a LSTM network architecture, including an input layer, one or more LSTM layers, and an output layer. The output layer uses a SoftMax layer for classification. Use the preprocessed time series data to train the LSTM model. The model learns the differences between normal nodes and Sybil attack nodes to identify and evaluate node behavior.

[0064] Step Q3, Feature Analysis and Trust Assessment: After training, real-time and historical node traffic feature data are input into the trained long-short-term memory network to identify node behavior patterns and potential Sybil attacks. The normal behavior output by the SoftMax classifier is directly used as the node's trustworthiness.

[0065] In this embodiment, the long short-term memory network can process and analyze time series data, and is particularly suitable for identifying and analyzing the dynamic behavior of nodes in drone ad hoc networks. It is particularly important for detecting witch attacks, because witch attacks often involve complex temporal behavior patterns, such as frequent changes in identity or behavior patterns. The advantage of the long short-term memory network is that it can learn long-term dependencies in data, identify behavior patterns and anomalies over long time spans, and enhance the ability to detect continuous or intermittent attack behaviors. By learning the differences between normal and witch attack behaviors, the long short-term memory network model can more accurately distinguish malicious nodes from normal nodes, reducing false positives and false negatives. The long short-term memory network can carefully analyze The behavioral characteristics of nodes are more sensitive to minor behavioral changes in nodes, which helps to promptly detect early signs of Sybil attacks; the LSTM model can also automatically adjust its parameters based on new data, adapt to changes in network behavior and attack strategies, and maintain the effectiveness and timeliness of the detection mechanism; through continuous learning and optimization (dynamic adjustment and feedback in step S500), the LSTM model can dynamically adjust its detection strategy based on the latest network status and security threats, achieving continuous improvement and optimization; combining the trust, node activity, and identity change frequency obtained through LSTM model analysis to construct a comprehensive security assessment formula, which can more comprehensively assess the security status of nodes and improve the accuracy and reliability of the assessment.

[0066] As a preferred technical solution of the present invention, in step S100, the formula for obtaining the node activity by observing the number of node communications and the number of node neighbor changes within the time window is:

[0067]

[0068] Where: C freq is the number of node communications within the observation time window, N change is the number of node neighbor changes, λ and μ are the adjustment C freq and N changeThe weight coefficient of the importance of activity is set manually according to the network susceptibility and management strategy, and is calculated by the logarithmic function log(1+C freq ) reflects C freq To A node The impact of C freq For every unit increase in C freq The A node The improvement gradually decreases, showing a decreasing marginal effect, smoothing the extremely high C freq To A node The excessive impact of using Make sure that even N change The value is very large, which is node The impact of N change In A node The contribution of China's GDP is gradually increasing but at a decreasing rate.

[0069] In the embodiment of this scheme, by combining the number of node communications and the number of neighbor changes, a more comprehensive and detailed description of the node can be achieved; a logarithmic function is used to ensure that even if the number of neighbor changes of a node is large, its impact on the activity can be moderately amplified, avoiding excessive neighbor changes directly leading to an abnormal increase in the activity score; the weight coefficient can be flexibly adjusted according to the specific situation and management strategy of the network to adjust the weight of the impact of the number of communications and the number of neighbor changes on the activity score, so that the activity score is more in line with the actual network conditions; this formula makes the activity calculation both sensitive and accurate, and can effectively identify nodes that may be involved in malicious activities (such as Sybil attacks). For Sybil attackers, they will increase their influence in the network through frequent communications and frequent changes in neighbor relationships. This activity calculation method helps to reveal such abnormal behavior.

[0070] As a preferred technical solution of the present invention, in step S100, the node identity change frequency is the number of times the node identity changes within the observation time window. The formula for the node identity change frequency is:

[0071]

[0072] Where: M change is the number of identity changes of the node in the observation time window, t obs The length of the observation time window.

[0073] In this embodiment, by dividing the number of identity changes by the time window, the frequency value obtained directly reflects the frequency of node identity changes. This is an intuitive and easy-to-understand measurement method. By dividing by the length of the observation time window, it can ensure that the calculation of the identity change frequency is comparable under different time window lengths, thereby standardizing the measurement of identity changes in the time dimension. In drone ad hoc networks, frequent identity changes are a sign of a Sybil attack. By calculating the identity change frequency, the dynamic behavior of the node can be effectively captured and evaluated, and possible malicious activities can be identified in a timely manner. The drone network is characterized by high dynamics, and the behavior and status of the node may change rapidly. The calculation of the identity change frequency can adapt to this dynamics and provide real-time data support for security assessment and risk analysis. Using the identity change frequency as an important indicator for security assessment helps to more accurately identify and evaluate security risks in the network, because frequent identity changes are often associated with network attacks or unstable states.

[0074] As a preferred technical solution of the present invention, in step S100, the node communication activities recorded by each drone node are used to obtain the number and timestamps of sent and received data packets, capture and record network traffic information in real time, track the number of communications between nodes, data packet exchange information and the number of neighbor changes, and the observation time window is adaptively set according to the dynamics of the drone self-organizing network, the behavior pattern of the node, and the purpose of monitoring and detection.

[0075] By capturing and recording network traffic information in real time, the real-time and accuracy of the data can be ensured, allowing the system to respond instantly to changes in network status. Recording the number of packets sent and received, as well as their timestamps, provides detailed analysis of communication patterns, helping to accurately understand the data flows and interactions between nodes in the network. Tracking the number of communications, packet exchange information, and neighbor changes helps monitor dynamic behavior and topology changes in the network, especially in highly dynamic drone ad hoc networks. The adaptive setting of the observation time window can be adjusted according to the dynamic nature of the network, the behavior patterns of nodes, and the monitoring and detection objectives, making data collection more consistent with actual network conditions. The adaptive setting of the observation time window provides flexibility and can optimize the data collection process according to the actual needs and goals of the network, whether in rapidly changing scenarios or those requiring long-term observation. The data collection strategy can be adjusted according to specific analysis and monitoring needs to better understand and respond to network behavior. Real-time data collection and dynamic behavior analysis help to detect abnormal behavior and potential security threats, such as Sybil attacks, at an early stage, so that defensive measures can be taken in a timely manner. Accurate and dynamic network traffic information supports more effective network management and optimization decisions, such as load balancing, resource allocation, and fault diagnosis.

[0076] As a preferred technical solution of the present invention, the specific implementation process of step S200 includes:

[0077] Step S210, data preparation: convert the traffic feature sequence of each node collected in step S100 into a time series format, normalize the data using the Min-Max normalization formula, and mark known normal nodes and nodes performing Sybil attacks separately;

[0078] Step S220: Deploy the long short-term memory network model: match the serialized traffic feature data dimensions at the input layer, design appropriate hidden units in the long short-term memory network layer to capture long-term dependencies. The number of hidden units is set according to the traffic feature data dimensions of the UAV ad hoc network. The output layer uses a SoftMax classifier for binary classification, and the prediction results are divided into normal and Sybil attack. Set the model's learning rate, batch size, and number of iterations, and use the Adam optimizer.

[0079] Step S230, model training, validation, and adjustment: Use labeled training data to perform supervised learning on the LSTM network model, perform forward propagation on each batch of data, calculate the cross-entropy loss function, and then perform backpropagation to update the model parameters. Use the validation set to evaluate the model performance, and adjust the model's learning rate, batch size, and the number of hidden units in the LSTM network layer based on the validation results.

[0080] Step S240, model testing and evaluation: After training is completed, the model is evaluated using an independent test set to confirm the model's ability to identify normal nodes and Sybil attack nodes.

[0081] In this embodiment, traffic features are serialized and normalized to ensure consistency and standardization of data input, which helps improve the efficiency and accuracy of model training. Normal nodes and nodes performing Sybil attacks are separately labeled to provide accurate training labels for supervised learning, thereby enhancing the accuracy of model learning. Serialized traffic feature data is matched in a long-short-term memory network, and an appropriate number of hidden units are designed based on the data characteristics, which can effectively capture long-term dependencies and improve the model's learning and prediction capabilities. Setting an appropriate learning rate, batch size, and number of iterations, and using advanced technologies such as the Adam optimizer, can optimize the training process, accelerate convergence, and improve model performance. Repeated forward and backpropagation, as well as the calculation and optimization of the cross-entropy loss function, ensure that the model can effectively learn to distinguish between normal and Sybil attack behaviors during training. Using a validation set to evaluate the model's performance and adjusting model parameters based on the evaluation results helps prevent overfitting or underfitting and ensures that the model has good generalization capabilities. After training, the model is evaluated using an independent test set to verify the model's ability to distinguish normal nodes from Sybil attack nodes, ensuring the model's practicality and accuracy.

[0082] As a preferred technical solution of the present invention, in step S300, the initial threshold setting of the SoftMax classifier is adaptively set according to the security sensitivity and task urgency of the UAV self-organizing network execution task. The initial threshold adaptive setting formula of the SoftMax classifier is:

[0083]

[0084] Where: K initial is the initial threshold of the SoftMax classifier, K base As the basic threshold, take 0.5, S sensitivity U is the sensitivity of the UAV to network security in the task performed by the UAV self-organizing network, and its value range is [0,1]. The closer it is to 1, the higher the sensitivity to network security. urgency is the urgency of the task, and its value range is [0,1]. The closer it is to 1, the more urgent the task is. is the adjustment factor used to determine the contribution of safety sensitivity and task urgency to the initial threshold, S sensitivity 、U urgency , σ and They are all set manually according to the specific circumstances of the UAV self-organizing network to perform tasks.

[0085] By adjusting the initial threshold based on security sensitivity and task urgency, the threshold setting can be made more flexible and adaptable, ensuring that good detection efficiency and accuracy can be maintained in different scenarios. The initial threshold setting takes into account the security sensitivity of the network and the urgency of the task, ensuring that urgent tasks are quickly handled while ensuring network security, and achieving a risk-aware decision-making balance. Adjusting the threshold based on the security requirements and urgency of the task can help improve the accuracy of Sybil attack detection and reduce false positives and missed positives, especially in high-risk or high-urgency tasks. By adjusting the threshold to reflect security sensitivity and task urgency, the response speed and efficiency of task execution can be optimized while ensuring network security. By adjusting σ and The introduction of two adjustment factors can customize the threshold settings according to the specific needs and characteristics of the drone self-organizing network and implement personalized security strategies.

[0086] The embodiments of the present application also disclose a UAV self-organizing network defense system for Sybil attacks, which includes a routing module and a Sybil attack detection module. The Sybil attack detection module organizes the collected node traffic features into time series traffic features, performs deep feature extraction through the LSTM module, and finally predicts the classification results through the SoftMax classifier to determine whether each node has suffered a Sybil attack, and returns the result to the routing module for security assessment.

[0087] The Long Short-Term Memory (LSTM) network module performs in-depth analysis of time-series traffic characteristics, effectively learning and identifying the complex patterns and differences between normal behavior and Sybil attack behavior, improving detection accuracy and sensitivity. The SoftMax classifier predicts and classifies node behavior in real time, enabling rapid identification and response to Sybil attack events, mitigating the damage caused by attacks. The detection module returns analysis results to the routing module, enabling routing decisions to be made based on real-time security assessments, dynamically avoiding nodes identified as malicious and enhancing network security and stability. The routing module adjusts network routing strategies based on detection results, optimizing network performance and resource allocation, and enabling adaptive management of network status and security threats. Through comprehensive monitoring and analysis of network traffic, the system comprehensively assesses the network's security status, promptly identifies and responds to various potential threats, and provides comprehensive network security protection. Detection algorithms and routing strategies are continuously optimized based on feedback from detection and routing decisions, achieving continuous security performance improvements. Intelligent routing decisions prevent data from passing through malicious or unstable nodes, reducing network congestion and communication latency, thereby improving network performance and user experience. The system's effective Sybil attack protection capabilities help maintain stable network operation and improve network reliability and availability.

[0088] As a preferred technical solution of the present invention, the routing module includes a data cache queue module, a traffic statistics module, a routing control module and a security assessment module. The data cache queue module is used to temporarily store incoming data packets and record data logs, process and forward data packets according to priority and routing policies, the traffic statistics module is used to analyze the data traffic passing through the node and record logs, monitor network conditions and traffic patterns, the routing control module is used to determine the routing path of the data packet based on the traffic statistics and security assessment results, give priority to security and efficiency, and avoid passing data through nodes attacked by witch attacks, the security assessment module is used to receive the results of the witch attack detection module, evaluate the security of each node in the network, and adjust the routing decision according to the evaluation results to isolate or restrict the network access of malicious nodes.

[0089] It should be noted that the data cache queue module is connected to the traffic statistics module, the data cache queue module and the traffic statistics module are both connected to the Sybil attack detection module, the traffic statistics module is connected to the routing control module and the security assessment module, and the security assessment module is connected to the routing control module and the Sybil attack detection module.

[0090] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A method for defending against Sybil attacks in a drone ad hoc network, comprising: S100 collects traffic characteristic data of each node in the UAV self-organizing network, obtains node activity and the frequency of node identity changes, and serializes the traffic characteristic data of each node, wherein the traffic characteristic data includes the number of data packets sent and received within the observation time window, the timestamps of data packet sending and receiving, the number of node communications and the number of node neighbor changes, and the number of node identity changes; S200 uses a long short-term memory network model to process serialized traffic feature data and learn the behavioral differences between normal nodes and nodes performing Sybil attacks; The S300 uses a trained long-short-term memory network model to analyze the collected data, determine whether each node has participated in a Sybil attack, and identify and mark nodes that use multiple identities to conduct malicious activities; S400 makes routing decisions based on the above judgment and identification results to avoid routing data through marked malicious nodes and regularly assesses network security to adjust routing strategies and improve detection algorithms. The S500 adjusts its detection strategy and routing decisions based on network conditions and Sybil attack detection results, collects feedback from the detection process, and further trains and optimizes the long-short-term memory network model; The network security status is assessed using the following model: Where, Score the node's security. is the node trust obtained based on the analysis of the long short-term memory network model, is the activity of the node, is the frequency of node identity change, 、 、 、 is the weight coefficient, is the hyperbolic tangent function, used for smoothing At extreme values The growth impact of is the natural logarithm, which is used to emphasize the impact of node activity and avoid Very low excessive punishment, Is the inverse of the exponential function, used to express the The increase, right The negative impact gradually decreased. is a square root function used to increase the Additional penalty for nodes.

2. A method for defending against Sybil attacks in a drone ad hoc network according to claim 1, wherein: By observing the number of node communications and the number of node neighbor changes within the time window, the node activity is obtained in the following way: Where, is the number of communication times of nodes in the observation time window, is the number of node neighbor changes, and To regulate and The weight coefficient of the importance of affecting activity.

3. A method for defending against Sybil attacks in a drone ad hoc network according to claim 1, wherein: The node identity change frequency is the number of times the node identity changes within the observation time window. The formula for the node identity change frequency is: Where, is the number of identity changes of the node in the observation time window, The length of the observation time window.

4. A method for defending against Sybil attacks in a drone ad hoc network according to claim 1, wherein: The node communication activities recorded by each drone node are used to obtain the number and timestamps of sent and received data packets, capture and record network traffic information in real time, and track the number of communications between nodes, data packet exchange information, and the number of neighbor changes.

5. A method for defending against Sybil attacks in a drone ad hoc network according to claim 2, wherein: The behavioral differences between learning normal nodes and nodes performing Sybil attacks specifically include: Convert the traffic feature sequence of each node into a time series format, normalize the data, and mark known normal nodes and nodes that perform Sybil attacks separately; The input layer matches the serialized traffic feature data dimensions, and the long short-term memory network layer designs appropriate hidden units to capture long-term dependencies. The number of hidden units is set based on the traffic feature data dimensions of the UAV ad hoc network. The output layer uses a SoftMax classifier for binary classification, and the prediction results are divided into normal and Sybil attack. Use labeled training data to perform supervised learning on the LSTM network model. Perform forward propagation on each batch of data, calculate the cross-entropy loss function, and then perform backpropagation to update the model parameters. Use the validation set to evaluate the model performance. Based on the validation results, adjust the model's learning rate, batch size, and the number of hidden units in the LSTM network layer. The model is evaluated using an independent test set to confirm its ability to identify normal nodes and Sybil attack nodes.

6. A method for defending against Sybil attacks in a drone ad hoc network according to claim 1, wherein: The judgment is implemented by a SoftMax classifier. The initial threshold setting of the SoftMax classifier is adaptively set according to the security sensitivity and urgency of the UAV self-organizing network execution task. The formula for the adaptive setting of the initial threshold is: Where, is the initial threshold of the SoftMax classifier, is the basic threshold, It is the sensitivity of the UAV to network security in the mission performed by the self-organizing network, and its value range is [0,1]. is the urgency of the task, and its value range is [0,1]. and is the regulating factor.

7. A UAV self-organizing network defense system for Sybil attack, used to implement the UAV self-organizing network defense method for Sybil attack as claimed in any one of claims 1 to 6, comprising a routing module and a Sybil attack detection module, characterized in that: The routing module includes a data cache queue module, a traffic statistics module, a routing control module and a security assessment module, wherein: The traffic statistics module is used to collect traffic characteristic data of each node in the UAV ad hoc network, analyze the data flow passing through the node and record the log, and monitor the network status and traffic pattern; The data cache queue module is used to temporarily store incoming data packets and record data logs, and process and forward data packets according to priority and routing policies; The Sybil attack detection module is used to organize the collected node traffic features into time series traffic features, perform deep feature extraction through the LSTM module, and finally predict the classification results through the SoftMax classifier to determine whether each node has suffered a Sybil attack, and return the result to the routing module; The security assessment module is used to receive the results of the Sybil attack detection module, assess the security of each node in the network, and adjust routing decisions based on the assessment results to isolate or restrict network access of malicious nodes; The routing control module is used to determine the routing path of the data packet based on traffic statistics and security assessment results to avoid the data passing through nodes that are attacked by Sybil.

8. A terminal comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method for defending against Sybil attacks in a drone self-organizing network as described in any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for defending against Sybil attacks in a drone self-organizing network as claimed in any one of claims 1 to 6 is implemented.

Images