Attack detection method, device and system

Abstract

The embodiment of the present application provides an attack detection method, device and system, which can detect various security attacks in the RPL routing protocol and reduce the network transmission overhead in the attack detection process. In this method, the root node receives the first information, which is obtained by M monitoring nodes monitoring the DIO message of N business nodes, the N business nodes belong to the first DODAG, the M monitoring nodes belong to the second DODAG, the first DODAG is used for business transmission, the second DODAG is used to monitor the first DODAG, the root node is the root node of the first DODAG and the second DODAG, M and N are positive integers; then, the root node determines the malicious node among the N business nodes according to the first information.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to an attack detection method, device and system. Background Art

[0002] The routing protocol for low-power and lossy networks (RPL) based on Internet Protocol version 6 (IPv6) is the main routing protocol used in IPv6 over Low power wireless personal area network (6LoWPAN). The network topology established using the RPL routing protocol can be one or more destination oriented directed acyclic graphs (DODAGs), and each node in the network and the nodes and the external network communicate through DODAG. Exemplarily, the network topology established based on the RPL routing protocol can be as follows: Figure 1 shown.

[0003] In the process of establishing the network topology, one or more root nodes can be determined first. After the root node is working, it sends a DODAG information object (DIO) message to the surrounding nodes; other nodes in the network except the root node can select a parent node based on the DIO message and the objective function, and then calculate its own Rank value to send a DIO message to the surrounding nodes, and finally build a complete DODAG. In addition, after the non-DODAG root node selects a parent node, it can send a destination advertisement object (DAO) message to the DODAG root node through its parent node, so that the root node can know the topology of the entire DODAG.

[0004] However, the RPL routing protocol still has security issues. For example, malicious nodes carry false ranks in DIO messages to attract child nodes, affecting the DODAG topology, thereby affecting data transmission and increasing network transmission overhead; or malicious nodes update the destination announcement trigger sequence number (DAO trigger sequence number, DTSN) in the DIO message, triggering a large number of meaningless routing updates and increasing network transmission overhead. Summary of the invention

[0005] The embodiments of the present application provide an attack detection method, device and system, which can detect various attacks in the RPL routing protocol and reduce the network transmission overhead during the attack detection process.

[0006] To achieve the above objectives, the embodiments of the present application adopt the following technical solutions:

[0007] In the first aspect, an attack detection method is provided. In the method, a root node receives first information, which is obtained by M monitoring nodes monitoring DIO messages of N business nodes, the N business nodes belong to a first DODAG, the M monitoring nodes belong to a second DODAG, the first DODAG is used for business transmission, the second DODAG is used to monitor the first DODAG, the root node is the root node of the first DODAG and the second DODAG, M and N are positive integers; the root node determines the malicious node among the N business nodes according to the first information.

[0008] Based on this solution, the service node is monitored through the monitoring node, so that the monitoring node can obtain the DIO message of the service node. Since the DIO message includes information such as the Rank value or DTSN, the second information sent by the monitoring node to the root node can indicate the Rank value or DTSN of the service node, so that the root node can determine the malicious node that initiates the Rank attack or DTSN attack based on one or more second information, that is, the root node can detect the Rank attack or DTSN attack and perform corresponding processing. In summary, the solution of the present application can be used to detect a variety of attacks in RPL. In addition, the transmission overhead of the service network will not be increased during the attack detection process.

[0009] In some possible designs, the first information includes the Rank value of each service node in the N service nodes. Based on this possible design, the root node can obtain the Rank value of each service node, thereby detecting a Rank attack according to the Rank value.

[0010] In some possible designs, the root node determines a malicious node among N business nodes based on the first information, which may include: the root node determines one or more potential malicious nodes based on the first information, and the potential malicious node is a business node among the N business nodes whose Rank value is different from the reference Rank value; the root node determines the potential malicious node with the smallest Rank value among the one or more potential malicious nodes as a malicious node. Based on this possible design, since the malicious node can attract other nodes to select the malicious node as the parent node after launching a Rank attack, the Rank value of the business node that selects the malicious node as the parent node will not be greater than the Rank value of the malicious node, and thus, the potential malicious node with the smallest Rank value among the potential malicious nodes can be determined as a malicious node.

[0011] In some possible designs, the root node determines a malicious node among N service nodes based on the first information, including: when the Rank value of the first service node is less than or equal to the Rank value of the second service node, the root node determines the first node as a malicious node, the first service node is a service node among the N service nodes, and the second service node is the parent node of the first service node. Based on this possible design, when determining a malicious node, the root node does not need to calculate the Rank value of each service node, but only needs to perform a comparison operation, which can reduce the calculation complexity of the node.

[0012] In some possible designs, the first information includes the Rank value of one or more potential malicious nodes, and the potential malicious node is a service node among the N service nodes whose Rank value is different from the reference Rank value; the root node determines the malicious node among the N service nodes according to the first information, including: the root node determines the potential malicious node with the smallest Rank value among the one or more potential malicious nodes as a malicious node. Based on this possible design, the root node does not need to determine the potential malicious node, which can reduce the processing pressure of the root node.

[0013] In some possible designs, the first information includes the identification of one or more candidate malicious nodes, where the candidate malicious nodes are malicious nodes among the N service nodes determined by the monitoring node according to the Rank value of the service node or the topological relationship of the service node. Based on this possible design, the root node does not need to judge potential malicious nodes, candidate malicious nodes, etc., which can reduce the processing pressure and power consumption of the root node.

[0014] In some possible designs, the attack detection method may also include: the root node sends the reference Rank value of the service node belonging to the first DODAG within each monitoring range to each of the M monitoring nodes. Based on this possible design, the monitoring node can determine the potential malicious node or candidate malicious node according to the reference Rank value of the service node, thereby reducing the processing pressure of the root node.

[0015] In some possible designs, the attack detection method may also include: the root node sends the topological relationship of the service nodes belonging to the first DODAG within the respective monitoring range to each of the M monitoring nodes. Based on this possible design, the monitoring node can determine the candidate malicious node according to the topological relationship of the service node, thereby reducing the processing pressure of the root node.

[0016] In some possible designs, the first information includes an identifier of a third service node and a DTSN of the third service node, and the third service node is a service node among the N service nodes; the root node determines a malicious node among the N service nodes based on the first information, including: when the DTSN of the third service node is different from the latest DTSN determined by the root node, the root node determines the third service node as a malicious node. Based on this possible design, the root node can detect a DTSN attack or identify a malicious node.

[0017] In the second aspect, an attack detection method is provided. In the method, a monitoring node determines second information based on DIO messages of K service nodes, the second information is used to determine malicious nodes, the K service nodes are located within the monitoring range of the monitoring node, the K service nodes belong to the first DODAG, the monitoring node belongs to the second DODAG, the first DODAG is used for service transmission, the second DODAG is used to monitor the first DODAG, the root node of the first DODAG is the same as the root node of the second DODAG, K is a positive integer less than or equal to N, and N is the total number of service nodes included in the first DODAG; the monitoring node sends the second information to the root node.

[0018] Based on this solution, the service node is monitored through the monitoring node, so that the monitoring node can obtain the DIO message of the service node. Since the DIO message includes information such as the Rank value or DTSN, the second information sent by the monitoring node to the root node can indicate the Rank value or DTSN of the service node, so that the root node can determine the malicious node that initiates the Rank attack or DTSN attack based on one or more second information, that is, the root node can detect the Rank attack or DTSN attack and perform corresponding processing. In summary, the solution of the present application can be used to detect a variety of attacks in RPL. In addition, the transmission overhead of the service network will not be increased during the attack detection process.

[0019] In some possible designs, the second information includes the Rank value of each service node in the K service nodes. Based on this possible design, the root node can obtain the Rank value of the service node, thereby detecting a Rank attack based on the Rank value.

[0020] In some possible designs, the second information includes the Rank value of one or more potential malicious nodes, and the potential malicious node is a service node whose Rank value is different from the reference Rank value among the K service nodes. Based on this possible design, since the second information includes the Rank value of the potential malicious node, the root node does not need to determine the potential malicious node, which can reduce the processing pressure of the root node.

[0021] In some possible designs, the second information includes an identifier of a candidate malicious node, where the candidate malicious node is a malicious node among the K service nodes determined by the monitoring node. Based on this possible design, since the second information includes an identifier of the candidate malicious node, the root node does not need to determine the candidate malicious node, which can reduce the processing pressure of the root node.

[0022] In some possible designs, the attack detection method may also include: the monitoring node determines the potential malicious node with the smallest Rank value among one or more potential malicious nodes as a candidate malicious node, and the potential malicious node is a business node among K business nodes whose Rank value is different from the reference Rank value.

[0023] In some possible designs, the attack detection method may further include: the monitoring node receives a reference Rank value of each service node in the K service nodes from the root node. Based on this possible design, the monitoring node may determine a potential malicious node or a candidate malicious node according to the reference Rank value of the service node, thereby reducing the processing pressure of the root node.

[0024] In some possible designs, the attack detection method may also include: when the Rank value of the first business node is less than or equal to the Rank value of the second business node, the monitoring node determines the first business node as a candidate malicious node, the first business node is a business node among K business nodes, and the second business node is the parent node of the first business node.

[0025] In some possible designs, the attack detection method may further include: the monitoring node receives the topological relationship of the K service nodes from the root node. Based on this possible design, the monitoring node may determine the candidate malicious node according to the topological relationship of the service node, thereby reducing the processing pressure of the root node.

[0026] In some possible designs, the second information includes an identifier of a third service node and a DTSN of the third service node, the DTSN of the third service node is different from a preset DTSN, and the third service node is a service node among the K service nodes. Based on this possible design, the root node can detect a DTSN attack or identify a malicious node.

[0027] In a third aspect, a communication device is provided for implementing any one of the above-mentioned methods. In some implementations, the communication device may be the root node in the above-mentioned first aspect, or a device including the above-mentioned root node, or a device included in the above-mentioned root node, such as a chip; or, in some other implementations, the communication device may be the monitoring node in the above-mentioned second aspect, or a device including the above-mentioned monitoring node, or a device included in the above-mentioned monitoring node. The communication device includes a module, unit, or means corresponding to the implementation of the above-mentioned method, and the module, unit, or means may be implemented by hardware, software, or by executing the corresponding software implementation by hardware. The hardware or software includes one or more modules or units corresponding to the above-mentioned functions.

[0028] In a fourth aspect, a communication device is provided, comprising: a memory and at least one processor; the memory is used to store computer instructions, and when the processor executes the instructions, the communication device executes the method described in any of the above aspects. The communication device can be the root node in the above first aspect, or a device including the above root node, or a device included in the above root node, such as a chip; or, in some implementations, the communication device can be the monitoring node in the above second aspect, or a device including the above monitoring node, or a device included in the above monitoring node.

[0029] In a fifth aspect, a communication device is provided, comprising: an interface circuit and at least one processor, the interface circuit may be a code / data read / write interface circuit, the interface circuit is used to receive computer execution instructions (computer execution instructions are stored in a memory, may be read directly from the memory, or may pass through other devices) and transmit them to the processor; the processor is used to run the computer execution instructions to execute the method described in any of the above aspects. The communication device may be the root node in the above first aspect, or a device including the above root node, or a device included in the above root node, such as a chip; or, in some other implementations, the communication device may be the monitoring node in the above second aspect, or a device including the above monitoring node, or a device included in the above monitoring node.

[0030] In a sixth aspect, a communication device is provided, comprising: at least one processor; the processor is used to couple with a memory, and after reading instructions in the memory, execute the method as described in any of the above aspects according to the instructions. The communication device may be the root node in the above first aspect, or a device including the above root node, or a device included in the above root node, such as a chip; or, in some implementations, the communication device may be the monitoring node in the above second aspect, or a device including the above monitoring node, or a device included in the above monitoring node.

[0031] In a seventh aspect, a computer-readable storage medium is provided, in which instructions are stored, and when the instructions are executed on a communication device, the communication device can execute the method described in any of the above aspects. The communication device can be the root node in the above first aspect, or a device including the above root node, or a device included in the above root node, such as a chip; or, in some implementations, the communication device can be the monitoring node in the above second aspect, or a device including the above monitoring node, or a device included in the above monitoring node.

[0032] In an eighth aspect, a computer program product including instructions is provided, which, when executed on a communication device, enables the communication device to execute the method described in any one of the above aspects. The communication device may be the root node in the above first aspect, or a device including the above root node, or a device included in the above root node, such as a chip; or, in some other implementations, the communication device may be the monitoring node in the above second aspect, or a device including the above monitoring node, or a device included in the above monitoring node.

[0033] In a ninth aspect, a communication device is provided (for example, the communication device may be a chip or a chip system), the communication device including at least one processor for implementing the functions involved in any of the above aspects. In one possible design, the communication device also includes a memory for storing necessary program instructions and / or data. When the communication device is a chip system, it may be composed of a chip, or may include a chip and other discrete devices.

[0034] Among them, the technical effects brought about by any design method in the third to ninth aspects can refer to the technical effects brought about by different design methods in the above-mentioned first or second aspects, and will not be repeated here.

[0035] In a tenth aspect, a communication system is provided, which includes the root node described in the above aspect and the monitoring node described in the above aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A topological diagram of a DODAG provided in an embodiment of the present application;

[0037] Figure 2 A schematic diagram of the structure of a DIO message provided in an embodiment of the present application;

[0038] Figure 3 A schematic diagram of the structure of a DAO message provided in an embodiment of the present application;

[0039] Figure 4 A schematic diagram of the structure of a communication system provided in an embodiment of the present application;

[0040] Figure 5 A schematic diagram of the structure of another communication system provided in an embodiment of the present application;

[0041] Figure 6 A schematic diagram of the structure of a communication device provided in an embodiment of the present application;

[0042] Figure 7 A flowchart of an attack detection method provided in an embodiment of the present application;

[0043] Figure 8 A flowchart of another attack detection method provided in an embodiment of the present application;

[0044] Fig. 9 A flowchart of another attack detection method provided in an embodiment of the present application;

[0045] Fig.10 A schematic diagram of the structure of a root node provided in an embodiment of the present application;

[0046] Fig.11 A schematic diagram of the structure of a monitoring node provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to facilitate understanding of the technical solutions of the embodiments of the present application, a brief introduction to the related technologies of the present application is first given as follows.

[0048] First, the relevant elements in RPL:

[0049] 1. Network (NETWORK): A network consists of one or more RPL instances (RPLInstance), each RPLInstance is uniquely identified by RPLInstanceID.

[0050] 2. RPLInstance: An RPLInstance includes one or more DODAGs, each of which is identified by a DODAGID. Different DODAGs in the same RPLInstance have the same RPLInstanceID.

[0051] 3. DODAG: Each DODAG includes only one root node (root), and all nodes except the root node are nodes.

[0052] Second, DIO message, DAO message:

[0053] Nodes running the RPL routing protocol establish topology and routing by exchanging DIO messages, DAO messages, and DODAG information solicitation (DIO) messages.

[0054] The DIO message includes the node's own information. For example, its message structure is as follows: Figure 2 As shown in the figure, IP refers to the Internet Protocol (IP), and ICMP refers to the Internet Control Message Protocol (ICMP). The DIO field further includes the following fields:

[0055] RPLInstanceID: RPL instance identifier;

[0056] Version Number: version number;

[0057] Rank: The value of this field can be called the Rank value. The size of the Rank value indicates the distance between the node and the root node. The smaller the Rank value, the closer the node is to the root node, and the larger the Rank value, the farther the node is from the root node.

[0058] DTSN: Destination Notification Trigger Sequence Number. DTSN is determined by the root node when DODAG is initially constructed. Other nodes except the root node do not change DTSN, that is, the DTSN in the DIO message of each node is the same when DODAG is initially constructed. The root node can subsequently initiate a topology update by updating DTSN, that is, the update of DTSN is performed by the root node, and other nodes usually do not update DTSN.

[0059] Flags: flags;

[0060] Reserved: reserved;

[0061] DODAGID: DODAG identifier.

[0062] DAO messages can be used to establish downlink routes. For example, the message structure is as follows: Figure 3 For explanations of related fields, refer to Figure 2 The relevant description will not be repeated here.

[0063] Third, business nodes and monitoring nodes:

[0064] In the embodiment of the present application, a service node refers to a node in DODAG other than the root node that is used for service transmission; a monitoring node refers to a node in DODAG other than the root node that is used to monitor service nodes.

[0065] It is understandable that the monitoring node can be a service node, that is, the monitoring node can also be a service node.

[0066] Fourth, Rank attack and DTSN attack:

[0067] Rank attack: A malicious node can attract child nodes by tampering with their Rank values, causing the child nodes to update their parent nodes to change the original topology. Rank attacks can change the topology around malicious nodes, thereby affecting data packet delivery and increasing network transmission delay and transmission overhead.

[0068] DTSN attack: Malicious node A sends a DIO message to its child node B. When the DTSN carried in the DIO message changes (for example, increases) compared to the DTSN when the topology was initially constructed, it will trigger child node B to update the DAO message, and continue to trigger child node B to send a DIO message to child node C of child node B, and child node C will reply to the DAO message. Therefore, when the malicious node has many child nodes, the DTSN attack will cause a large number of meaningless routing updates, resulting in network transmission overhead.

[0069] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. Among them, in the description of the present application, unless otherwise specified, " / " indicates that the objects associated before and after are in an "or" relationship, for example, A / B can represent A or B; "and / or" in the present application is only a kind of association relationship describing the associated objects, indicating that there can be three relationships, for example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. And, in the description of the present application, unless otherwise specified, "multiple" refers to two or more than two. "At least one of the following" or its similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0070] In addition, in order to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, the words "first", "second" and the like are used to distinguish the same items or similar items with substantially the same functions and effects. Those skilled in the art will understand that the words "first", "second" and the like do not limit the quantity and execution order, and the words "first", "second" and the like do not necessarily limit the differences. At the same time, in the embodiments of the present application, the words "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or design solutions. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a concrete manner for easy understanding.

[0071] In addition, the network architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Ordinary technicians in this field can know that with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0072] The embodiment of the present application provides a communication system, which may be a 6LoWPAN network using RPL as a routing protocol. In a possible implementation, the communication system includes a root node, N service nodes, and M monitoring nodes, where N and M are positive integers.

[0073] The service nodes are different from the monitoring nodes, and the M monitoring nodes are used to monitor the N service nodes, or in other words, the N service nodes are located within the monitoring range of the M monitoring nodes.

[0074] Among them, the root node, service node, and monitoring node run the RPL routing protocol, N service nodes and the root node constitute the first DODAG, M monitoring nodes and the root node constitute the second DODAG, the first DODAG is used for service transmission, and the second DODAG is used to monitor the first DODAG.

[0075] Optionally, M is less than or equal to N, that is, the number of monitoring nodes is not greater than the number of service nodes.

[0076] For example, taking N as 8 and M as 2, Figure 4 As shown, a communication system 40 is provided in an embodiment of the present application, wherein node A is a root node, node B, node C, node D, node E, node F, node G, node H, and node I are service nodes, and node M1 and node M2 ​​are monitoring nodes.

[0077] For example, Figure 4As shown, the business nodes within the monitoring range of the monitoring node M1 are node B, node C, node E, and node F; the business nodes within the monitoring range of the monitoring node M2 ​​are node D, node G, node H, and node I.

[0078] In another possible implementation, the communication system includes a root node and N service nodes. Among the N service nodes, M service nodes serve as monitoring nodes. That is, among the N service nodes, M service nodes serve as both service nodes and monitoring nodes, N and M are positive integers, and M is less than or equal to N.

[0079] The M monitoring nodes are used to monitor the N service nodes. That is, among the N service nodes, M service nodes are used to transmit services and monitor themselves and other service nodes.

[0080] Among them, the root node, service node, and monitoring node run the RPL routing protocol. The N service nodes and the root node constitute the first DODAG, and the M monitoring nodes and the root node constitute the second DODAG. The first DODAG is used for service transmission, and the second DODAG is used to monitor the first DODAG. That is to say, among the N service nodes, M service nodes belong to both the first DODAG and the second DODAG.

[0081] For example, taking N as 8 and M as 2, Figure 5 As shown, another communication system 50 provided by an embodiment of the present application is shown, wherein node A is a root node, node B, node C, node D, node E, node F, node G, node H, and node I are service nodes, and node B and node D are monitoring nodes.

[0082] For example, Figure 5 As shown, the business nodes within the monitoring range of monitoring node B are node B, node C, node E, and node F; the business nodes within the monitoring range of monitoring node D are node D, node G, node H, and node I.

[0083] In an embodiment of the present application, the monitoring node determines the second information based on the DIO messages of the K business nodes within its monitoring range, and sends the second information to the root node, and the second information is used to determine the malicious nodes. The root node receives the second information (hereinafter collectively referred to as the first information) from one or more monitoring nodes, and determines the malicious nodes in the business nodes based on the first information. That is to say, the first information is obtained by M monitoring nodes monitoring the DIO messages of N business nodes, wherein the N business nodes belong to the first DODAG, the M monitoring nodes belong to the second DODAG, the first DODAG is used for business transmission, the second DODAG is used to monitor the first DODAG, and the root node is the root node of the first DODAG and the second DODAG, and M and N are positive integers.

[0084] It can be understood that in the embodiments of the present application, a "malicious node" refers to a service node that initiates a Rank attack and / or a DTSN attack.

[0085] It should be noted that in the embodiments of the present application, a "malicious node" may also be referred to as an "attack node" or an "attacker", which may be interchangeable, and the present application does not make any specific limitation on this.

[0086] Based on this solution, the service node is monitored through the monitoring node, so that the monitoring node can obtain the DIO message of the service node. Since the DIO message includes information such as the Rank value or DTSN, the second information sent by the monitoring node to the root node can indicate the Rank value or DTSN of the service node, so that the root node can determine the malicious node that initiates the Rank attack or DTSN attack based on one or more second information, that is, the root node can detect the Rank attack or DTSN attack and perform corresponding processing. In summary, the solution of the present application can be used to detect a variety of attacks in RPL. In addition, the transmission overhead of the service network will not be increased during the attack detection process.

[0087] Optionally, the root node, service node or monitoring node in the embodiment of the present application may also be referred to as a communication device, which may be a general device or a dedicated device, and the embodiment of the present application does not specifically limit this.

[0088] Exemplarily, the relevant functions of the root node, service node or monitoring node in the embodiment of the present application can be Figure 6 This is achieved by the communication device 60 in the embodiment. Figure 6 FIG. 6 is a schematic diagram of the structure of a communication device 60 provided in an embodiment of the present application. The communication device 60 includes one or more processors 601, a communication line 602, and at least one communication interface ( Figure 6 The example in which the communication interface 604 and a processor 601 are included is merely exemplary), and a memory 603 may also be included optionally.

[0089] The processor 601 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present application.

[0090] The communication line 602 may include a path for connecting different components.

[0091] The communication interface 604 may be a transceiver module for communicating with other devices or communication networks, such as Ethernet, RAN, wireless local area networks (WLAN), etc. For example, the transceiver module may be a device such as a transceiver or a transceiver. Optionally, the communication interface 604 may also be a transceiver circuit located in the processor 601 to implement signal input and signal output of the processor.

[0092] The memory 603 may be a device with a storage function. For example, it may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory may exist independently and be connected to the processor via a communication line 602. The memory may also be integrated with the processor.

[0093] The memory 603 is used to store computer-executable instructions for executing the solution of the present application, and the execution is controlled by the processor 601. The processor 601 is used to execute the computer-executable instructions stored in the memory 603, thereby realizing the attack detection method provided in the embodiment of the present application.

[0094] Alternatively, optionally, in an embodiment of the present application, the processor 601 may also perform processing-related functions in the attack detection method provided in the following embodiments of the present application, and the communication interface 604 is responsible for communicating with other devices or communication networks, which is not specifically limited in the embodiment of the present application.

[0095] Optionally, the computer-executable instructions in the embodiments of the present application may also be referred to as application code, which is not specifically limited in the embodiments of the present application.

[0096] In a specific implementation, as an embodiment, the processor 601 may include one or more CPUs, such as Figure 6 CPU0 and CPU1 in.

[0097] In a specific implementation, as an embodiment, the communication device 60 may include multiple processors, such as Figure 6 601 and processor 608 in the embodiment. Each of these processors may be a single-core processor or a multi-core processor. The processors here may include but are not limited to at least one of the following: a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), a microcontroller unit (MCU), or an artificial intelligence processor and other computing devices running software, each of which may include one or more cores for executing software instructions to perform calculations or processing.

[0098] In a specific implementation, as an embodiment, the communication device 60 may further include an output device 605 and an input device 606. The output device 605 communicates with the processor 601 and may display information in a variety of ways. For example, the output device 605 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector.

[0099] The input device 606 communicates with the processor 601 and can receive user input in various ways. For example, the input device 606 can be a mouse, a keyboard, a touch screen device, or a sensor device.

[0100] Combine the following Figures 1 to 6 , the attack detection method provided in the embodiment of the present application is described.

[0101] It is understandable that the actions, terms, etc. involved in the various embodiments of the present application can refer to each other without limitation. The message name or parameter name in the message exchanged between the various devices in the embodiments of the present application is only an example, and other names can also be used in the specific implementation without limitation.

[0102] In addition, in the embodiment of the present application, the root node or the monitoring node can perform some or all of the steps in the embodiment of the present application, and these steps or operations are only examples. The embodiment of the present application can also perform other operations or variations of various operations. In addition, each step can be performed in a different order presented in the embodiment of the present application, and it is possible not to perform all the operations in the embodiment of the present application.

[0103] It should be noted that the message names between the nodes or the names of the parameters in the messages in the following embodiments of the present application are only examples, and other names may be used in the specific implementation, and the embodiments of the present application do not specifically limit this.

[0104] The attack detection method provided in the embodiment of the present application first needs to establish a first DODAG and a second DODAG. The root node can send a first DIO message to establish a first DODAG for business transmission, and send a second DIO message to establish a second DODAG for monitoring the first DODAG.

[0105] The first DIO message may include<RPLInstanceID 1,DODAGID 1> ; The second DIO message may include<RPLInstanceID 1,DODAGID 2> That is, the first DODAG and the second DODAG may be different DODAGs in the same RPLInstance.

[0106] Optionally, the node used for service transmission can join the first DODAG as a service node according to the first DIO message until the first DODAG is constructed; the node used to monitor the service node can join the second DODAG as a monitoring node according to the second DIO message until the second DODAG is constructed.

[0107] It is understandable that the monitoring node can be a node different from the business node, or it can be a business node. In the case where the monitoring node is a business node, the business node as a monitoring node can join the first DODAG for business transmission according to the first DIO message, and can also join the second DODAG for monitoring other business nodes according to the second DIO message. In other words, in this case, there is no need to deploy additional monitoring nodes, which can reduce network complexity and overhead.

[0108] Optionally, the service node used as the monitoring node may be a service node with a higher security level (for example, supporting key encryption) that is trusted by the root node.

[0109] In the embodiment of the present application, an example is taken in which the finally constructed first DODAG includes N business nodes, and the second DODAG includes M monitoring nodes, that is, M monitoring nodes monitor N business nodes.

[0110] It should be noted that the following embodiments of the present application are described by taking the second DODAG including monitoring node 1 and monitoring node 2, that is, M is 2 as an example. It can be understood that the attack detection method provided in the embodiment of the present application is not limited to the scenario of two monitoring nodes. When there are more than two monitoring nodes, the attack detection method provided in the embodiment of the present application is still applicable.

[0111] like Figure 7 As shown, an attack detection method provided by an embodiment of the present application includes the following steps:

[0112] S701, monitoring node 1 obtains a DIO message of each service node among K service nodes. Monitoring node 2 obtains a DIO message of each service node among J service nodes.

[0113] Wherein, K is a positive integer less than or equal to N, and the K business nodes are located within the monitoring range of monitoring node 1; J is equal to NK, and the J business nodes are located within the monitoring range of monitoring node 2.

[0114] Optionally, in an embodiment of the present application, the business node is located within the monitoring range of the monitoring node, which can be understood as: the DIO message sent by the business node can be received by the monitoring node.

[0115] It can be understood that the monitoring node 1 may be one of the K service nodes; and the monitoring node 2 may be one of the J service nodes.

[0116] S702: Monitoring node 1 determines second information according to DIO messages of K service nodes, and monitoring node 2 determines second information according to DIO messages of J service nodes.

[0117] Optionally, the second information determined by the monitoring node 1 may include the Rank value of each service node in the K service nodes; the second information determined by the monitoring node 2 may include the Rank value of each service node in the J service nodes.

[0118] Optionally, after obtaining a DIO message from a certain service node, monitoring node 1 may first determine whether the RPLInsteanceID included in the DIO message is the same as the RPLInsteanceID of monitoring node 1. If so, the Rank value of the service node in the DIO message is determined as the parameter included in the second information; if not, the DIO message may be discarded, etc., and the embodiment of the present application does not make specific limitations on this. Alternatively, monitoring node 1 may not make a judgment, and after obtaining a DIO message from a certain service node, the Rank value of the service node in the DIO message is determined as the parameter included in the second information.

[0119] Among them, the processing method of monitoring node 2 after obtaining the DIO message of the business node can refer to monitoring node 1, which will not be repeated here.

[0120] S703: Monitoring node 1 and monitoring node 2 send second information to the root node respectively. Correspondingly, the root node receives the second information from monitoring node 1 and the second information from monitoring node 2.

[0121] In the embodiment of the present application, the second information of each monitoring node is collectively referred to as the first information. That is, for the root node, step S703 may also be: the root node receives the first information, which is obtained by the DIO messages of M monitoring nodes monitoring N service nodes.

[0122] It can be understood that since the second information sent by monitoring node 1 includes the Rank value of each business node among K business nodes, and the second information sent by monitoring node 2 includes the Rank value of each business node among J business nodes, it can be considered that the first information includes the Rank value of each business node among N business nodes.

[0123] Optionally, after obtaining the DIO message of a certain business node among the K business nodes, the monitoring node 1 may send the Rank value of the business node in the DIO message to the root node, that is, the monitoring node 1 sends the Rank value of each business node included in the second information to the root node respectively; or, after obtaining the DIO message of each business node among the K business nodes, the monitoring node 1 may send the Rank value of each business node to the root node, and the embodiment of the present application does not make any specific limitation on this.

[0124] Optionally, when the monitoring node 1 is one of the K service nodes, when the monitoring node 1 sends the second information to the root node, the first key may be used to encrypt and / or sign the second information to improve the security of the second information during transmission. After receiving the encrypted second information, the root node may perform signature verification and / or decryption according to the first key to obtain the second information.

[0125] Optionally, the first key may be negotiated between the root node and the monitoring node 1, or may be preset by the monitoring node and the root node at the factory, and this embodiment of the present application does not specifically limit this.

[0126] Optionally, the monitoring node 2 may also send the second information in the same manner as the monitoring node 1. Please refer to the relevant description of the monitoring node 1 sending the second information, which will not be repeated here.

[0127] S704: The root node determines a malicious node among the N service nodes according to the first information.

[0128] In different implementation scenarios of this application, the root node can determine the malicious node in the following two ways:

[0129] In a possible implementation, the root node determines a malicious node among the N service nodes according to the first information, which may include:

[0130] The root node determines one or more potential malicious nodes according to the first information, and determines the potential malicious node with the smallest Rank value among the one or more potential malicious nodes as the malicious node. The potential malicious node is a service node among the N service nodes whose Rank value is different from the reference Rank value.

[0131] Optionally, the reference Rank value of each of the N service nodes may be determined by the root node according to the network topology when the first DODAG is initially established.

[0132] Optionally, the root node may determine a business node whose Rank value is different from the reference Rank value as a potential malicious node by comparing the Rank value of the business node included in the first information with a reference Rank value of the business node, and then determine the potential malicious node with the smallest Rank value among the one or more potential malicious nodes as the malicious node.

[0133] For example, Figure 4 or Figure 5 Taking the system shown in the figure as an example, the reference Rank values ​​of each service node determined by the root node when the first DODAG is initially established can be as shown in Table 1.

[0134] Table 1

[0135] node Reference Rank value B 1 C 1 D 2 E 2 F 2 G 3 H 4 I 4

[0136] For example, based on Figure 4 or Figure 5In the system shown, taking monitoring node 1 as M1, monitoring node 2 as M2, and node G launching a Rank attack, that is, the Rank value in the DIO message sent by node G is 1 as an example, the Rank values ​​of each business node within its monitoring range reported by monitoring node 1 can be shown in Table 2, and the Rank values ​​of each business node within its monitoring range reported by monitoring node 2 can be shown in Figure 3.

[0137] It can be understood that the reason why the Rank values ​​of nodes H and I in Table 3 changed is that node G launched a Rank attack and broadcast a smaller Rank value through DIO messages, causing nodes H and I to change their Rank values ​​accordingly.

[0138] Table 2

[0139] node Rank value reported by monitoring node 1 B 1 C 1 E 2 F 2

[0140] Table 3

[0141] node Rank value reported by monitoring node 2 D 2 G 1 H 2 I 2

[0142] Based on the above example, the root node can compare the reference Rank value of each service node with the Rank value reported by the monitoring node to determine the potential malicious node. Exemplarily, the comparison result can be shown in Table 4 below:

[0143] Table 4

[0144]

[0145]

[0146] That is to say, the potential malicious nodes determined by the root node according to the first information are node G, node H, and node I, and among the three potential malicious nodes, the Rank value of potential malicious node G is the smallest. Therefore, the root node can determine that node G is a malicious node among the business nodes.

[0147] In another possible implementation, the root node determines a malicious node among the N service nodes according to the first information, which may include:

[0148] When the Rank value of the first service node is less than or equal to the Rank value of the second service node, the root node determines the first node as a malicious node, the first service node is a service node among the N service nodes, and the second service node is the parent node of the first service node.

[0149] Optionally, after receiving the first information, the root node may compare the Rank value of a certain business node with the Rank value of its parent node, and determine the node as a malicious node if the Rank value of the business node is less than or equal to the Rank value of its parent node.

[0150] In this way, the root node does not need to calculate the reference Rank value of each service node, but only needs to perform a simple comparison operation, thereby reducing the calculation complexity of the root node.

[0151] For example, based on Figure 4 or Figure 5 For the system shown, the comparison results can be shown in Table 5 below:

[0152] Table 5

[0153]

[0154] That is, the root node can determine, based on the first information, that the Rank value 1 of the service node G is less than the Rank value 2 of its parent node D. Therefore, the root node can determine that the service node G is a malicious node.

[0155] It is understandable that the parent node of node B and node C is root node A, and root node A can obtain its own Rank value and compare it with the Rank values ​​of node B and node C. Since the Rank value of the root node is usually 0, the root node can determine that node B or node C is not a malicious node.

[0156] At this point, the root node can identify malicious nodes in the service nodes.

[0157] Optionally, after the root node determines the malicious node, it can perform relevant processing, such as reducing the credibility of the malicious node, or adding it to a blacklist, etc., which is not specifically limited in the embodiments of the present application.

[0158] Based on this solution, the business node is monitored by the monitoring node, so that the monitoring node can obtain the DIO message of the business node. Since the DIO message includes the Rank value, the second information sent by the monitoring node to the root node can indicate the Rank value of the business node, so that the root node can determine the malicious node that initiates the Rank attack based on one or more second information, that is, the root node can detect the Rank attack or identify the malicious node.

[0159] In the above embodiment, the relevant processing and storage functions are all implemented by the root node. The following provides an attack detection method, in which part of the processing and storage functions are implemented by the monitoring node, such as Figure 8 As shown, the attack detection method includes the following steps:

[0160] S801, same as the above step S701, please refer to the above related instructions, and will not be repeated here.

[0161] S802: Monitoring node 1 determines second information according to DIO messages of K service nodes, and / or monitoring node 2 determines second information according to DIO messages of J service nodes.

[0162] In different implementation scenarios of the present application, the second information of the DIO message of the monitoring node according to the business node may also be different, and the following is explained using monitoring node 1 as an example.

[0163] In one possible implementation, the monitoring node 1 can determine whether there are potential malicious nodes among the K business nodes based on the DIO messages of the K business nodes. If so, the monitoring node 1 can continue to determine the second information based on the DIO messages of the K business nodes; if not, the monitoring node 1 can not determine the second information, or determine the third information and send the third information to the root node, and the third information can be used to indicate that there are no potential malicious nodes within the monitoring range of the monitoring node 1.

[0164] It can be understood that, for monitoring node 1, a potential malicious node refers to a service node whose Rank value is different from the reference Rank value among the K service nodes.

[0165] Optionally, after obtaining a DIO message of a certain service node, monitoring node 1 may compare the Rank value of the service node included in the DIO message with a reference Rank value of the service node, and determine a service node having a Rank value different from the reference Rank value as a potential malicious node.

[0166] Optionally, after the potential malicious node is determined, the second information can be provided in the following two forms:

[0167] Method 1: The second information includes Rank values ​​of one or more potential malicious nodes determined by monitoring node 1.

[0168] That is, the monitoring node 1 may determine the Rank value of the potential malicious node as a parameter in the second information.

[0169] Method 2: The second information includes an identifier of a candidate malicious node.

[0170] The candidate malicious node is a malicious node among the K service nodes determined by the monitoring node.

[0171] Optionally, in the second method, the attack detection method provided in the embodiment of the present application may also include: the monitoring node 1 determines the potential malicious node with the smallest Rank value among the one or more potential malicious nodes determined by it as a candidate malicious node.

[0172] Optionally, in this possible implementation, the reference Rank values ​​of the K service nodes may be sent by the root node to the monitoring node 1 .

[0173] That is, in this implementation, the attack detection method provided in the embodiment of the present application may also include: the root node sends the reference Rank value of the service node belonging to the first DODAG within the respective monitoring range to each of the M monitoring nodes. Correspondingly, each monitoring node receives the reference Rank value of the service node belonging to the first DODAG within its respective monitoring range. For monitoring node 1, it means that monitoring node 1 receives the reference Rank value of each service node among the K service nodes from the root node; for monitoring node 2, it means that monitoring node 2 receives the reference Rank value of each service node among the J service nodes from the root node.

[0174] For example, based on Figure 4 or Figure 5 In the system shown, taking monitoring node 1 as M2 and monitoring node 2 as M1 as an example, the reference Rank values ​​of K business nodes sent by the root node to monitoring node 1 can be as shown in Table 6, and the reference Rank values ​​of J business nodes sent to monitoring node 2 can be as shown in Table 7.

[0175] Table 6

[0176] node Reference Rank value D 2 G 3 H 4 I 4

[0177] Table 7

[0178] node Reference Rank value B 1 C 1 E 2 F 2

[0179] For example, based on Figure 4 or Figure 5 In the system shown, take the case where node G initiates a Rank attack, that is, the Rank value in the DIO message sent by node G is 1 as an example. The Rank values ​​of each business node within its monitoring range obtained by monitoring node 1 are shown in Table 8:

[0180] Table 8

[0181] node Monitor the Rank value obtained by node 1 D 2 G 1 H 2 I 2

[0182] Exemplarily, based on the above example, monitoring node 1 can compare the Rank values ​​of each service node it obtains with the reference Rank value to determine the potential malicious node. The comparison result can be shown in the following Table 9:

[0183] Table 9

[0184] node Reference Rank value Monitor the Rank value obtained by node 1 result D 2 2 Normal business node G 3 1 Potentially malicious nodes H 4 2 Potentially malicious nodes I 4 2 Potentially malicious nodes

[0185] That is to say, the potential malicious nodes determined by the monitoring node 1 are node G, node H, and node I. Therefore, if the second information is the above-mentioned method one, the second information determined by the monitoring node 1 includes the Rank value of node G, the Rank value of node H, and the Rank value of node I obtained by the monitoring node 1; if the second information is the above-mentioned method two, the second information determined by the monitoring node 1 may include the identification of node G.

[0186] It can be understood that the method for monitoring node 2 to determine the second information according to the DIO messages of J service nodes can refer to the method for monitoring node 1 to determine the second information according to the DIO messages of K service nodes, which will not be repeated here.

[0187] For example, based on Figure 4 or Figure 5 According to the above examples and methods, the monitoring node 2 compares the Rank value of each service node with the reference Rank value, and the comparison result can be shown in the following Table 10:

[0188] Table 10

[0189] node Reference Rank value Monitor the Rank value obtained by node 1 result B 1 1 Normal business node C 1 1 Normal business node E 2 2 Normal business node F 2 2 Normal business node

[0190] That is, the monitoring node 2 does not determine the second information, or determines the third information, where the third information indicates that there is no potential malicious node within the monitoring range of the monitoring node 2.

[0191] In another possible implementation, after the monitoring node 1 obtains the DIO message of the first service node, it can compare the Rank value of the first service node and the Rank value of the second service node included in the DIO message. When the Rank value of the first service node is less than or equal to the Rank value of the second service node, the monitoring node 1 determines the first service node as a candidate malicious node. The first service node is a service node among the K service nodes, and the second service node is the parent node of the first service node.

[0192] Accordingly, in this possible implementation, the monitoring node 1 determines that the second information may include an identifier of a candidate malicious node.

[0193] Optionally, in this possible implementation, the monitoring node 1 needs to obtain the topological relationship of K service nodes. The topological relationship of the K service nodes may be sent to the monitoring node 1 by the root node.

[0194] That is, the attack detection method provided in the embodiment of the present application may also include: the root node sends the topological relationship of the business nodes belonging to the first DODAG within its respective monitoring range to each of the M monitoring nodes. Correspondingly, each monitoring node receives the topological relationship of the business nodes belonging to the first DODAG within its respective monitoring range. For monitoring node 1, it means that monitoring node 1 receives the topological relationship of K business nodes from the root node; for monitoring node 2, it means that monitoring node 2 receives the topological relationship of J business nodes from the root node.

[0195] Optionally, in this possible implementation, if monitoring node 1 cannot obtain the Rank value of the parent node of a business node among the K business nodes, that is, the parent node of the business node is not within the monitoring range of monitoring node 1, monitoring node 1 can report the Rank value of the business node to the root node, and the root node compares the Rank value of the business node with the Rank value of its parent node to determine whether the business node is a malicious node.

[0196] For example, based on Figure 4 or Figure 5 In the system shown, taking monitoring node 1 as M2 and monitoring node 2 as M1 as an example, the topological relationship of the K business nodes sent by the root node to monitoring node 1 can be as shown in Table 11, and the topological relationship of the J business nodes sent to monitoring node 2 can be as shown in Table 12.

[0197] Table 11

[0198] node Parent Node D B G D H G I G

[0199] Table 12

[0200]

[0201]

[0202] For example, based on Figure 4 or Figure 5 In the system shown, taking the case where node G initiates a Rank attack, that is, the Rank value in the DIO message sent by node G is 1 as an example, the Rank values ​​of each service node and its parent node within its monitoring range obtained by monitoring node 1, and the comparison results can be shown in Table 13:

[0203] Table 13

[0204]

[0205] That is, monitoring node 1 can determine that the Rank value 1 of service node G is less than the Rank value 2 of its parent node D. Therefore, monitoring node 1 can determine that service node G is a candidate malicious node, and the second information includes the identifier of node G.

[0206] Optionally, since monitoring node 1 cannot obtain the Rank value of the parent node of node D (ie, node B), monitoring node 1 may report the Rank value of node D to the root node for determination.

[0207] It can be understood that the method for monitoring node 2 to determine the second information according to the DIO messages of J service nodes can refer to the method for monitoring node 1 to determine the second information according to the DIO messages of K service nodes, which will not be repeated here.

[0208] For example, based on Figure 4 or Figure 5 According to the above examples and methods, the system shown in FIG. 14 can be seen that the Rank values ​​of the service nodes and their parent nodes within the monitoring range obtained by the monitoring node 2, and the comparison results can be shown in Table 14:

[0209] Table 14

[0210]

[0211] That is to say, there is no situation in the monitoring range of monitoring node 2 where the Rank value of a certain service node is less than or equal to the Rank value of its parent node. In this case, monitoring node 2 may not determine the second information.

[0212] S803: Monitoring node 1 sends second information to the root node, and / or monitoring node 2 sends second information to the root node. Accordingly, the root node receives the second information from monitoring node 1 and / or the second information from monitoring node 2.

[0213] It can be understood that when monitoring node 1 sends the second information to the root node, the root node receives the second information from monitoring node 1; when monitoring node 2 sends the second information to the root node, the root node receives the second information from monitoring node 2.

[0214] For the description of how the monitoring node sends the second information, please refer to the above step S703, which will not be described again.

[0215] S804: The root node determines a malicious node among the N service nodes according to the first information.

[0216] It can be understood that, when multiple monitoring nodes report the second information, the first information includes the multiple second information; when only one monitoring node reports the second information, the first information is the same as the second information.

[0217] Optionally, when the second information reported by the monitoring node is different, the way in which the root node determines the malicious node among the N service nodes according to the first information may also be different.

[0218] In one possible implementation, when the second information includes the Rank values ​​of one or more potential malicious nodes, the first information also includes the Rank values ​​of one or more potential malicious nodes. At this time, the root node determines the malicious nodes among N business nodes based on the first information, which may include: the root node determines the potential malicious node with the smallest Rank value among the one or more potential malicious nodes as a malicious node.

[0219] In another possible implementation, when the second information includes the identifier of a candidate malicious node, the first information includes the identifier of one or more candidate malicious nodes. In this case, if the first information includes the identifier of a candidate malicious node, the root node can determine the one candidate malicious node as a malicious node; if the first information includes the identifiers of multiple candidate malicious nodes, the root node can continue to determine the malicious nodes based on the Rank values ​​or topological relationships of the multiple candidate malicious nodes, for example, determining the candidate malicious node with the smallest Rank value among the multiple candidate malicious nodes as a malicious node; or, if among the multiple candidate malicious nodes, the Rank value of the first candidate malicious node is less than or equal to the Rank value of the second candidate malicious node, the first candidate malicious node is determined as a malicious node, and the second candidate malicious node is the parent node of the first candidate malicious node.

[0220] At this point, the root node can identify malicious nodes in the service nodes.

[0221] Optionally, after the root node determines the malicious node, it can perform relevant processing, such as reducing the credibility of the malicious node, or adding it to a blacklist, etc., which is not specifically limited in the embodiments of the present application.

[0222] Based on this solution, the service node is monitored by the monitoring node, so that the monitoring node can obtain the DIO message of the service node. Since the DIO message includes the Rank value, the second information sent by the monitoring node to the root node can indicate the Rank value of the potential malicious node or the identification of the candidate malicious node, so that the root node can determine the malicious node that initiates the Rank attack based on one or more second information, that is, the root node can detect the Rank attack or identify the malicious node. In addition, in this embodiment, the judgment of the potential malicious node or the candidate malicious node by the monitoring node can reduce the processing pressure and power consumption of the root node.

[0223] The above embodiment introduces a method for detecting Rank attacks based on the communication system provided by the present application. The following describes a method for detecting DTSN attacks.

[0224] like Fig. 9 As shown, another attack detection method provided in an embodiment of the present application includes the following steps:

[0225] S901, same as the above step S701, please refer to the above related instructions, which will not be repeated here.

[0226] S902: Monitoring node 1 determines second information according to DIO messages of K service nodes, and / or monitoring node 2 determines second information according to DIO messages of J service nodes.

[0227] Optionally, after obtaining a DIO message of a service node, the monitoring node can determine whether the DTSN of the service node included in the DIO message is the same as the preset DTSN. If not, the monitoring node can determine that the second information includes the identifier of the service node and the DTSN of the service node.

[0228] Optionally, the preset DTSN is the DTSN in the first DIO message sent by the root node when the first DODAG is initially constructed.

[0229] That is, the second information includes the identifier of the third service node and the DTSN of the third service node, and the DTSN of the third service node is different from the preset DTSN. For the monitoring node, the third service node is a service node within its monitoring range.

[0230] Optionally, the second information may further include time information, where the time information is used to indicate the time when the monitoring node receives the DIO message from the third service node.

[0231] S903: Monitoring node 1 sends second information to the root node, and / or monitoring node 2 sends second information to the root node. Accordingly, the root node receives the second information from monitoring node 1 and / or the second information from monitoring node 2.

[0232] It can be understood that when monitoring node 1 sends the second information to the root node, the root node receives the second information from monitoring node 1; when monitoring node 2 sends the second information to the root node, the root node receives the second information from monitoring node 2.

[0233] For the description of how the monitoring node sends the second information, please refer to the above step S703, which will not be described again.

[0234] S904: The root node determines a malicious node among the N service nodes according to the first information.

[0235] It can be understood that, when multiple monitoring nodes report the second information, the first information includes the multiple second information; when only one monitoring node reports the second information, the first information includes the one second information.

[0236] Optionally, when the first information includes a second information, the first information includes a DTSN of a third service node and an identifier of the third service node. At this time, the root node determines a malicious node among N service nodes based on the first information, which may include: when the DTSN of the third service node is different from the latest DTSN determined by the root node, the root node determines the third service node as a malicious node.

[0237] Optionally, the latest DTSN determined by the root node may be the DTSN used by the root node when it last updated the topology of the first DODAG; or it may be the DTSN used when the first DODAG was initially constructed. In this case, it can be considered that the root node has not initiated a topology update.

[0238] Optionally, in the case where the first information includes multiple second information, the first information includes the identifiers of multiple third service nodes and the DTSN of each third service node. At this time, the root node determines the malicious node among the N service nodes based on the first information, which may include: the root node determines the third service node whose DTSN is different from the latest DTSN as a candidate malicious node, and then determines the candidate malicious node corresponding to the earliest received second information as a malicious node; or determines the candidate malicious node corresponding to a specific second information as a malicious node, and the specific second information is the second information with the earliest time indicated by the included time information.

[0239] At this point, the root node can identify malicious nodes in the service nodes.

[0240] Optionally, after the root node determines the malicious node, it can perform relevant processing, such as reducing the credibility of the malicious node, or adding it to a blacklist, etc., which is not specifically limited in the embodiments of the present application.

[0241] Based on this scheme, the business node is monitored by the monitoring node, so that the monitoring node can obtain the DIO message of the business node. Since the DIO message includes DTSN, the second information sent by the monitoring node to the root node can indicate the identifier and DTSN of the business node that is different from the preset DTSN, so that the root node can determine the malicious node that initiates the DTSN attack based on one or more second information, that is, the root node can detect the DTSN attack or identify the malicious node.

[0242] Among them, the above Figures 7 to 9 In the embodiment shown, the actions of the root node or monitoring node can be Figure 6 The processor 601 in the communication device 60 shown calls the application code stored in the memory 603 to instruct the root node or the monitoring node to execute, and this embodiment does not impose any limitation on this.

[0243] In the various embodiments of the present application, unless otherwise specified or provided for in any logical conflict, the terms and / or descriptions between the different embodiments are consistent and may be referenced to each other, and the technical features in the different embodiments may be combined to form new embodiments according to their inherent logical relationships.

[0244] It can be understood that in each of the above embodiments, the methods and / or steps implemented by each node may also be implemented by a component (such as a chip or a circuit) that can be used for the node.

[0245] The above mainly introduces the scheme provided by the embodiment of the present application from the perspective of interaction between each node. Accordingly, the embodiment of the present application also provides a communication device, which is used to implement the above various methods. The communication device can be the root node in the above method embodiment, or a device including the above root node, or a component that can be used for the root node; or, the communication device can be the monitoring node in the above method embodiment, or a device including the above monitoring node, or a component that can be used for the monitoring node. It can be understood that in order to implement the above functions, the communication device includes a hardware structure and / or software module corresponding to each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present application.

[0246] The embodiment of the present application can divide the functional modules of the communication device according to the above method embodiment. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0247] For example, take the communication device as the root node in the above method embodiment. Fig.10The schematic diagram of the structure of a root node 100 is shown. The root node 100 includes a first processing module 1001 and a first transceiver module 1002. The first transceiver module 1002, which may also be called a transceiver unit, is used to implement the sending and / or receiving functions, and may be, for example, a transceiver circuit, a transceiver, a transceiver or a communication interface.

[0248] Among them, the first transceiver module 1002 is used to receive the first information, which is obtained by M monitoring nodes monitoring the DIO messages of N business nodes, the N business nodes belong to the first DODAG, the N monitoring nodes belong to the second DODAG, the first DODAG is used for business transmission, and the second DODAG is used to monitor the first DODAG; the first processing module 1001 is used to determine the malicious nodes among the N business nodes according to the first information.

[0249] Optionally, the first processing module 1001 is used to determine a malicious node among N business nodes based on the first information, including: the first processing module 1001 is used to determine one or more potential malicious nodes based on the first information, and the potential malicious node is a business node among the N business nodes whose Rank value is different from the reference Rank value; the first processing module 1001 is also used to determine the potential malicious node with the smallest Rank value among the one or more potential malicious nodes as a malicious node.

[0250] Optionally, the first processing module 1001 is used to determine a malicious node among N business nodes based on the first information, including: the first processing module 1001 is used to determine the first node as a malicious node when the Rank value of the first business node is less than or equal to the Rank value of the second business node, the first business node is a business node among the N business nodes, and the second business node is the parent node of the first business node.

[0251] Optionally, the first processing module 1001 is used to determine a malicious node among N business nodes according to the first information, including: the first processing module 1001 is used to determine a potential malicious node with the smallest Rank value among one or more potential malicious nodes as a malicious node.

[0252] Optionally, the first transceiver module 1002 is further used to send the reference Rank value of the service node belonging to the first DODAG within the respective monitoring range to each of the M monitoring nodes.

[0253] Optionally, the first transceiver module 1002 is further used to send the topological relationship of the service nodes belonging to the first DODAG within the respective monitoring range to each of the M monitoring nodes.

[0254] Optionally, the first processing module 1001 is used to determine a malicious node among N service nodes based on the first information, including: the first processing module 1001 is used to determine the third service node as a malicious node when the DTSN of the third service node is different from the latest DTSN determined by the root node.

[0255] Among them, all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, and will not be repeated here.

[0256] Optionally, the root node 100 may also include a storage module ( Fig.10 ), which is used to store data and / or instructions. The first processing module 1001 can read the data or instructions in the storage module to implement the methods corresponding to the above embodiments.

[0257] It is understandable that the above-mentioned modules can be set up independently or integrated, and the embodiments of the present application are not limited to this.

[0258] In one possible manner, the root node 100 is presented in the form of various functional modules divided in an integrated manner. Here, the "module" may refer to a specific ASIC, a circuit, a processor and a memory that executes one or more software or firmware programs, an integrated logic circuit, and / or other devices that can provide the above functions. In a simple embodiment, those skilled in the art can imagine that the root node 100 can be used Figure 6 The form of the communication device 60 is shown.

[0259] for example, Figure 6 The processor 601 in the communication device 60 shown can call the computer execution instructions stored in the memory 603 to enable the communication device 60 to execute the attack detection method in the above method embodiment.

[0260] Specifically, Fig.10 The functions / implementation processes of the first processing module 1001 and the first transceiver module 1002 can be Figure 6 The processor 601 in the communication device 60 shown calls the computer execution instructions stored in the memory 603 to implement. Or, Fig.10 The function / implementation process of the first processing module 1001 in Figure 6 The processor 601 in the communication device 60 shown calls the computer execution instructions stored in the memory 603 to implement, Fig.10 The function / implementation process of the first transceiver module 1002 can be Figure 6 The communication interface 604 in the communication device 60 is shown to be implemented.

[0261] Since the root node 100 provided in this embodiment can execute the above-mentioned attack detection method, the technical effects that can be obtained can refer to the above-mentioned method embodiment, which will not be repeated here.

[0262] Or, for example, take the communication device as the monitoring node in the above method embodiment. Fig.11 The schematic diagram of the structure of a monitoring node 110 is shown. The monitoring node 110 includes a second processing module 1101 and a second transceiver module 1102. The second transceiver module 1102, which may also be called a transceiver unit, is used to implement the sending and / or receiving functions, and may be, for example, a transceiver circuit, a transceiver, a transceiver or a communication interface.

[0263] Among them, the second processing module 1101 is used to determine the second information according to the DIO messages of K business nodes, and the second information is used to determine the malicious node. The K business nodes are located in the monitoring range of the monitoring node 110, and the K business nodes belong to the first DODAG. The monitoring node 110 belongs to the second DODAG. The first DODAG is used for business transmission, and the second DODAG is used to monitor the first DODAG. The root node of the first DODAG and the root node of the second DODAG are the same. K is a positive integer less than or equal to N, and N is the total number of business nodes included in the first DODAG; the second transceiver module 1102 is used to send the second information to the root node.

[0264] Optionally, the second processing module 1101 is further used to determine the potential malicious node with the smallest Rank value among one or more potential malicious nodes as a candidate malicious node, and the potential malicious node is a business node among the K business nodes whose Rank value is different from the reference Rank value.

[0265] Optionally, the second transceiver module 1102 is further configured to receive a reference Rank value of each service node in the K service nodes from the root node.

[0266] Optionally, the second processing module 1101 is also used to determine the first business node as a candidate malicious node when the Rank value of the first business node is less than or equal to the Rank value of the second business node, and the first business node is a business node among K business nodes, and the second business node is the parent node of the first business node.

[0267] Optionally, the second transceiver module 1102 is used to receive the topological relationship of the K service nodes from the root node.

[0268] Among them, all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, and will not be repeated here.

[0269] Optionally, the monitoring node 110 may further include a storage module ( Fig.11 ), which is used to store data and / or instructions. The second processing module 1101 can read the data or instructions in the storage module to implement the methods corresponding to the above embodiments.

[0270] It is understandable that the above-mentioned modules can be set up independently or integrated, and the embodiments of the present application are not limited to this.

[0271] In one possible implementation, the monitoring node 110 is presented in the form of various functional modules divided in an integrated manner. The "module" here may refer to a specific ASIC, a circuit, a processor and a memory that executes one or more software or firmware programs, an integrated logic circuit, and / or other devices that can provide the above functions. In a simple embodiment, those skilled in the art can imagine that the monitoring node 110 can be implemented in the form of various functional modules divided in an integrated manner. Figure 6 The form of the communication device 60 is shown.

[0272] for example, Figure 6 The processor 601 in the communication device 60 shown can call the computer execution instructions stored in the memory 603 to enable the communication device 60 to execute the attack detection method in the above method embodiment.

[0273] Specifically, Fig.11 The functions / implementation processes of the second processing module 1101 and the second transceiver module 1102 can be Figure 6 The processor 601 in the communication device 60 shown calls the computer execution instructions stored in the memory 603 to implement. Or, Fig.11 The function / implementation process of the second processing module 1101 can be achieved by Figure 6 The processor 601 in the communication device 60 shown calls the computer execution instructions stored in the memory 603 to implement, Fig.11 The function / implementation process of the second transceiver module 1102 can be Figure 6 The communication interface 604 in the communication device 60 is shown to be implemented.

[0274] Since the monitoring node 110 provided in this embodiment can execute the above-mentioned attack detection method, the technical effects that can be obtained can refer to the above-mentioned method embodiments, which will not be repeated here.

[0275] Optionally, an embodiment of the present application further provides a communication device (for example, the communication device may be a chip or a chip system), the communication device including a processor for implementing the method in any of the above method embodiments. In one possible design, the communication device also includes a memory. The memory is used to store necessary program instructions and data, and the processor can call the program code stored in the memory to instruct the communication device to execute the method in any of the above method embodiments. Of course, the memory may not be in the communication device. In another possible design, the communication device also includes an interface circuit, which is a code / data read / write interface circuit, which is used to receive computer execution instructions (computer execution instructions are stored in the memory, may be read directly from the memory, or may pass through other devices) and transmit them to the processor. When the communication device is a chip system, it can be composed of a chip, or it can include a chip and other discrete devices, which is not specifically limited in the embodiment of the present application.

[0276] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or may contain one or more servers, data centers and other data storage devices that can be integrated with the medium. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state drive (SSD)), etc. In the embodiment of the present application, the computer may include the aforementioned device.

[0277] Although the present application is described herein in conjunction with various embodiments, in the process of implementing the claimed application, those skilled in the art may understand and implement other variations of the disclosed embodiments by viewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "one" or "an" does not exclude multiple situations. A single processor or other unit may implement several functions listed in a claim. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

[0278] Although the present application has been described in conjunction with specific features and embodiments thereof, it is obvious that various modifications and combinations may be made thereto without departing from the spirit and scope of the present application. Accordingly, this specification and the drawings are merely exemplary illustrations of the present application as defined by the appended claims, and are deemed to have covered any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, those skilled in the art may make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An attack detection method, characterized in that: The method comprises: The root node receives first information, where the first information is obtained through a directed acyclic graph information object DIO message in which M monitoring nodes monitor N business nodes, where the N business nodes belong to a first target-oriented directed acyclic graph DODAG, and the M monitoring nodes belong to a second DODAG, where the first DODAG is used for business transmission, and the second DODAG is used to monitor the first DODAG, and the root node is a root node of the first DODAG and the second DODAG, where M and N are positive integers; The root node determines a malicious node among the N service nodes according to the first information; The first information includes an identifier of a third service node and a destination notification trigger sequence number DTSN of the third service node, the DTSN of the third service node is different from the preset DTSN, and the third service node is a service node among the N service nodes; The root node determines a malicious node among the N service nodes according to the first information, including: In the case that the DTSN of the third service node is different from the latest DTSN determined by the root node, the root node determines the third service node as the malicious node.

2. The method according to claim 1, characterized in that: The first information includes a Rank value of each service node in the N service nodes.

3. The method according to claim 2, characterized in that The root node determines a malicious node among the N service nodes according to the first information, including: The root node determines one or more potential malicious nodes according to the first information, where the potential malicious nodes are service nodes among the N service nodes whose Rank values ​​are different from the reference Rank values; The root node determines the potential malicious node with the smallest Rank value among the one or more potential malicious nodes as the malicious node.

4. The method according to claim 2, characterized in that: The root node determines a malicious node among the N service nodes according to the first information, including: When the Rank value of the first service node is less than or equal to the Rank value of the second service node, the root node determines the first service node as the malicious node, the first service node is a service node among the N service nodes, and the second service node is the parent node of the first service node.

5. The method according to claim 1, characterized in that The first information includes Rank values ​​of one or more potential malicious nodes, where the potential malicious nodes are service nodes among the N service nodes whose Rank values ​​are different from the reference Rank value; The root node determines a malicious node among the N service nodes according to the first information, including: The root node determines the potential malicious node with the smallest Rank value among the one or more potential malicious nodes as the malicious node.

6. The method according to claim 1, characterized in that The first information includes identifications of one or more candidate malicious nodes, where the candidate malicious nodes are malicious nodes among the N service nodes determined by the monitoring node according to a reference Rank value of the service node or a topological relationship of the service node.

7. The method according to claim 5 or 6, characterized in that: The method further comprises: The root node sends a reference Rank value of a service node belonging to the first DODAG within the respective monitoring range to each of the M monitoring nodes.

8. The method according to claim 6, characterized in that The method further comprises: The root node sends the topological relationship of the service nodes belonging to the first DODAG within the respective monitoring range to each of the M monitoring nodes.

9. An attack detection method, characterized in that: The method comprises: The monitoring node determines the second information according to the directed acyclic graph information object DIO message of the K business nodes, where the second information is used to determine the malicious node, the K business nodes are located within the monitoring range of the monitoring node, the K business nodes belong to a first target-oriented directed acyclic graph DODAG, the monitoring node belongs to a second DODAG, the first DODAG is used for business transmission, the second DODAG is used to monitor the first DODAG, the root node of the first DODAG is the same as the root node of the second DODAG, K is a positive integer less than or equal to N, and N is the total number of business nodes included in the first DODAG; The monitoring node sends the second information to the root node, so that the root node determines the third service node as a malicious node when determining that the DTSN of the third service node is different from the latest DTSN determined by the root node; The second information includes an identifier of the third service node and a destination notification trigger sequence number DTSN of the third service node. The DTSN of the third service node is different from the preset DTSN. The third service node is a service node among the K service nodes.

10. The method according to claim 9, characterized in that The second information includes a Rank value of each service node in the K service nodes.

11. The method according to claim 9, characterized in that The second information includes Rank values ​​of one or more potential malicious nodes, where the potential malicious nodes are service nodes among the K service nodes whose Rank values ​​are different from the reference Rank values.

12. The method according to claim 9, characterized in that The second information includes an identifier of a candidate malicious node, where the candidate malicious node is a malicious node among the K service nodes determined by the monitoring node.

13. The method according to claim 12, characterized in that The method further comprises: The monitoring node determines the potential malicious node with the smallest Rank value among one or more potential malicious nodes as the candidate malicious node, and the potential malicious node is a service node among the K service nodes whose Rank value is different from the reference Rank value.

14. The method according to claim 11 or 13, characterized in that The method further comprises: The monitoring node receives a reference Rank value of each service node in the K service nodes from the root node.

15. The method according to claim 12, characterized in that The method further comprises: When the Rank value of the first service node is less than or equal to the Rank value of the second service node, the monitoring node determines the first service node as the candidate malicious node, the first service node is a service node among the K service nodes, and the second service node is the parent node of the first service node.

16. The method according to claim 15, characterized in that The method further comprises: The monitoring node receives the topological relationship of the K service nodes from the root node.

17. A communication device, characterized in that: The method comprises a module for executing the method according to any one of claims 1 to 8, or comprises a module for executing the method according to any one of claims 9 to 16.

18. A computer-readable storage medium, characterized in that: The method comprises instructions, which, when executed on a communication device, enable the communication device to execute the method according to any one of claims 1 to 8, or enable the communication device to execute the method according to any one of claims 9 to 16.

19. A communication device, comprising a computer program product, characterized in that: The computer program product comprises instructions, and when the instructions are executed on the communication device, the communication device is caused to perform the method according to any one of claims 1 to 8, or the communication device is caused to perform the method according to any one of claims 9 to 16.

20. A communication device, characterized in that: The communication device comprises: a processor and an interface circuit; The interface circuit is used to receive computer execution instructions and transmit them to the processor; The processor is configured to execute the computer-executable instruction so that the communication device executes the method according to any one of claims 1 to 8, or so that the communication device executes the method according to any one of claims 9 to 16.

21. A communication device, characterized in that: The communication device comprises: a processor; The processor is used to read the computer-executable instructions in the memory and execute the computer-executable instructions to enable the communication device to perform the method according to any one of claims 1 to 8, or to enable the communication device to perform the method according to any one of claims 9 to 16.

22. A communication device, characterized in that: The communication device comprises: a processor and a memory; The memory is used to store computer-executable instructions. When the processor executes the computer-executable instructions, the communication device executes the method as described in any one of claims 1-8, or the communication device executes the method as described in any one of claims 9-16.

23. A communication system, characterized in that: The communication system comprises: a root node and a monitoring node, wherein the root node is used to execute the method according to any one of claims 1 to 8, and the monitoring node is used to execute the method according to any one of claims 9 to 16.

Images