Modeling and prevention methods of WSN malicious program propagation based on cluster routing protocol

Abstract

The present invention relates to a method for preventing and controlling the spread of malicious programs in a wireless sensor network (WSN) under a cluster routing protocol. The main idea is as follows: according to the infectious disease theory, nodes are divided into four types of nodes, namely, susceptible, infected, immune and dead nodes, and the node states are mutually transformed over time; the infection process of a cluster head and subordinate nodes is distinguished, and a Holling-II function is introduced to describe the saturation of the subordinate infection cluster head process; a prevention and control mechanism combining immunization of susceptible nodes with screening of infected nodes is established, and the immunization ratio of susceptible nodes and the screening ratio of infected nodes are used as control variables to construct a prevention and control benefit objective function considering the cost, and the maximum value principle is used to obtain the optimal prevention and control conditions, so that the cost is minimized while achieving the predetermined prevention and control effect.

Description

Technical Field

[0001] The invention belongs to the technical field of communication networks, and in particular relates to a method for preventing and controlling the propagation of WSN malicious programs under a cluster routing protocol based on an improved KM model. Background Art

[0002] Wireless sensor network is abbreviated as WSN. Its network terminals can automatically detect and sense various physical quantities distributed in the outside world. Due to its low cost and convenient deployment, it has been applied in many fields such as agriculture, military, and industrial manufacturing. In the WSN network system, the information communication method of sensors is mainly wireless, resulting in the lack of a fixed topological structure of sensors. The spread of malicious programs in them is highly destructive and difficult to be blocked.

[0003] The broad definition of a computer virus is: "Any program that can replicate itself to 'infect' the target system, causing computer and network failures, and destroying computer data is collectively called a computer virus." In this article, we believe that malicious programs, namely malicious code, are computer viruses in a broad sense.

[0004] The sensor in the present invention adopts a cluster routing protocol, and the spread of malicious programs under this protocol is significantly different from that under a flat routing protocol. Under flat routing, each sensor node is equivalent to each other, and the propagation process is relatively stable and uniform. However, the cluster routing protocol determines the inequality between cluster heads and ordinary nodes: on the one hand, cluster heads consume more energy costs than ordinary nodes in receiving, fusion and multi-hop; on the other hand, cluster heads receive more information and the risk of infection is much higher than that of ordinary nodes. Existing prevention and control methods for the spread of malicious programs are mainly based on flat routing protocols, and there is a lack of effective methods for the prevention and control of the spread of malicious programs under cluster routing protocols. The present invention proposes a prevention and control method for the spread of malicious programs in WSNs under a cluster routing protocol based on an improved KM model. Summary of the invention

[0005] Purpose of the invention: The purpose of the present invention is to provide a method for preventing and controlling the spread of malicious programs in WSN under a cluster routing protocol based on an improved KM model: describing the spread of malicious programs in sensor networks by a set of differential equations can well reflect the infection situation of malicious programs in reality, and propose a method for suppressing malicious programs in WSN under a cluster routing protocol, which effectively optimizes the prevention and control of malicious programs.

[0006] Technical solution: The present invention proposes a modeling and prevention method for the propagation of WSN malicious programs under a cluster routing protocol, and the implementation steps are as follows:

[0007] Step 1: Model the virus transmission efficiency of each type of node in the sensor network of cluster routing protocol, and introduce Holling-Ⅱ function to characterize the saturation of transmission;

[0008] Step 2: Introduce the Kermark-Mckendrick model to describe the state changes between nodes, and improve the KM model to apply it specifically to the infectious relationship between cluster heads and cluster nodes; establish a group of state transformation equations;

[0009] Step 3: Establish an optimization objective function for the proportion of infected nodes and the cost of preventing and controlling virus transmission, and solve the optimization problem;

[0010] Step 4: Establish an immune time-effectiveness function to characterize the failure of the patch, perform numerical simulation, and characterize the effect of prevention and control over time;

[0011] Furthermore, the step 2 specifically includes:

[0012] (1) N is the total number of sensors, n is the number of cluster heads, and the cluster heads in the susceptible state node S are converted The transformation is transformed into the infected state cluster head I1, and the transformation rate of this process is set to λ1; the subordinate nodes in the susceptible state node S are transformed into the infected state cluster head I1, and the transformation rate of this process is set to λ1; Transformed into the infected node I2, the conversion rate of this process is set to λ2; some susceptible nodes S are immunized, and the number of immune nodes accounts for a(t) of all susceptible nodes, that is, a(t) susceptible nodes S are transformed into R-type nodes, where a is a function of time, Λ, λ are constants;

[0013] (2) Some infected nodes I are screened, and the proportion of screened nodes to all infected nodes is b(t), that is, b(t) proportion of class I nodes are converted to class R nodes, where b is a function of time;

[0014] (3) S(t) is the number of susceptible nodes at time t, I(t) is the number of infected nodes at time t, and R(t) is the number of immune nodes at time t. Based on the above description, the transition equations between the states are as follows:

[0015]

[0016]

[0017] That is, in the end:

[0018]

[0019]

[0020]

[0021] Furthermore, in step 2, the node energy consumption is determined by a First Order Radio Model.

[0022] Furthermore, the step three specifically includes the following steps:

[0023] (1) Control the two variables of screening rate a(t) and immunization rate b(t) to obtain the control set

[0024] (2) Define the objective function

[0025] Where T is any time;

[0026] (3) Based on the objective function of step (2) and the state transition equation obtained in step 3, write the Hamiltonian function;

[0027] (4) Using the control set obtained in step (1) as the second constraint condition, the optimal control variable is obtained through the Hamiltonian function, so that the number of infected nodes in the network is minimized and the cost of resisting the spread of malicious programs is minimized.

[0028] Furthermore, the clustering routing protocol includes the Leach clustering protocol and the PSO-UFC clustering protocol.

[0029] Furthermore, the Leach clustering protocol includes the following steps:

[0030] (1) Cluster head selection stage:

[0031] Before the formal clustering, the cluster head must be selected from all nodes according to the protocol. The rule of the Leach protocol is: only nodes that have not been cluster heads before can be selected as cluster heads. This type of node set is represented by G. The clustering mechanism can be described by the probability T(n) of each node being selected as a cluster head. In the 1 / P-1 round, in order to allow all nodes in the system to participate in sharing the energy consumption pressure of the cluster head, the remaining nodes that have not been selected as cluster heads are all made cluster heads. In the 1 / P round, the history of all nodes becoming cluster heads is cleared, and they regain the qualification to become cluster heads.

[0032]

[0033] T(n) is the probability function of selecting a node as a cluster head, P is the ratio of the number of expected cluster heads to the total number of nodes in the system, r is the number of simulation rounds or simulation time counting variable, G is the set of all nodes that have never served as cluster heads, and in the initial state, it contains all sensor nodes in the network. The set elements decrease with iteration, and G returns to the initial state after every P rounds.

[0034] (2) Clustering stage:

[0035] After the cluster head is selected, the cluster head broadcasts according to the protocol, and the subordinate nodes that receive the broadcast join the cluster; the subordinate nodes find the nearest cluster according to the distance, send information to the corresponding cluster head, and then join the cluster;

[0036] (3) Information Exchange:

[0037] After each round of clustering, each ordinary node sends information to the cluster head once. The cluster head merges the information and sends it to the base station, and then enters the next round of clustering.

[0038] Advantages of the Leach protocol: Compared with the protocol in which the cluster head remains unchanged, it considers replacing the cluster head with other network nodes at regular intervals, sharing the energy consumption of the cluster head to the entire system, and extending the system life to a certain extent.

[0039] Furthermore, the PSO-UFC clustering protocol includes the following steps:

[0040] (1) Select cluster head:

[0041] The fitness function is constructed based on the linear combination of the distance within the cluster, the distance to the base station, and the residual energy of the sensor node to maximize the fitness function; the particle swarm algorithm is used to solve the NP problem of cluster head selection.

[0042]

[0043] Where ||N i -MCH j || is the distance between subordinate node i and cluster head node j, l j is the number of common nodes belonging to cluster head j, E R (MCH j ) is the residual energy of the actual cluster head j, ||MCH j -BS|| is the distance between the cluster head node and the base station, Fitness is the fitness function, the optimization goal is to minimize the fitness function, α, β, γ are constant coefficients;

[0044] (2) Cluster construction:

[0045] After the cluster head combination selection is completed, the subordinate node receives the cluster head broadcast and selects the cluster to join; the selection basis includes the distance of the cluster head node, the distance of the cluster head node from the base station, the remaining energy of the cluster head node, and the node degree of the cluster head node. The subordinate node traverses the cluster heads that can be joined, selects a relatively energy-saving cluster head to join, and sends information to the cluster head for feedback;

[0046] (3) Multi-hop path construction:

[0047] After the clusters are formed, multi-hop paths between cluster head nodes are constructed for information exchange. The path selection is based on the remaining energy of cluster head nodes, the distance between cluster head nodes, the distance between cluster head nodes and base stations, and the node degree of cluster head nodes to form a suitable multi-hop path;

[0048] (4) Information Exchange:

[0049] After each round of clustering, each subordinate node sends the detected message to the cluster head node. The cluster head node merges multiple messages and then sends the merged message to the next cluster head along the multi-hop tree path, and then enters the next round of clustering.

[0050] Advantages of PSO-UFC protocol:

[0051] Reasonable clustering effectively alleviates the hot spot problem under multi-hop paths, alleviates the energy imbalance problem, and prolongs the network service life.

[0052] Beneficial effects: Compared with the current technology, the advantages of the present invention are obvious, as follows:

[0053] (1) The present invention takes into account the characteristic of limited sensor energy, constructs a specific mechanism for the spread of malicious programs in sensor networks, and reasonably adopts the Holling-Ⅱ reaction function in the infectious disease model and the predator model in the infection process of the cluster head and subordinate nodes, which can well reflect the infection situation of malicious programs in reality; at the same time, two measures, immunity and screening, are adopted to prevent and control the spread of malicious programs, and the reality of the failure of the immune patch is portrayed. The present invention can provide effective help for resisting the spread of malicious programs in WSNs under the cluster routing protocol.

[0054] (2) The present invention selects two clustering routing protocols to study the spread and prevention of malicious programs. The Leach protocol is a classic clustering routing protocol. Its main idea is to select cluster heads based on probability, so that each sensor node has an equal chance of being elected as a cluster head. This protocol considers sharing the extra energy consumption of the cluster head to each node at an early stage, which increases the system life to a certain extent. The other is the PSO-UFC protocol, which is a clustering protocol with good comprehensive capabilities. Its main idea is to use the particle swarm algorithm and add spare cluster heads to optimize the clustering process. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 It is the transformation relationship diagram of four types of nodes;

[0056] Figure 2 A flowchart for preventing and controlling malicious programs;

[0057] Figure 3Comparison between prevention and control under the Leach protocol and without prevention and control, where (a) shows the change of the number of nodes in each state with the number of simulation rounds when the prevention and control mechanism of this paper is used, (b) shows the change of the immunization ratio a and the screening ratio b with the number of simulation rounds during the prevention and control process, and (c) shows the change of the number of nodes in each state with the number of simulation rounds when no prevention and control is performed;

[0058] Figure 4 This is a comparison between the prevention and control under the PSO-UFC protocol and the non-prevention and control. (a) shows the change of the number of nodes in each state with the number of simulation rounds when the prevention and control mechanism of this paper is used, (b) shows the change of the immunization ratio a and the screening ratio b with the number of simulation rounds during the prevention and control process, and (c) shows the change of the number of nodes in each state with the number of simulation rounds when no prevention and control is performed. DETAILED DESCRIPTION

[0059] The technical solution of the present invention is further described below in conjunction with the accompanying drawings.

[0060] Attached Figure 1 The transformation relationship of four types of nodes is depicted; Figure 2 Shown is a flow chart of the solution of the present invention; Figure 3 By comparing Figure a) and Figure c), we can see that under the Leach protocol, after the implementation of this method, the number of infected nodes in the middle and late stages is significantly reduced compared to when this method is not implemented, which reflects the effectiveness of this method in numerical simulation; Figure 4 Under the PSO_UFC protocol, Figure a) and Figure c) also prove the effectiveness of the prevention and control methods.

[0061] The present invention proposes a control method for suppressing the growth of malicious programs in WSN under two clustering routing protocols, which can better resist the spread of malicious programs in WSN, that is, reduce the number of infected nodes (I) in the network, and reduce the immunization cost and troubleshooting cost of the network, that is, minimize the optimization objective function. It should be noted that in actual operation, the immunization and troubleshooting measures should be set at the end of each round of working stage, that is, after the end of the current round of working stage and before the start of the next round of clustering stage. Because the clustering stage is short in reality, and the execution of prevention and control work during normal work may affect the normal operation of the system, it is set to be executed at the end of the working stage.

[0062] The technical solution of the present invention comprises the following steps:

[0063] N1. Model the effectiveness of each type of node in the sensor network of the cluster routing protocol in transmitting viruses, and introduce the Holling-Ⅱ function to characterize the saturation of the infection.

[0064] Determine the network model of wireless sensors, specifically: determine the total number of nodes evenly distributed in a two-dimensional area of ​​L×L, and perform normal operations and cluster head replacement procedures according to the Leach or PSO-UFC protocol. Each node has limited energy and will die once the energy is exhausted.

[0065] N2. Introduce the Kermark-Mckendrick model to describe the state changes between nodes, and improve the KM model to apply it specifically to the infectious relationship between cluster heads and cluster nodes; establish a group of state transformation equations;

[0066] According to the infectious disease theory, the node types in WSN are: susceptible nodes (S), infected nodes (I), immune nodes (R) and dead nodes (D), among which the infected nodes (I) can be subdivided into cluster heads in the infected state (I1) and subordinate nodes in the infected state (I2); according to the transfer rules of various node states, the state transition equation is introduced; the mutual conversion between nodes in each state in step N2 includes the following sub-steps, where N is the total number of sensors and n is the number of cluster heads:

[0067] (1) The cluster head of the susceptible node (S) is converted Transformed into the infected cluster head (I1), the conversion rate of this process is set to λ1; is the number of subordinate nodes in the susceptible node, is the number of cluster head nodes among the infected nodes, and Λ is a constant; that is, subordinate nodes can only infect cluster heads. Due to the strong protection ability of cluster heads and the existence of channel restrictions, the infected subordinate node I1 has a saturation effect on the infection process of cluster heads, so its conversion rate adopts the Holling-Ⅱ function form σ1, σ2 are parameters.

[0068] (2) The subordinate nodes in the susceptible state node (S) are based on the conversion amount Transformed into the infected state subordinate node (I2), the process conversion rate is set to λ2; is the cluster head node among the susceptible nodes, is the subordinate node among the infected nodes, and λ is a constant; the cluster head has less restriction on the channel of subordinate broadcast process, and there is no saturation, and the infection law can be regarded as the classic bilinear incidence rate;

[0069] (3) All susceptible nodes (S) are transformed into immune nodes (R) at a ratio a(t), where a is a function of time. In actual operation, considering the limited time for executing immune measures, the upper limit of the immune ratio a is 0.5.

[0070] (4) All infected nodes (I) are transformed into immune nodes (R) at a ratio of b(t), where b is a function of time. In actual operation, considering the limited time for implementing screening measures, the upper limit of the screening ratio b is 0.5.

[0071] That is:

[0072]

[0073]

[0074] (5), S(t), I(t), and R(t) are the number of susceptible nodes, infected nodes, and immune nodes at time t, respectively. The above description can be used to derive the transition equation between states:

[0075] (6)

[0076] (7)

[0077] (8)

[0078] (9) At the same time, the energy consumption of nodes in the network follows the First Order Radio Model energy model, and the nodes that are exhausted of energy are dead nodes (D):

[0079]

[0080]

[0081] E Rx (l) = l × E elec

[0082] E Dx =n×E DA

[0083] Where E Tx is the energy consumed by the node to send information, l is the information length (bit), d is the distance between two nodes (m), E elec ,ε fs ,ε mp are all constant coefficients, E Rx is the energy consumed by the node to receive information, E Dx is the energy consumption of cluster head fusion message, n is the number of fusion messages, E DA is a constant coefficient.

[0084] N3. Establish an optimization objective function for the proportion of infected nodes and the cost of preventing and controlling virus transmission, and solve the optimization problem;

[0085] The immunization rate of WSN to susceptible nodes (S) and the screening rate to infected nodes (I) are used as control variables to obtain the control set.

[0086] Objective function:

[0087]

[0088] It can ensure that the number of infected nodes is within a controllable range. Among them, c1 is the cost parameter for implementing the immunization operation, c2 is the cost parameter for implementing the screening operation, and the feasible domain of the optimization control variables a(t) and b(t) corresponding to the objective function is:

[0089] U={a(t),b(t)|0≤a(t)≤1,0≤b(t)≤1,t∈[0,T]}

[0090] First, construct the Hamiltonian function as follows:

[0091]

[0092]

[0093] ξ1(t),ξ2(t) are covariables. According to Pontryagin's maximum principle, we get a system of differential equations with covariables. In the following, S represents S(t) and I represents I(t).

[0094]

[0095] The optimal control variable J*=(a*(t),b*(t)) can be obtained from this set of equations, so that minJ(a,b)=J(u*), where J(u) represents the objective function, that is, the cost function, u is the dependent variable, and u=(a(t),b(t)). The goal is to find a suitable u=u* to minimize J(u).

[0096] The optimization conditions are as follows:

[0097]

[0098] From the above formula, we can get:

[0099]

[0100] The optimal control pair is as follows:

[0101]

[0102] The result of the optimization control is that the objective function obtains the minimum value.

[0103] N4. Establish an immune time-effectiveness function to characterize patch failure, conduct numerical simulation, and characterize the effect of prevention and control over time.

Claims

1. A modeling and prevention method for the propagation of malicious programs in WSN under a cluster routing protocol, characterized in that: The following steps are involved: The first step is to model the virus transmission efficiency of each type of node in the sensor network of cluster routing protocol, and introduce the Holling-Ⅱ function to characterize the saturation of transmission; The second step is to introduce the Kermark-Mckendrick model to describe the state changes between nodes, and improve the KM model to apply it specifically to the infectious relationship between cluster heads and cluster nodes; establish a group of state transformation equations; The third step is to establish an optimization objective function for the proportion of infected nodes and the cost of preventing and controlling virus transmission, and solve the optimization problem; Step 4: Establish an immune time-effectiveness function to characterize the failure of the patch, conduct numerical simulation, and characterize the effect of prevention and control over time; Among them, it is applicable to the cluster routing protocol, that is, the second step is as follows: (1) N is the total number of sensors, n is the number of cluster heads, and the cluster heads in the susceptible state node S are converted The transformation is transformed into the infected cluster head I1, the process transformation rate is set to λ1, and the transformation amount is in the form of Holling-Ⅱ function to describe its infection saturation, where m is a parameter; the subordinate nodes in the susceptible state node S are transformed into the infected cluster head I1 with the transformation amount. Transformed into the infected state subordinate node I2, the process conversion rate is set to λ2; some susceptible state nodes S are immunized, and the number of immune nodes accounts for the proportion of all susceptible state nodes S is a(t), that is, a(t) susceptible state nodes S are transformed into R class nodes, where a is a function of time, Λ, λ are constants; (2) Some infected nodes I are screened, and the proportion of screened nodes to all infected nodes is b(t), that is, b(t) proportion of class I nodes are converted to class R nodes, where b is a function of time; (3) S(t) is the number of susceptible nodes at time t, I(t) is the number of infected nodes at time t, and R(t) is the number of immune nodes at time t. Based on the above description, the transition equations between the states are as follows: That is, in the end: The third step is specifically as follows: (1) Control the two variables of immunization rate a(t) and screening rate b(t) to obtain the control set; (2) Define the objective function Where T is any time; (3) Based on the objective function of step (2) and the state transfer equation obtained in the third step, the Hamiltonian function is derived; (4) Using the control set obtained in step (1) as the second constraint condition, the optimal control variable is obtained through the Hamiltonian function, so that the number of infected nodes in the network is minimized and the cost of resisting the spread of malicious programs is minimized.

2. The modeling and prevention method for WSN malicious program propagation under the cluster routing protocol according to claim 1 is characterized in that: The First Order Radio Model determines the energy consumption of each node in the network, and then determines the life and death status of the node.

3. The modeling and prevention method for WSN malicious program propagation under the cluster routing protocol according to claim 1 is characterized in that: The clustering routing protocols include the Leach clustering protocol and the PSO-UFC clustering protocol.

4. The modeling and prevention method for WSN malicious program propagation under the cluster routing protocol according to claim 3 is characterized in that: The Leach clustering protocol includes the following steps: (1) Cluster head selection stage: Before the formal clustering, the cluster head must be selected from all nodes according to the protocol. The rule of the Leach protocol is: only nodes that have not been cluster heads before can be selected as cluster heads. This type of node set is represented by G. The clustering mechanism can be described by the probability T(n) of each node being selected as a cluster head. In the 1 / P-1 round, in order to allow all nodes in the system to participate in sharing the energy consumption pressure of the cluster head, the remaining nodes that have not been selected as cluster heads are all made cluster heads. In the 1 / P round, the history of all nodes becoming cluster heads is cleared, and they regain the qualification to become cluster heads. T(n) is the probability function of selecting a node as a cluster head, P is the ratio of the number of expected cluster heads to the total number of nodes in the system, r is the number of simulation rounds or simulation time counting variable, G is the set of all nodes that have never served as cluster heads, and in the initial state, it contains all sensor nodes in the network. The number of set elements decreases with iteration, and G returns to the initial state after every P rounds; (2) Clustering stage: After the cluster head is selected, the cluster head broadcasts according to the protocol, and the subordinate nodes that receive the broadcast join the cluster; the subordinate nodes find the nearest cluster according to the distance, send information to the corresponding cluster head, and then join the cluster; (3) Information Exchange: After each round of clustering, each ordinary node sends information to the cluster head once. The cluster head merges the information and sends it to the base station, and then enters the next round of clustering.

5. The modeling and prevention method for WSN malicious program propagation under the cluster routing protocol according to claim 3 is characterized in that: The PSO-UFC clustering protocol execution steps are: (1) Select cluster head: The fitness function is constructed based on the linear combination of the distance within the cluster, the distance to the base station, and the residual energy of the sensor node to maximize the fitness function; the particle swarm algorithm is used to solve the NP problem of cluster head selection. Where ||N i -MCH j || is the distance between subordinate node i and cluster head node j, l j is the number of subordinate nodes belonging to cluster head j, E R (MCH j ) is the residual energy of the actual cluster head j, ||MCH j -BS|| is the distance between the cluster head node and the base station, Fitness is the fitness function, the optimization goal is to minimize the fitness function, α, β, γ are constant coefficients; (2) Cluster construction: After the cluster head combination selection is completed, the subordinate node receives the cluster head's broadcast and selects the cluster to join; the selection basis includes the distance of the cluster head node, the distance of the cluster head node from the base station, the remaining energy of the cluster head node, and the node degree of the cluster head node; the subordinate node traverses the cluster heads that can be joined, selects a relatively energy-saving cluster head to join, and sends information to the cluster head for feedback; (3) Multi-hop path construction: After the clusters are formed, multi-hop paths between cluster head nodes are constructed for information exchange. The path selection is based on the remaining energy of cluster head nodes, the distance between cluster head nodes, the distance between cluster head nodes and base stations, and the node degree of cluster head nodes to form a suitable multi-hop path; (4) Information Exchange: After each round of clustering, each subordinate node sends the detected message to the cluster head node. The cluster head node merges multiple messages and then sends the merged message to the next cluster head along the multi-hop tree path, and then enters the next round of clustering.

Images