A MANET network flood attack defense method and device

Abstract

The present application discloses a method and device for defending against flooding attacks on a MANET network, including pre-initializing the MANET; within each update time interval Δt, any node in the MANET counts the total number of RREQ message packets received; if the total number of RREQ message packets exceeds a normal message number threshold, the node calculates its adaptive dynamic threshold; if the number of RREQ message packets sent to the node by any neighboring node of the node exceeds the adaptive dynamic threshold, the node refuses to receive all packets from the neighboring node. The method of the present application reduces the additional packet communication load in the link, solving the problems of the lack of flexibility of existing malicious node detection methods based on static thresholds and the high communication cost and computational overhead of malicious node detection methods based on dynamic thresholds.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method and device for defending against flooding attacks on a MANET network. Background Art

[0002] Mobile Ad Hoc Networks (MANETs) are collections of wireless mobile devices that dynamically form a temporary network without the support of additional infrastructure in situations such as disaster relief, emergency meetings, or military missions. The topology of a MANET can change at any time because mobile devices can join or leave the network at will.

[0003] AODV (Adhoc On-demand Distance Vector) is a popular passive routing algorithm in MANETs. It uses three types of routing control messages: RREQ messages for initiating route requests, RREP messages for route replies, and HELLO / RERR messages for maintaining route state. The AODV protocol works as follows: When a source node S wishes to communicate with a destination node D, if its local routing table does not contain a route to D, S initiates the route discovery process by broadcasting a RREQ packet containing D's IP address to its neighboring nodes. The neighboring nodes then establish a reverse route from S to themselves based on the source IP address in the RREQ packet. They then check their own routing tables for a route to D. If not, they continue forwarding the RREQ packet to their neighbors. This forwarding process continues until an intermediate node T, which contains a route to D, or D receives the RREQ packet. T or D then sends a route reply (RREP) packet back to S along the established reverse route. Upon receiving the RREP message, the intermediate node adds a forward route to D to its own routing table. Once a route is established, HELLO or RERR packets can be used to maintain the state of the route.

[0004] The AODV routing protocol features rapid adaptability to link conditions, low memory overhead, and low network utilization, making it ideal for use in MANETs with dynamic and changing links. Although the AODV protocol establishes routes in a simple manner, its defenses against security threats are limited. In particular, during the route request phase, it is extremely vulnerable to RREQ flooding attacks initiated by malicious user nodes. These attacks involve broadcasting a large number of spurious RREQ packets containing fake IP addresses in a short period of time, reducing the bandwidth of links within the MANET. This floods legitimate RREQ requests from other legitimate nodes, resulting in a decrease in overall network throughput and a reduction in the lifespan of other mobile devices. However, current methods for defending against RREQ attacks against the AODV protocol primarily rely on static threshold detection, which makes it difficult to achieve flexible, dynamic, and resilient defenses.

[0005] Song et al., in a paper titled "Effective filtering scheme against RREQ flooding attack in mobile ad hoc networks" published in The International Conference on Parallel and Distributed Computing, Applications and Technologies, 2006, proposed a dual-static threshold scheme: RATE_LIMIT and BLACKLIST_LIMIT thresholds. If the number of RREQ packets from a specific IP source within a node's statistical unit time is lower than the RATE_LIMIT threshold, the request is processed immediately. If the number is higher than the BLACKLIST_LIMIT, the IP source address is blacklisted. If the number is between the two thresholds, a constant queuing time is imposed on all RREQ requests from the specific IP source and the request is processed after the queuing ends. The disadvantage of this technical solution is that it reduces the false positive detection rate of normal nodes, and malicious nodes can also bypass the security mechanism by sending RREQ data packets at a frequency lower than the threshold.

[0006] In their paper titled "A New Intrusion Detection System Based on KNN Classification Algorithm in Wireless Sensor Network," published in the Journal of Electrical and Computer Engineering, 2014, Wen Chao et al. constructed an intrusion detection system based on the kNN algorithm. This system classifies and separates abnormal nodes from normal nodes by observing their behavioral characteristics. Although the system has high detection accuracy, it does not provide an algorithm for establishing a training dataset. In their paper titled "A novel approach for mitigating route request flooding attack in MANET," published in Wireless Networks, 2018, Gurung et al. attempted to deploy specialized Flooding Intrusion Detection System (F-IDS) nodes in a promiscuous network and use dynamic thresholds to detect and defend against RREQ flooding attacks. F-IDS, as a macro detector, counts nodes with abnormal RREQ requests within the network, including several steps such as malicious node broadcasts and blacklisting mechanisms. Experimental results show that the standard routing load capacity of the AODV protocol with the F-IDS solution is slightly higher than that of the original AODV protocol. However, since promiscuous mode places more communication and processing burden on the network, this defense measure severely impacts system performance. Furthermore, setting up multiple F-IDS nodes in every scenario is impractical, as malicious nodes may forge broadcasts and exploit them maliciously.

[0007] Amit et al. published a paper titled "Q-AODV: A Flood Control Ad-Hoc on DemandDistance Vector Routing Protocol" at the International Conference on Secure Cyber Computing and Communication, 2018. They considered the empty rate of the routing message queue on a node as a congestion metric and used a random probability-based algorithm to discard or forward routing messages to reduce redundant RREQ broadcast messages. Although simulation results such as average delay and throughput were slightly better than those of the AODV protocol, the algorithm was unable to effectively identify malicious nodes, and the MANET network was constantly under threat of flooding attacks.

[0008] The existing methods for defending against RREQ flood attacks mainly include:

[0009] Detection methods based on multiple sets of static thresholds lack flexibility because the most appropriate thresholds vary with the dynamic changes in network topology size, number of nodes, and mobility speed. Lower thresholds can misidentify more normal node routing requests as malicious, resulting in higher false positives and increased network latency. Higher thresholds can lead to some malicious nodes indiscriminately launching RREQ flooding attacks.

[0010] Detection methods based on dynamic thresholds in a promiscuous mode require measuring the extreme values of some indicators in the network in the absence of malicious node attacks as dynamic thresholds, or setting up a central detection node using a promiscuous mode to detect the entire network. However, even if the dynamic threshold takes into account factors such as network transmission capacity, node mobility, and the frequency of malicious node attacks, the misclassification rate is still high. This is because in a high-mobility environment, the connection status of network nodes changes very frequently, and a node may not be able to capture accurate and sufficient information to extract it into a single threshold. In addition, using a promiscuous mode in the detection node will inevitably increase the communication and computational overhead of the network.

[0011] Detection methods based on machine learning models require extracting features from RREQ packets and request behaviors to train a malicious node classification model. However, the datasets lack universality and transparency, and the trained models may not be transferable. Summary of the Invention

[0012] The embodiments of the present application provide a method and device for defending against flooding attacks in a MANET network, so as to solve the problems that the existing malicious node detection methods based on static thresholds lack flexibility and the malicious node detection methods based on dynamic thresholds have high communication costs and computational overhead.

[0013] The present invention provides a method for defending against flooding attacks on a MANET network, including the following steps:

[0014] Pre-initializing a Mobile Ad Hoc Network (MANET), wherein a timestamp for unifying the MANET is initialized and global shared parameters of the MANET are defined, wherein the global shared parameters include an update time interval Δt;

[0015] In each update time interval Δt, any node of the MANET counts the total number of RREQ message data packets received. If the total number of RREQ message data packets is higher than the normal message number threshold, the node calculates its adaptive dynamic threshold;

[0016] If the number of RREQ message data packets sent by any neighboring node of any node to any node is higher than the adaptive dynamic threshold, any node refuses to receive all data packets from any neighboring node.

[0017] Optionally, a timer is configured for any node of the MANET, and the timer generates an event response signal every Δt;

[0018] In each update time interval Δt, the total number of RREQ packets received by any node in the MANET includes:

[0019] After any node i receives the timer's event response signal at time t, it executes:

[0020] The total number of RREQ message data packets received within the update time interval Δt, the source set of the RREQ message data packets, and the number of RREQ data packets transmitted by the source set to any node i are recorded.

[0021] Optionally, the step of calculating the adaptive dynamic threshold value of any node includes the following steps:

[0022] Any node calculates the average number of received RREQ message data packets;

[0023] Calculate the standard deviation based on the mean number of RREQ message data packets;

[0024] Calculate the rate of change based on the mean and standard deviation of the previous moment;

[0025] A dynamic threshold is calculated based on the change rate and the average number of RREQ message data packets.

[0026] Optionally, a time list is configured for any node of the MANET, wherein the time list records the remaining rejection duration of the rejected neighbor nodes. After any node i receives an event response signal from the timer at time t, the following steps are further executed:

[0027] Decrementing each remaining rejection duration in the time list to update the time list; and

[0028] Resume receiving data packets from neighboring nodes whose remaining rejection time decreases to the set value.

[0029] Optionally, a receiving queue for RREQ data flow is configured for any node, and a gray list is configured for any node, wherein the gray list records the IP addresses of rejected neighbor nodes. The method further includes:

[0030] Any node detects whether the source node IP address of any RREQ data packet in the receiving queue belongs to the gray list, and if so, rejects the packet; if not, increments the number of received RREQ message data packets;

[0031] Determine whether the source node IP address of any RREQ data packet belongs to the source set. If so, the corresponding source node IP address statistic is incremented. Otherwise, the source set is updated using the corresponding source node IP address.

[0032] Optionally, a counting dictionary is configured for any node, wherein the counting dictionary records the number of times all IP addresses are added to the grey list after any node is running, and the length of the counting dictionary increases and elements are not deleted;

[0033] The value of the remaining rejection time recorded in the time list increases exponentially as the number of times the corresponding IP address appears in the grey list increases.

[0034] Optionally, if the number of RREQ message data packets sent by any neighboring node of any node to any node is higher than the adaptive dynamic threshold, the step further includes:

[0035] Adding the IP address of any neighbor node to the gray list;

[0036] Use the counting dictionary to determine whether there is a record of any neighbor node. If so, the record value is incremented. If not, a corresponding dictionary key value is added and assigned an initial value.

[0037] The counting dictionary is queried for the statistical number of any neighbor node, and the corresponding remaining rejection time is assigned in the time list.

[0038] An embodiment of the present application further provides a terminal device, including a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the aforementioned MANET network flood attack defense method are implemented.

[0039] The embodiment of the present application further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the aforementioned method for defending against flooding attacks on a MANET network are implemented.

[0040] The embodiment of the present application uses adaptive dynamic threshold detection for different network topology states, avoiding the use of promiscuous mode or the setting of dedicated detection nodes, thereby reducing the additional data packet communication load in the link, and solving the problems of lack of flexibility of existing malicious node detection methods based on static thresholds and high communication costs and computational overhead of malicious node detection methods based on dynamic thresholds.

[0041] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present application. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0043] Figure 1 This is a basic flow chart of the MANET network flood attack defense method according to an embodiment of the present application;

[0044] Figure 2 This is an example of the process of the MANET network flood attack defense method according to the embodiment of the present application;

[0045] Figure 3 This is an example of the message format of the protocol targeted by the embodiments of the present application;

[0046] Figure 4 This is an example of the RREQ data packet loss rate in a simulated MANET network according to an embodiment of the present application. DETAILED DESCRIPTION

[0047] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0048] The present invention provides a method for defending against flooding attacks on a MANET network. Figure 1 、 Figure 2 As shown, the following steps are included:

[0049] In step S101, a mobile ad hoc network (MANET) is pre-initialized, wherein the timestamp used to unify the MANET is initialized and the global shared parameters of the MANET are defined, and the global shared parameters include the update time interval Δt. All nodes under the MANET can work in real time and in a distributed manner. In this embodiment, initialization is first performed, and on the basis of the unified timestamp, global shared parameters such as the update time interval Δt are defined. During the initialization phase, all participating nodes synchronize their timestamps. In addition, the gray list can be set to an empty set during the initialization phase, and the shared time interval Δt (such as 10 seconds by default), the minimum warning threshold mat i In this embodiment, the minimum warning threshold value mat i As a preset constant, mat i Represents the reasonable upper limit of the total number of RREQ packets received by any node i. The nodes in MANET count the total number of RREQ packets they received in the past time interval cnt i If the total number is not higher than the warning value, it is considered that no RREQ flood attack has occurred in the past time interval, and the subsequent adaptive dynamic threshold defense steps are avoided. Otherwise, it is considered that there is a risk of potential RREQ flood attack and the subsequent steps are not executed. i The parameter setting can save computing power and battery energy when MANET is not attacked by RREQ flooding. i Can be defined as a globally shared value (such as mat * =10).

[0050] In some embodiments, a timer is configured for each node in the MANET, and the timer generates an event response signal every Δt. Specifically, all nodes in the MANET have built-in timers and synchronized timestamps, and all timers generate an event response signal every Δt. In this embodiment, "previous moment" is defined to represent the time of the previous timer event, "next moment" to represent the time of the next timer event, and "time t" to represent the time of the tth timer event.

[0051] In step S102, within each update time interval Δt, any node of the MANET counts the total number of RREQ message packets received. If the total number of RREQ message packets is higher than the normal message number threshold, the node calculates its adaptive dynamic threshold. Specifically, within each Δt, all nodes independently count the total number of RREQ packets received cnt i For a specific RREQ message format, see Figure 3 As shown. i With mat i For comparison, mat iIndicates the normal upper limit of the number of RREQ packets received by any node i within each Δt: if cnt i No higher than mat i It is considered that there is no RREQ flood attack at this moment and no subsequent steps need to be performed; if the node cnt i Higher than mat i , continue to calculate any node i's own adaptive dynamic threshold dt i .

[0052] In step S103, if the number of RREQ message data packets sent by any neighboring node of any node to any node is higher than the adaptive dynamic threshold, any node refuses to receive all data packets from any neighboring node.

[0053] The embodiment of the present application uses adaptive dynamic threshold detection for different network topology states, avoiding the use of promiscuous mode or the setting of dedicated detection nodes, thereby reducing the additional data packet communication load in the link, and solving the problems of lack of flexibility of existing malicious node detection methods based on static thresholds and high communication costs and computational overhead of malicious node detection methods based on dynamic thresholds.

[0054] In some embodiments, within each update time interval Δt, any node of the MANET counts the total number of RREQ message data packets received, including:

[0055] After any node i receives the timer's event response signal at time t, it executes:

[0056] The total number of RREQ message data packets received within the update time interval Δt, the source set of the RREQ message data packets, and the number of RREQ data packets transmitted by the source set to any node i are recorded.

[0057] Taking node i as an example, within any time interval Δt, the source of the RREQ data packets counted is defined as the source set Neighbor = {src_ip1, src_ip2, ..., src_ip n}, the number of RREQ packets they transmit to node i is Transmission = {tr1, tr2, ..., tr n The source of the RREQ data packet is obtained from the source node IP address of the RREQ data message.

[0058] In a specific application example, after any node i receives the timer event response signal at time t, it can save cnt i , Neighbor={src_ip1, src_ip2,…,src_ip n}, Transmission={tr1, tr2,…, tr n}Three values to the local variable Last_Cnt i , Last_Neig, Last_Trans, for subsequent steps:

[0059] Last_Cnt i =cnt i

[0060] Last_Neig=Neighbor

[0061] Last_Trans=Transmission

[0062] Clear cnt i , Neighbor, Transmission values:

[0063] cnt i =0

[0064]

[0065]

[0066] Restart counting cnt i , Neighbor, and Transmission values are waiting to be used at the next moment (i.e., time t+1).

[0067] In some embodiments, the method further includes configuring a gray list GrayList for any node, wherein the gray list GrayList records the IP addresses of rejected neighbor nodes, and configuring a time list RemainTimeList for any node of the MANET, wherein the time list records the remaining rejection time of the rejected neighbor nodes RemainTimeList=[rt1, rt2, ..., rt k ], after any node i receives the event response signal of the timer at time t, it also executes:

[0068] Decrementing each remaining rejection duration in the time list to update the time list; and

[0069] Resume receiving data packets from neighboring nodes whose remaining rejection time decreases to the set value.

[0070] In a specific application, update the remaining seal time list and reduce the value of each element in the list by one:

[0071] RemainTimeList[*]=RemainTimeList[*]-1

[0072] Clear the items with a value of 0 in the remaining seal time list and clear the corresponding IP addresses in the grey list.

[0073] In some embodiments, configuring a receive queue for a RREQ data flow for any node, the method further includes:

[0074] Any node detects whether the source node IP address of any RREQ data packet in the receiving queue belongs to the gray list. If it belongs to the gray list, it is rejected; if not, the number of received RREQ message data packets is incremented.

[0075] Any node detects in real time whether the source node IP address of each RREQ packet in the queue appears in the gray list. If so, the RREQ packet is discarded. Otherwise, i The statistic value is increased by 1:

[0076] cnt i =cnt i +1

[0077] Determine whether the source node IP address of any RREQ data packet belongs to the source set. If so, the corresponding source node IP address statistics are incremented:

[0078] tr x =tr x +1

[0079] Otherwise, update the source set with the corresponding source node IP address:

[0080] Neighbor=Neighbor∪{src_ip x}

[0081] tr x =1

[0082] In a specific application, for the n nodes that send RREQ data packets within any time interval Δt, Neighbor = {src_ip1, src_ip2, ..., src_ip n}, and also satisfies:

[0083]

[0084] At time t, node i obtains the value of the three local variables Last_Cnt i , Last_Neig, Last_Trans calculate the adaptive threshold; the process of calculating the adaptive threshold includes: mean calculation, standard deviation calculation, rate of change calculation, adaptive threshold calculation, where Last_Trans = {tr1, tr2, ..., tr nIn some embodiments, the step of calculating the adaptive dynamic threshold value of any node comprises the following steps:

[0085] Any node calculates the average number of received RREQ packets:

[0086]

[0087] The standard deviation is calculated based on the mean number of RREQ packets:

[0088]

[0089] Any node i obtains the mean and standard deviation saved at the last moment (marked as 、std t-1 ), calculate the rate of change based on the mean and standard deviation of the previous moment:

[0090]

[0091] Any node i saves the mean and standard deviation of the current moment as local variables, waiting to use them when calculating the change rate at the next moment, and calculates the dynamic threshold based on the change rate and the mean number of RREQ message packets:

[0092]

[0093] In some embodiments, the threshold comparison of the present application includes minimum warning threshold comparison and adaptive dynamic threshold comparison. In the minimum static threshold comparison, any node i will calculate the Last_Cnt i The minimum warning threshold mat at initialization i Perform a size comparison. If it is less than the threshold, it indicates that there has been no RREQ flooding attack in the past time interval (t-1, t). Skip the adaptive dynamic threshold comparison step and the graylist recording step, continue counting RREQ data flows, and wait for the next timer event. If it is greater than the threshold, continue the adaptive dynamic threshold comparison step.

[0094] In the adaptive dynamic threshold comparison step, first use the above method to calculate the dynamic threshold dt of any node i in the past time interval (t-1, t), and then compare the value of each element in the saved local variable Last_Trans with dt. If Last_Trans[j]≤dt, it means src_ip j If the user is not malicious, then continue to compare the size of other elements of Last_Trans with dt; if Last_Trans[j]>dt, then src_ip jAdd it to the graylist (see the subsequent steps for the specific process) and continue to compare the size of other elements of Last_Trans with dt. After all elements of Last_Trans are compared with dt, continue to count the RREQ data flow and wait for the next timer event to occur.

[0095] In some embodiments, a counting dictionary is further configured for any node, wherein the counting dictionary records the number of times all IP addresses are added to the grey list after any node is run, and the length of the dictionary increases and elements are not deleted;

[0096] The value of the remaining rejection time recorded in the time list increases exponentially as the number of times the corresponding IP address appears in the grey list increases.

[0097] In a specific application, assume that any node i maintains:

[0098] Graylist GrayList = [gray_ip1, gray_ip2, ..., gray_ip k ];

[0099] Count dictionary GrayDict = {gray_ip1: num1, ...};

[0100] Time list RemainTimeList = [rt1, rt2, ..., rt k ].

[0101] The counting dictionary counts the number of times all IP addresses have been added to the greylist since the device started running. The length of the counting dictionary increases, elements are not deleted, and the value of each element is non-decreasing.

[0102] The time list records the remaining rejection time of the rejected neighbor nodes, that is, it is used to save the remaining blocking time (remaining rejection time) of each IP address in the current gray list. Its characteristics are variable length, one-to-one correspondence between elements and gray list elements, and linear decrease of each element value. Specifically, the RemainTimeList element rt j The value of increases exponentially with the number of times the corresponding IP address appears in the greylist. The unit can be Δt, which is a time interval. The remaining ban duration can be calculated as follows:

[0103]

[0104] In some embodiments, if the number of RREQ message data packets sent by any neighboring node of any node to any node is higher than the adaptive dynamic threshold, the step further includes:

[0105] Add the IP address of any neighbor node to the gray list. Specifically, src_ip j Add it to the graylist GrayList and add it to the end of GrayList:

[0106] GrayList=GrayList+src_ip j

[0107] Use the counting dictionary to determine whether there is a record of any of the neighbor nodes. If so, the record value is incremented:

[0108] GrayDict[src_ip j ]=GrayDict[src_ip j ]+1

[0109] If it does not exist, add the corresponding dictionary key value and assign it an initial value:

[0110] GrayDict[src_ip j ]=1

[0111] Query the statistical number of any neighbor node in the counting dictionary and assign the corresponding remaining rejection time in the time list. Specifically, the time list can be used to update the query counting dictionary src_ip j The number of times it is counted is src_ip j Assign a sealing time as a penalty, and use the above method to calculate the sealing time rt j , add it to the end of RemainTimeList:

[0112] RemainTimeList=RemainTimeList+rt j

[0113] The embodiment of the present application also provides a network simulation example of a MANET network flood attack defense method:

[0114] Assume that the MANET simulation scenario contains 30 normal user nodes and 5 malicious nodes that generate forged RREQ packets, such as Figure 3 As shown in the figure, the simulation area is 100m×100m, in which all nodes move randomly, the node movement speed is constant at 10m / s, the upper limit of the single-hop communication distance between nodes is 40m, the transport layer uses the UDP protocol, and the data packet size is 1KB.

[0115] The default value of the RREQ_RATELIMIT parameter, as specified in the AODV RFC3561 standard, is 10. This means that any node is limited to a maximum of 10 RREQ packets per second. Malicious nodes can modify this value to a larger number. In accordance with the AODV RFC3561 standard, the RREQ_RATELIMIT of malicious nodes in the experiment is set to 30, the global time period Δt is set to 1 second, and the minimum warning threshold per second for normal nodes, mat, is set to 10. Assuming a total simulation time of 1 minute, only normal user nodes have the RFC3561 standard RREQ_RATELIMIT of 10. All malicious nodes begin generating forged RREQ packets at a constant rate of 30 packets / s at 20 seconds, continuously flooding the MANET.

[0116] The simulation results of the RREQ routing packet loss rate index are compared between the original AODV scheme and the proposed RREQ flood defense scheme. Figure 4 The malicious node starts flooding data packets at the th second, causing the loss rate of normal routing packets in the network to increase significantly. The method of the present application significantly reduces the loss rate of normal routing packets, ensuring the robustness and reliable performance of the network.

[0117] In the MANET network flood attack defense method of the present application, each node i counts the total number and source of RREQ packets received in each time interval and determines whether it is suffering from a flood attack. If so, it further calculates its own dynamic threshold dt i ; The number of forwarded RREQ packets tr j Greater than dt i Node j is added to the graylist GrayList i During this period, all data packets forwarded by the nodes in the gray list are directly discarded to avoid the negative impact of potential flooding attacks. After a period of time, the ban of node j in the gray list is lifted to allow node j to access the MANET again; when it is moved to the gray list, the isolation time st j (sealtime) increases exponentially as a penalty.

[0118] On the one hand, this method uses an adaptive dynamic threshold detection scheme for different network topology states, avoiding the use of promiscuous mode or the establishment of dedicated detection nodes, thereby reducing the additional packet communication load on the link. On the other hand, it implements a graylist sealing function with an exponentially increasing penalty time, improving the flexible trust mechanism of the mobile ad hoc network for nodes with a history of suspicious behavior and enhancing the self-recovery capability of the mobile ad hoc network.

[0119] An embodiment of the present application further provides a terminal device, including a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the aforementioned MANET network flood attack defense method are implemented.

[0120] The embodiment of the present application further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the aforementioned method for defending against flooding attacks on a MANET network are implemented.

[0121] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0122] The serial numbers of the above embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0123] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, computer, server or network device, etc.) to execute the methods described in each embodiment of the present application.

[0124] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of this application, ordinary technicians in this field can also make many forms without departing from the purpose of this application and the scope of protection of the claims, all of which are protected by this application.

Claims

1. A The network flood attack defense method is characterized by: The steps include: Pre-initialize the mobile ad hoc network ( ), where initialization is used to unify timestamp, and define The global shared parameters include the update time interval ; At each update interval Inside, Any node counts the received The total number of packets, if The total number of message data packets is higher than the normal message number threshold, and any node calculates its adaptive dynamic threshold; If any neighbor node of any node sends a If the number of message data packets exceeds the adaptive dynamic threshold, any node refuses to receive all data packets from any neighboring node; The calculation of the adaptive dynamic threshold by any node includes the following steps: Any node calculates the received The average number of message packets; Based on the Calculate the standard deviation of the mean of the number of message packets; Calculate the rate of change based on the mean and standard deviation of the previous moment; Based on the change rate and the Dynamic threshold for calculating the mean number of packets.

2. The method according to claim 1 The network flood attack defense method is characterized by: For the Any node configures a timer, which is set every Generate an event response signal; At each update interval Inside, Any node counts the received The total number of message packets includes: At any node exist After receiving the timer's event response signal, execute: Record update interval Received Total number of message packets, The source set of the message data packet, and the source set to any node Transmitted separately Number of packets.

3. The method according to claim 2 The network flood attack defense method is characterized by: For the Any node configures a time list, which records the remaining rejection time of the rejected neighbor nodes. exist After receiving the timer's event response signal, it also executes: Decrementing each remaining rejection duration in the time list to update the time list; and Resume receiving data packets from neighboring nodes whose remaining rejection time decreases to the set value.

4. The method according to claim 3 The network flood attack defense method is characterized by: Configure for any node The receiving queue of the data flow configures a gray list for any node, which records the rejected neighbor nodes. address, the method further comprising: Any node detects any one of the receiving queues The source node of the data packet Does the address belong to the gray list? If it does, reject it. If not, increment the received Number of message packets; determine any of the The source node of the data packet Does the address belong to the source set? If so, the corresponding source node The address statistics value increases, otherwise the corresponding source node is used Address updates the source set.

5. The method according to claim 4 The network flood attack defense method is characterized by: It also includes configuring a counting dictionary for any node, and the counting dictionary records all the nodes that are pulled into the gray list after any node is running. The number of times the address is incremented without deleting elements; The time list, the value of the remaining rejection time recorded is the same as the corresponding The number of times an address appears in the greylist increases exponentially.

6. The method according to claim 5 The network flood attack defense method is characterized by: If the number of RREQ message data packets sent by any neighboring node of any node to any node is higher than the adaptive dynamic threshold, the method further includes: The neighbor node The address is added to the grey list; Use the counting dictionary to determine whether there is a record of any neighbor node. If so, the record value is incremented. If not, a corresponding dictionary key value is added and assigned an initial value. The counting dictionary is queried for the statistical number of any neighbor node, and the corresponding remaining rejection time is assigned in the time list.

7. A terminal device, characterized in that: The invention comprises a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the invention realizes any one of claims 1 to 6. Steps in network flood attack defense method.

8. A computer-readable storage medium, characterized in that The computer readable storage medium stores a computer program, which, when executed by a processor, implements any one of claims 1 to 6. Steps in network flood attack defense method.

Images