Routing algorithm for black hole attack and route optimization in MANET

Abstract

The application relates to a routing algorithm for black hole attack and routing optimization in a MANET, which comprises two parts of malicious node detection S1 and routing optimization S2. When the malicious node detection is carried out, the difference between the behaviors of a malicious node and a safe node in the routing establishment stage of the black hole attack is used for judgment, and additional information of other nodes is not needed, that is, whether the node is a malicious node can be judged only by using the routing information returned by a next-hop node. A black and white list mechanism is used to improve the detection precision, reduce the false alarm rate and reduce the detection times. Meanwhile, when the routing optimization is carried out, the transmission path is optimized, when a next-hop node reaching a destination node is selected, the load state of the next-hop node and the hop number of the next-hop node to the destination node are considered, the load capacity of the transmission path is effectively improved, and the robustness of the network is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to an improved routing algorithm for anti-black hole attack and routing optimization for AODV protocol in mobile ad hoc network (MANET), in particular to a routing algorithm for anti-black hole attack and routing optimization in MANET. BACKGROUND

[0002] Mobile ad hoc network has dynamic topology, self-organization, multi-hop and other characteristics, and has become one of the popular research fields. AODV routing protocol is a widely used routing protocol in mobile ad hoc network, and because the nodes are secure by default and have no verification mechanism, it is easy to be attacked by black hole.

[0003] Current black hole detection techniques for AODV protocol can be roughly divided into schemes based on cryptography, listening, sequence number threshold, cross-layer verification, cross-checking, etc. However, these schemes cannot take into account single malicious node, multiple malicious nodes, network load, optimal next hop node selection and other problems. MBDP-AODV [1] is a black hole attack detection scheme for single malicious node in AODV protocol proposed by Gurung et al. It is based on the average value and standard deviation of the destination node sequence number returned by the secure node and the malicious node in the black hole attack to detect. When there is only a single malicious node in the network, this scheme can effectively detect the malicious node, but when there are multiple malicious nodes in the network, the detection accuracy of this scheme will be greatly reduced. Literature [2] is a black hole node detection algorithm proposed by Shrestha et al. It judges whether the information returned by the next hop node is real by modifying the destination node sequence number value. The advantage of this scheme is that it can effectively detect single malicious node and multiple malicious node scenarios, but it needs to send a large number of routing request data packets, increasing the network load. Literature [3] proposes to use the elliptic curve cryptography (ECC) algorithm to identify attackers. This scheme divides trust into three different trust levels, each of which identifies an attacker, but the disadvantage is that the calculation is complex, the energy consumption is large, and the optimal next hop node is not considered. Literature [4] is a detection scheme based on public and private key encryption proposed by Ndajah et al. This scheme uses an activity table, in which each node stores its identifier, RREQ message number and RREP message number. Each data packet is signed using the public key of all nodes in the network. Each time any node receives any message, it will increase the sequence number of the corresponding message, but the disadvantage is that it needs to pass additional control information, increasing the network load.

[0004] Most of the existing black hole attack detection schemes cannot balance the detection of malicious nodes and network load. Some schemes can effectively deal with the single malicious node scenario, but cannot solve the network environment with multiple malicious nodes. Moreover, some schemes detect after the black hole attack occurs, such as the listening mechanism, which detects by listening to the malicious node packet loss, and cannot effectively detect malicious nodes before the black hole attack occurs, which also causes the decline of network performance. At the same time, most of the current detection schemes only consider the detection of malicious nodes, without considering the optimization of routing.

[0005] References:

[0006] [1]Gurung S,Chauhan S.A dynamic threshold based approach formitigating black-hole attack in MANET[J].Wireless Networks,2018,24(8):2957-2971.

[0007] [2]Shrestha S,Baidya R,Giri B,et al.Securing Blackhole Attacks inMANETs using Modified Sequence Number in AODV Routing Protocol[C] / / 2020 8thInternational Electrical Engineering Congress(iEECON).2020.

[0008] [3]Singh O,Singh J,Singh R.Multi-level trust based intelligenceintrusion detection system to detect the malicious nodes using elliptic curvecryptography in MANET[J].Cluster Computing,2018,21(1):51-63.

[0009] [4] Ndajah P, Matine A.O, Hounkonnou M.N. Blackhole attack prevention in wireless peer to peer networks: A new strategy [J]. International Journal of Wireless Information Networks. 2019, 26, 48-60 SUMMARY

[0010] The present application aims to provide a routing algorithm for black hole attack and routing optimization in MANET, to solve the problem that existing black hole attack detection methods cannot consider malicious node detection and network load.

[0011] The present application is implemented as follows: a routing algorithm for black hole attack and routing optimization in MANET, comprising two parts of malicious node detection S1 and routing optimization S2.

[0012] The malicious node detection S1 comprises the following steps.

[0013] S11. When node A sends RREQ packet to node B, the current known maximum destination node sequence number, current time, source node ip address, id of RREQ packet and RREQ expiration time are stored in RREQ message list.

[0014] S12. When node B receives RREQ packet, node B returns RREP response packet, and node A receiving RREP response packet judges whether the ip address of node B returning RREP is in the local whitelist, if it exists, routing optimization is performed, if it does not exist, the destination node sequence number in the RREP response packet returned by node B and the destination node sequence number saved by node A are compared, when they are consistent, it represents that node B is a safe node, and the ip address of node B is saved to the whitelist by node A.

[0015] S13. When the destination node sequence number in the RREP response packet returned by node B and the destination node sequence number saved by node A are inconsistent, node A checks whether the ip address of node B is in the local blacklist, when the ip address of node B exists in the blacklist list of node A, and node B is a malicious node, the RREP response packet returned by node B is discarded, if it does not exist or the ip address of node B exists in the blacklist but node B belongs to a suspected node, the destination node sequence number change rate R of node B is calculated.

[0016] S14. When the R value of the node B is greater than the set threshold value and the hop count of the node B to the destination node is equal to 2, the node A adds the node B to the blacklist, and when at least one of the two conditions that the R value of the node B is not greater than the threshold value or the hop count of the node B to the destination node is not 2 is met, the node A judges the node B as a safe node.

[0017] The route optimization S2 comprises the following steps.

[0018] S21. When the node A determines the node B as a safe node, the node A takes the weight value of the node B from the RREP packet and assigns the value in the RREP response packet. At this time, the node A selects according to the information in the routing table. If the routing table of the node A does not exist the route to the destination node, the node B is set as the next hop node to the destination node. If the routing table of the node A exists the next hop node to the destination node, the node A compares the weight value of the next hop node in the routing table with the weight value of the node B. When the weight value of the node B is less than the weight value of the next hop node in the routing table, the node A takes the node B as the next hop node and saves the weight value of the node B. Otherwise, when the weight value of the node B is greater than or equal to the weight value of the next hop node in the routing table, the node A discards the RREP response packet returned by the node B and still uses the original route.

[0019] The calculation formula of the change rate of the sequence number of the destination node is:

[0020]

[0021] Wherein, RREPseqId represents the sequence number of the destination node in the RREP response packet received by a node, RREQseqId represents the sequence number of the destination node in the RREQ request packet corresponding to the RREP response packet, RREPreceiveTime represents the time when the node receives the corresponding RREP response packet, and RREQreceiveTime is the time when the node sends the RREQ request packet.

[0022] The calculation formula of the weight value of the node B is:

[0023]

[0024] Wherein, queue_length B queue_length represents the queue length of the currently buffered data of the node B, queue_length represents the maximum queue length of the buffered data of a node, and the ratio of the two represents the use degree of the buffered queue of the node B. k represents the hop count from the node B to the destination node.

[0025] In step S14, if the node A judges the node B as a safe node, the node B is deleted from the blacklist and added to the whitelist if the node B's ip address exists in the blacklist of the node A; the node B is directly added to the whitelist if the node B's ip address does not exist in the blacklist.

[0026] In step S14, if the node A adds the node B's ip address to the blacklist, the node B is changed to a malicious node state if the node B's information exists in the local blacklist and the state is a suspicious node state, and the RREP response packet returned by the node B is discarded; the node B's ip address is added to the local blacklist and the state of the node B is set as a suspicious node state if the node B's ip address does not exist in the local blacklist, and the RREP response packet returned by the node B is discarded.

[0027] The node A is a source node or an intermediate node, and the node B is an intermediate node.

[0028] In step S14, the threshold value is 0.5.

[0029] The application judges the difference between the behaviors of the malicious node and the safe node in the routing establishment stage of the black hole attack, does not need additional information of other nodes, and only uses the routing information returned by the next hop node to judge whether it is a malicious node. When multiple malicious nodes exist in the network, the application only needs to detect the returned information of the node to be detected, does not need to combine the returned information of other nodes to detect, can avoid the joint black hole attack of multiple malicious nodes, and realizes effective detection in single malicious node environment and multiple malicious node environment. The use of the blacklist and whitelist mechanism can also improve the detection accuracy, reduce the false positive rate, and reduce the detection frequency. Meanwhile, the transmission path is optimized, the load state of the next hop node and the hop number of the next hop node to the destination node are considered when the next hop node to the destination node is selected, the load capacity of the transmission path is effectively improved, and the robustness of the network is improved. BRIEF DESCRIPTION OF DRAWINGS

[0030] Figure 1 is a flowchart of the application.

[0031] Figure 2 is a black hole detection algorithm of the application.

[0032] Figure 3 is a comparison diagram of the average throughput of the application and the prior art under different data stream numbers.

[0033] Figure 4 is a comparison diagram of the data packet delivery rate of the application and the prior art under different data stream numbers.

[0034] Figure 5is a comparison chart of detection accuracy of the present application and prior art under different data flow numbers.

[0035] Figure 6 is a comparison chart of average throughput of the present application and prior art under different malicious node numbers.

[0036] Figure 7 is a comparison chart of data packet delivery rate of the present application and prior art under different malicious node numbers.

[0037] Figure 8 is a comparison chart of detection accuracy of the present application and prior art under different malicious node numbers. DETAILED DESCRIPTION

[0038] As shown in Figure 1 the present application is directed to a routing algorithm for black hole attack and routing optimization in MANET, which includes two parts of malicious node detection S1 and routing optimization S2.

[0039] The malicious node detection S1 includes the following steps.

[0040] S11. When node A sends RREQ packet to node B, the current known maximum destination node sequence number, current time, source node ip address, id of RREQ packet and RREQ expiration time are stored in RREQ message list.

[0041] S12. When node B receives RREQ packet, node B returns RREP response packet, and node A receiving the RREP response packet judges whether the ip address of node B returning RREP is in the local whitelist, if exists, executes routing optimization, if not exists, compares the destination node sequence number in the RREP response packet returned by node B with the destination node sequence number saved in node A locally, when the two are consistent, it represents that node B is a safe node, and node A saves the ip address of node B to the whitelist.

[0042] S13. When the destination node sequence number in the RREP response packet returned by node B and the destination node sequence number saved in node A locally are not consistent, node A checks whether the ip address of node B is in the local blacklist. When the ip address of node B exists in the blacklist list of node A, and node B is a malicious node, the RREP response packet returned by node B is discarded; if not exists or the ip address of node B exists in the blacklist but node B belongs to a suspected node, the destination node sequence number change rate R of node B is calculated.

[0043] The calculation formula of the destination node sequence number change rate is:

[0044]

[0045] Wherein, RREPseqId represents the sequence number of the destination node in the RREP response packet received by a node, RREQseqId represents the sequence number of the destination node in the RREQ request packet corresponding to the RREP response packet, RREPreceiveTime represents the time when the node receives the corresponding RREP response packet, and RREQreceiveTime is the time when the node sends the RREQ request packet.

[0046] S14. When the R value of node B is greater than the set threshold value and the hop number of node B to the destination node is equal to 2, node A adds the ip address of node B to the blacklist; when at least one of the two conditions that the R value of node B is not greater than the threshold value or the hop number of node B to the destination node is not 2 is established, node A judges node B as a safe node.

[0047] Wherein, when node A adds the ip address of node B to the blacklist, if the ip address of node B already exists in the local blacklist and the state is the suspicious node state, node B is changed to the malicious node state, and the RREP response packet returned by node B is discarded; if the ip address of node B does not exist in the local blacklist, the ip address of node B is added and the state of node B is set as the suspicious node state, and the RREP response packet returned by node B is discarded.

[0048] When node A judges node B as a safe node, if the ip address of node B exists in the blacklist of node A, the ip address of node B is deleted from the blacklist and added to the whitelist; if the ip address of node B does not exist in the blacklist, the ip address of node B is directly added to the whitelist.

[0049] The route optimization S2 includes the following steps.

[0050] S21. When node A determines that node B is a safe node, node A takes the weight value of node B from the RREP packet and assigns the value in the RREP response packet. At this time, node A selects according to the information in the routing table. If the routing table of node A does not exist to the destination node, node B is set as the next hop node to the destination node. If the routing table of node A exists to the destination node, node A compares the weight value of the next hop node in the routing table with the weight value of node B. When the weight value of node B is less than the weight value of the next hop node in the routing table, node A takes node B as the next hop node and saves the weight value of node B. Otherwise, when the weight value of node B is greater than or equal to the weight value of the next hop node in the routing table, node A discards the RREP response packet returned by node B and still uses the original route.

[0051] The weight value calculation formula of node B is:

[0052]

[0053] wherein, queue_length B queue_length represents the queue length of the data currently buffered by the node B, queue_length represents the queue length of the data currently buffered by the node B,

[0054] In step S14 of the present application, the threshold value is selected as 0.5, and the threshold value is obtained through experiments.

[0055] For the selection of the threshold value in the present application, first, a malicious node and multiple malicious nodes are randomly selected in different experimental environments, and then the destination node sequence number change rate of these malicious nodes is calculated and counted to obtain the destination node sequence number change rate distribution of the malicious nodes, and the minimum value of the destination node sequence number change rate of each malicious node is recorded. Through thousands of experiments, the minimum value of the destination node sequence number change rate of the malicious nodes is 0.9.

[0056] Then, in the same experimental environment, only the threshold value and the malicious node are changed, and the average throughput, average packet delivery rate, and detection accuracy of the experiment are recorded. The threshold value selected in the experiment is 0, 0.1, 0.3, 0.5, 0.7, 0.9, 1, 1.2, 1.3, 1.5, 1.7, 1.9, 2, 3, 4, 5, 6, 7, 8, 9, 10, 20, 30, 40, 50, 60, 70, 80, 90, 100. Each threshold value is tested 50 times, and the average value is taken. Then, the experimental environment is changed, and the above threshold detection process is repeated in the new experimental environment. Through a large number of experiments, it is shown that when the threshold value is 0.5, the DSCR-AODV protocol has the best detection effect.

[0057] In the present application, node A is a source node or an intermediate node, and node B is an intermediate node.

[0058] The nodes are divided into secure nodes and malicious nodes, and all nodes have the same physical characteristics. The source node and the destination node are trusted, but the intermediate node is not trusted.

[0059] Secure node: can be a source node, intermediate node, and destination node. When receiving the RREQ request packet of other nodes, if there is a valid route to the destination node, a RREP response packet with RREQ id and its own weight value will be returned.

[0060] Malicious node: can only be used as an intermediate node. When receiving the RREQ request packet of other nodes, a RREP response packet with RREQ id and its own weight value is also returned, but in the response packet, the destination node sequence number is set to a larger value, and the hop number to the destination node is set to 1.

[0061] When the malicious node detection is performed, each node newly creates three tables, namely a RREQ message list (table 1), a white list (table 2) and a black list (table 3).

[0062] Table 1 RREQ message list

[0063]

[0064] Table 2 white list

[0065]

[0066] Table 3 black list

[0067]

[0068] In order to verify the present application, a network environment is realized by using an NS-3 network simulation simulator to perform experiments, the experimental nodes are fixed as 50, the experimental running time is 200s, the experimental range is 1000m*1000m, the transmission range of each node is 250m, the mobile model of each node is Random waypoint, the channel bandwidth is set as 2Mbs, the flow type is CBR, the node moving speed is fixed as 5m / s, the source node transmits 512 byte data packets at a fixed rate of 4 data packets per second on a randomly selected target node. The present application is compared with the prior art by changing the number of data streams and the number of malicious nodes: (1) when the number of malicious nodes is fixed as 1, the number of data streams is 5, 10, 15 and 20 respectively; (2) when the number of data streams is 5, the number of malicious nodes is 2, 4, 6, 8 and 10 respectively. Each experimental condition is performed for 50 times, and the average value is taken.

[0069] The present application shows the algorithm effect by the average throughput, the average data packet delivery rate and the detection accuracy in the network, wherein the formula of the average throughput is:

[0070]

[0071] Wherein, N is the number of experiments, PRi is the number of data packets received by the destination node from node i, Psz is the size of the data packet, Sp is the start time of the experiment, and ST is the end time of the experiment.

[0072] The formula of the average data packet delivery rate is:

[0073]

[0074] where N is the number of experiments, PRi is the number of data packets received by the destination node from node i, and PSi is the number of data packets sent by node i.

[0075] The formula for average detection accuracy is

[0076]

[0077] where N is the number of experiments, RMi is the number of real malicious nodes detected by node i, and Mi is the total number of malicious nodes detected by node i.

[0078] The present application is compared with the AODV protocol without malicious nodes, the AODV protocol with malicious nodes and no detection mechanism (BAODV), and the MBDP-AODV protocol proposed by Gurung et al.

[0079] The experimental results are shown in Figures 3 to 8

[0080] As can be seen from Figure 3 , with the increase of data flow, the average throughput in the AODV protocol without malicious nodes and the DSCR-AODV protocol with only one malicious node decreases slightly, but the decrease is not large, the average throughput of AODV changes in the range of 15.04 kbps-15.69 kbps, and the average throughput of DSCR-AODV changes in the range of 14.72 kbps-15.24 kbps, both of which always maintain an error of less than 0.32 kbps. For the MB-DP-AODV protocol, its average throughput changes in the range of 12.46 kbps-14.29 kbps. When the AODV protocol is used and there is one malicious node (BAODV), the average throughput changes in the range of 9.36 kbps-10 kbps.

[0081] ​For AODV protocol and DSCR-AODV protocol, with the increase of data flow, the data packets to be transmitted in the node increase, resulting in the decline of average throughput caused by congestion, not the protocol itself or the attack of malicious node. This shows the effectiveness of DSCR-AODV protocol. However, when facing fewer data flows, MBDP-AODV protocol has better effect, but with the increase of data flow, its average throughput will decrease significantly. The reason for this phenomenon is that the protocol does not mark the destination node sequence number of each data flow, and when there are multiple data flows in the network, the detection method relying on the change of average value and variance to distinguish malicious nodes and normal nodes is unreliable. With the increase of data flow, MBDP-AODV protocol will cause more false positives, which leads to more data unable to be transmitted to the destination node. For BAODV, the reason for its slight increase in average throughput is that more data flows result in more traffic not passing through the malicious node, thereby slightly increasing, but there is no significant change.

[0082] In Figure 4 When the number of data flows changes from 5 to 20, the data packet delivery rate of AODV protocol decreases from 92.7% to 88.1%, and the data packet delivery rate of DSCR-AODV protocol decreases from 89.3% to 86.9%. The reason for the slight decrease of both is consistent with the reason for the decrease of average throughput, because too much data flow causes network congestion, thereby causing a slight decrease of both, but we can still see that the difference between them is very small. When BAODV protocol is used, the data packet delivery rate in the network is 50.3%, 55.2%, 54.7% and 57% respectively when the number of data flows is 5, 10, 15 and 20. Through the comparison of AODV protocol, BAODV protocol and DSCR-AODV protocol, we can know that when the data flow increases, DSCR-AODV protocol will cause a slight decrease in data packet delivery rate, but the difference between AODV protocol and DSCR-AODV protocol is basically within 3.4%, and the data packet delivery rate of DSCR-AODV protocol is 30%-40% higher than that of BAODV protocol. This also shows that when there is a malicious node in the network, DSCR-AODV protocol can effectively detect the malicious node and prevent its attack, and DSCR-AODV protocol has little effect on the network state under multiple data flows, and still maintains the approximate level of AODV protocol.

[0083] For MBDP-AODV protocol, when the number of data flow is 5, 10, 15, 20, the data packet delivery rate is 72.6%, 60.9%, 60.6% and 57% respectively. Analysis can know that the reason that the data packet delivery rate of MBDP-AODV protocol suddenly drops 11.7% when the data flow changes from 5 to 10 is that more normal nodes are misreported, which also causes more packet loss. When the data flow continues to increase, the data packet delivery rate does not decrease sharply because enough normal nodes have been misreported and the remaining normal nodes are not misreported. This can be seen from the following table. Figure 5 It can be obtained.

[0084] Figure 5 The detection accuracy of DSCR-AODV protocol and MBDP-AODV protocol under different data flows is shown. The reason that the difference between the two is so large is that DSCR-AODV protocol not only considers malicious nodes, but also considers normal nodes. Because the R value of malicious nodes cannot be 0, and DSCR-AODV protocol uses 2-time verification, it can effectively avoid that normal nodes are considered as malicious nodes because of accidental increase of destination node sequence number. For malicious nodes, because their R value is much larger than that of normal nodes in most cases, 2-time verification can effectively detect malicious nodes and avoid normal nodes.

[0085] In Figure 6 , under different numbers of malicious nodes, the average throughput of DSCR-AODV protocol is 15.43kbps, 15.48kbps, 15.6kbps, 15.3kbps, 15.11kbps. The average throughput of MBDP-AODV protocol is 13.68kbps, 12.62kbps, 11.4kbps, 11.4kbps, 10.42kbps, and the average throughput of BAODV protocol is 9.43kbps, 7.51kbps, 7.6kbps, 7.52kbps, 7kbps.

[0086] From the data analysis, it can be seen that with the increase of malicious nodes, the average throughput under DSCR-AODV protocol does not change much, while the average throughput under MBDP-AODV protocol decreases significantly with the increase of malicious nodes. The reason for the difference between the two is that DSCR-AODV protocol is detected based on R value, so the detection efficiency of DSCR-AODV protocol does not change with the change of the number of malicious nodes. However, MBDP-AODV protocol is based on the average value and variance of the sequence number of the destination node returned by multiple RREPs for detection, which leads to the failure of MBDP-AODV protocol detection when the number of malicious nodes in the network increases. In addition, through the comparison of DSCR-AODV protocol and BAODV protocol under multiple malicious nodes, it can be seen that when there are multiple malicious nodes in the network, DSCR-AODV protocol can effectively improve the average throughput of the network.

[0087] In Figure 7 , we compared the packet delivery rate under different number of malicious nodes. Similar to the average throughput, DSCR-AODV protocol maintains a high packet delivery rate under different number of malicious nodes. When there are 6 malicious nodes, DSCR-AODV has the highest packet delivery rate of 91.7%, and when there are 10 malicious nodes, DSCR-AODV protocol detects the lowest packet delivery rate of 88%. In the network using DSCR-AODV protocol, the packet delivery rate remains stable and does not change significantly with the change of the number of malicious nodes. In contrast, the packet delivery rate of MBDP-AODV is the highest when there are 2 malicious nodes in the network, with a value of 65.8%, and the lowest when there are 10 malicious nodes in the network, with a value of 53.9%. It can be seen that the packet delivery rate of MBDP-AODV protocol decreases significantly with the increase of the number of malicious nodes, and when there are the same number of malicious nodes, the packet delivery rate of DSCR-AODV protocol is about 30% higher than that of MBDP-AODV protocol. This also shows that DSCR-AODV protocol is superior to MBDP-AODV protocol in the network environment with multiple malicious nodes.

[0088] Through the comparison of DSCR-AODV protocol and BAODV protocol, it can be seen that the detection of DSCR-AODV is effective. When the number of malicious nodes increases in the network, without detection mechanism, only using AODV protocol (BAODV), the packet delivery rate of the network decreases significantly and the packet loss rate increases significantly. In the network using DSCR-AODV, the packet delivery rate is significantly higher than that of BAODV, and does not decrease with the increase of malicious nodes.

[0089] Figure 8 It is illustrated that even as the number of malicious nodes increases, the detection accuracy of the DSCR-AODV protocol remains at a high level, which is 98.4%, 99.8%, 99.7%, 100% and 100% respectively. Although the detection accuracy of the MBDP-AODV protocol increases as the number of malicious nodes increases, it is still much lower than that of the DSCR-AODV protocol. The reason for the increase in the detection accuracy of the MBDP-AODV protocol is that in a fixed time, the number of malicious nodes detected by each normal node (including false positives of normal nodes) is fixed. When the number of malicious nodes in the network increases, the probability of normal nodes detecting malicious nodes also increases, thus causing the false positive rate to decrease (the total number of detection times remains unchanged), thereby increasing the detection accuracy. However, when using the MBDP-AODV protocol, the average throughput and packet delivery rate do not increase with the increase in detection accuracy. The reason is that although the detection accuracy has increased, it is not proportional to the increase in the number of malicious nodes, that is, when there are 10 malicious nodes in the network, even if 5 malicious nodes can be detected, the remaining 5 malicious nodes will still cause a large number of packet loss and damage the network state. The DSCR-AODV protocol can keep the detection accuracy at about 100%, which makes each node effectively avoid using malicious nodes, thereby improving the network state.

[0090] The application is an improved AODV routing algorithm (DSCR-AODV), and a new detection parameter (destination node sequence number change rate) is proposed according to the difference between the behaviors of normal nodes and malicious nodes when a black hole attack occurs. The destination node sequence number change rate can accurately distinguish between normal nodes and malicious nodes, but when there are frequent route disconnections and connections in the network, there is still a certain false positive rate. Therefore, this paper proposes a blacklist and whitelist and a secondary detection mechanism, which records normal nodes and malicious nodes and detects abnormal nodes multiple times, thereby improving the detection accuracy of black hole attacks. In addition, most of the previous security schemes do not consider the problem of route optimization, and the DSCR-AODV protocol considers the node load and hop count to the destination node when establishing a route, and optimizes the network transmission route by selecting the weight value of the next hop node. Through comparison with the MBDP-AODV protocol, it is verified that the DSCR-AODV protocol can detect malicious nodes when there is one malicious node or multiple malicious nodes, and maintain a high average throughput and packet delivery rate in the network.

[0091] The application judges the difference between the behaviors of the malicious node and the safe node in the route establishment stage of the black hole attack, does not need additional information of other nodes, and can judge whether it is a malicious node only by using the route information returned by the next hop node. When there are multiple malicious nodes in the network, because the application only needs to detect according to the return information of the node to be detected, and does not need to detect in combination with the return information of other nodes, the joint black hole attack of multiple malicious nodes can be avoided, and effective detection of single malicious node environment and multiple malicious node environment is realized. Moreover, the use of black and white list mechanism can also improve the detection accuracy, reduce the false positive rate and reduce the detection frequency. At the same time, the transmission path is optimized, when selecting the next hop node to the destination node, both the load state of the next hop node and the hop number from the next hop node to the destination node are considered, the load capacity of the transmission path is effectively improved, and the robustness of the network is improved.

Claims

1. A routing algorithm against black hole attack and route optimization in MANET, characterized in that, The method comprises two parts: malicious node detection S1 and route optimization S2. The malicious node detection S1 comprises the following steps: S11. When node A sends a RREQ packet to node B, the current known maximum destination node sequence number, current time, source node IP address, RREQ packet ID and RREQ expiration time are stored in the RREQ message list; S12. When node B receives the RREQ packet, node B returns a RREP response packet, and node A receiving the RREP response packet judges whether the IP address of node B returning the RREP is in the local whitelist. If yes, route optimization is performed; if not, the destination node sequence number in the RREP response packet returned by node B is compared with the destination node sequence number stored in node A. When the two are consistent, it means that node B is a safe node, and the IP address of node B is saved to the whitelist in node A; S13. When the destination node sequence number in the RREP response packet returned by node B is inconsistent with the destination node sequence number stored in node A, node A checks whether the IP address of node B is in the local blacklist. When the IP address of node B exists in the blacklist of node A, and node B is a malicious node, the RREP response packet returned by node B is discarded. If not, or the IP address of node B exists in the blacklist but node B is a suspicious node, the destination node sequence number change rate R of node B is calculated; S14. When the R value of node B is greater than a set threshold value and the hop count of node B to the destination node is equal to 2, the IP address of node B is added to the blacklist in node A. When at least one of the two conditions that the R value of node B is not greater than the threshold value or the hop count of node B to the destination node is not 2 is established, node B is judged as a safe node; The route optimization S2 comprises the following steps: S21. When node A determines that node B is a safe node, the weight value of node B is taken out from the RREP packet and is assigned in the RREP response packet. At this time, node A selects according to the information in the routing table. If there is no route to the destination node in the routing table of node A, node B is set as the next hop node to the destination node. If there is a next hop node to the destination node in the routing table of node A, node A compares the weight value of node B with the weight value of the next hop node in the routing table. When the weight value of node B is less than the weight value of the next hop node in the routing table, node A takes node B as the next hop node and saves the weight value of node B. Otherwise, when the weight value of node B is greater than or equal to the weight value of the next hop node in the routing table, node A discards the RREP response packet returned by node B and still uses the original route.

2. The routing algorithm against black hole attack and route optimization in MANET as claimed in claim 1 wherein, The formula for calculating the destination node sequence number change rate is: ； Wherein, RREPseqId represents the sequence number of the destination node in the RREP response packet received by a node, RREQseqId represents the sequence number of the destination node in the RREQ request packet corresponding to the RREP response packet, RREPreceiveTime represents the time when the node receives the corresponding RREP response packet, and RREQreceiveTime is the time when the node sends the RREQ request packet.

3. The routing algorithm against black hole attack and route optimization in MANET as claimed in claim 1 wherein, The weight value calculation formula of the node B is: ； wherein, denotes the queue length of data currently buffered by the node B, denotes the maximum queue length of buffered data for a node, and k denotes the number of hops from the node B to the destination node.

4. The routing algorithm against black hole attack and route optimization in MANET as claimed in claim 1 wherein, In step S14, after judging that the node B is a safe node, if the node A has the ip address of the node B in the blacklist, the node A deletes the ip address of the node B from the blacklist and adds the ip address of the node B to the whitelist; if the node A does not have the ip address of the node B in the blacklist, the node A directly adds the ip address of the node B to the whitelist.

5. The routing algorithm against black hole attack and route optimization in MANET as claimed in claim 1 wherein, In step S14, when the node A adds the ip address of the node B to the blacklist, if the ip address of the node B already exists in the local blacklist and the status is a suspicious node status, the node B is changed to a malicious node status, and the RREP response packet returned by the node B is discarded; if the ip address of the node B does not exist in the local blacklist, the ip address of the node B is added to the local blacklist and the status of the node B is set as a suspicious node status, and the RREP response packet returned by the node B is discarded.

6. The routing algorithm against black hole attack and route optimization in MANET as claimed in claim 1 wherein, The node A is a source node or an intermediate node, and the node B is an intermediate node.

7. The routing algorithm against black hole attack and route optimization in MANET as claimed in claim 1 wherein, In step S14, the threshold value is 0.5.

Images