A behavior feature-based internet of things node trust authentication method

Abstract

The application relates to a behavior feature-based trust authentication method for Internet of Things nodes, and belongs to the technical field of Internet of Things security. Firstly, the application uses the QoS metric of the node as a basis, extracts the behavior mode of the node, and constructs a node behavior feature model; then uses the constructed node behavior feature model to predict the future behavior of the node, calculates the error between the predicted behavior and the real behavior, and obtains the offset degree; finally, the comprehensive trust value of the node is calculated by combining the trust accumulation and the trust punishment mechanism. The application can directly determine whether the node is credible according to the trust degree calculated by using the offset degree, effectively avoids the defects that the current method cannot detect unknown or newly appeared attack paradigms and malicious codes; meanwhile, the method provided by the application transfers the operation from the node to the gateway, and the node does not need to bear any additional calculation overhead, thereby fundamentally avoiding the problem that the node resource is limited.

Description

TECHNICAL FIELD

[0001] The application relates to a behavior feature-based trust authentication method for Internet of Things nodes and belongs to the technical field of Internet of Things security. BACKGROUND

[0002] The Internet of Things (IoT) is a new type of Internet that connects "things" together using various technologies. The "things" in the Internet of Things often refer to different sensor devices that can collect, process and transmit different types of data in different environments. The Internet of Things can be combined with current cloud computing and big data technologies, and the collected data can be analyzed by using the computing power provided by cloud computing and big data analysis methods to achieve detection and prediction purposes.

[0003] Generally, the architecture of the Internet of Things is divided into three levels: the perception layer, the network layer and the application layer. As shown, different elements and functions are included in each level, and the IoT nodes in the perception layer are mainly responsible for collecting and exchanging data from the physical world and then transmitting the data to the network layer. Therefore, the security threat faced by the perception layer is mainly the access security of the IoT nodes, that is, how to ensure that the IoT nodes accessing the network are secure and reliable. The mainstream method currently used is to perform static authentication on the IoT nodes when they access the network, such as using a complex key management protocol or using an improved key distribution scheme to implement a public key cryptography authentication method; and detecting IoT nodes attacked or infected by malicious codes, such as using a machine learning method to detect IoT nodes in a wireless sensor network environment.

[0004] Although the above-mentioned scheme can achieve secure and reliable authentication of the perception nodes of the Internet of Things, it has certain defects: the cryptography-based method can provide high-level and provable security, but since the password operation needs to schedule a large amount of computing resources in a short time, the weak computing and storage performance and limited energy supply of the perception nodes make it difficult to widely apply the cryptography-based method; the machine learning-based method can effectively detect known attack behaviors and malicious codes in the IoT network, but it is powerless against unknown attack patterns and malicious codes. SUMMARY

[0005] The application aims to provide a behavior feature-based trust authentication method for Internet of Things nodes to solve the problem of large amount of computation and inability to effectively detect unknown attack patterns and malicious codes in the current trust authentication of Internet of Things nodes.

[0006] The application provides a behavior feature-based trust authentication method for Internet of Things nodes to solve the above technical problems, which comprises the following steps:

[0007] 1) using the QoS metric of the node as the basis, constructing a node behavior feature model;

[0008] 2) using the constructed node behavior feature model to predict the future behavior of the node, and calculating the error between the predicted behavior and the real behavior;

[0009] 3) calculating the deviation degree of the node according to the error distribution between the predicted behavior and the real behavior, determining the trust degree of the node by using the deviation degree of the node, and performing trust authentication on the node.

[0010] The application judges whether the node is in an abnormal state by calculating the deviation degree between the predicted behavior and the real behavior of the node, and if it is in an abnormal state, it may be due to the node being attacked, infected with malicious code, misoperation or network link failure, but no matter what kind of abnormal state, it will affect the reliability of the perception data obtained by the node, and the trust degree calculated by using the deviation degree can be directly used to judge whether the node is trustworthy. Therefore, the application no longer focuses on whether the node receives a specific form of attack or is infected with a known malicious code, which can effectively avoid the defect that the current method cannot detect unknown or newly emerging attack paradigms and malicious codes. At the same time, the method proposed by the application transfers the operation from the node to the gateway, and the node does not need to bear any additional calculation overhead, which fundamentally avoids the problem of limited node resources.

[0011] Further, the node behavior feature model in step 1) is trained by using an LSTM neural network, and the QoS metric data of the Internet of Things node in a set time period is used as training data during training.

[0012] The application uses an LSTM neural network to construct a node behavior feature model, which can accurately describe the change of the node behavior feature and further improve the accuracy of the node behavior prediction.

[0013] Further, the training data uses a node behavior matrix in a time window to represent:

[0014]

[0015] BEH node for the training data, wherein represents the jth QoS metric data of the ith time step node.

[0016] The application uses a node behavior matrix in a time window to describe the obtained QoS metric data in a set time period, which further improves the accuracy of data description.

[0017] Further, the QoS metric data includes hop count, delay and energy consumption.

[0018] Further, the calculation formula of the degree of deviation of the node in step 3) is as follows:

[0019]

[0020] wherein KL i is the degree of deviation of the ith time step node, σ1 2 is the error distribution parameter between the predicted behavior and the real behavior in the ideal case, σ2 2 is the error distribution parameter between the predicted behavior and the real behavior of the node in the actual case.

[0021] The present application takes the error distribution in the ideal case as the benchmark, and the distance between the real value and the ideal value represents the current state of the node, and the degree of deviation of the node is calculated using the KL divergence, so that the current state of the node can be accurately described.

[0022] Further, the parameter of the error distribution between the predicted behavior and the real behavior of the node is calculated by using the mean square error algorithm to calculate the error between the two, and the maximum likelihood estimation is used to estimate the parameter of the normal distribution.

[0023] Further, the calculation formula of the trust degree of the node is as follows:

[0024]

[0025] T i is the trust degree of the ith time step node, k is the penalty factor, and e is the natural constant.

[0026] The present application uses a trust accumulation mechanism and a trust penalty mechanism, wherein the trust accumulation mechanism is based on an exponential function and aims to ensure that the accumulation speed of the trust is slow, and the trust penalty mechanism uses a linear function based on a self-defined penalty factor to ensure that the trust degree value of the node is quickly reduced once the expected behavior of the node deviates greatly from the actual behavior, thereby avoiding the "self-promotion" attack initiated by a malicious node and further improving the security of the network.

[0027] Further, after the trust degree of the node in different time windows is calculated, the trust degree values of the different time windows are accumulated to obtain the current trust degree value of the node, and if the trust degree value is lower than a set threshold, the node is currently not trusted.

[0028] The present application uses the accumulated values of the trust degrees of the previous time windows as the trust degree of the current node, and can accurately determine whether the node is currently trustworthy. BRIEF DESCRIPTION OF DRAWINGS

[0029] Figure 1It is a principle diagram of a behavior feature-based trust authentication method for Internet of Things nodes in an embodiment of the application. DETAILED DESCRIPTION

[0030] The specific embodiments of the application will be further described below with reference to the accompanying drawings.

[0031] Unlike traditional identity authentication based on cryptography, the application proposes a behavior feature-based trust authentication method for Internet of Things nodes. The method first uses the QoS metric of a node as a basis to extract the behavior pattern of the node and construct a node behavior feature model; then uses the constructed node behavior feature model to predict the future behavior of the node and calculate the error between the predicted behavior and the real behavior; finally, in combination with the trust accumulation and trust punishment mechanisms, the comprehensive trust value of the node is calculated. The above calculation process includes two roles of nodes and gateways, wherein the nodes access the IoT network through the gateway, as shown in Figure 1 The specific implementation process of the method will be described in detail below.

[0032] 1. Using the QoS metric of a node as a basis, a node behavior feature model is constructed.

[0033] The gateway can capture the QoS metrics (such as hop count, delay, energy consumption, etc.) of all nodes connected thereto, and the metrics cover the behavior pattern of the node. The behavior pattern of the node can be used to further evaluate whether the state of the node is normal or stable. Therefore, an LSTM neural network capable of capturing time sequence features is used to construct a node behavior feature model to extract the time features and space features in the behavior pattern of the node from the QoS metrics, thereby completing the trust measurement of the node.

[0034] As shown in Figure 1 In the embodiment, nodes A, B and C are connected to the Internet of Things through a gateway. When A accesses the gateway, the gateway allows A to access the IoT network and starts collecting the QoS information of A. The QoS metric data at n time points with an interval of e within a certain time period is collected to form a node behavior matrix within a time window:

[0035]

[0036] The node behavior matrix BEH within the time window node as training data, i.e., the input and training data of the LSTM neural network, wherein represents the jth QoS metric data of the node at the ith time step. In the forward propagation of the neural network, a series of parameters need to be confirmed. For example, in the forward propagation of the forgetting gate:

[0037]

[0038] determining weight matrices W f (including weight matrices W t-1 accepting hidden layer outputs H Hf , weight matrices W t accepting inputs BEH BEHf , and weight matrices W t-1 accepting cell states C cf ) and bias vectors b f , during forward propagation of the input gate:

[0039]

[0040]

[0041]

[0042] determining weight matrices W i (including weight matrices W t-1 accepting hidden layer outputs H Hi , weight matrices W t accepting inputs BEH BEHi , and weight matrices W t-1 accepting cell states C ci ), W C (including weight matrices W t-1 accepting hidden layer outputs H HC and weight matrices W t accepting inputs BEH BEHC ), and bias vectors b i and b C , and further using the output f t of the forget gate, the output i t of the input gate, and the output of the tanh layer to update cell states C t . During forward propagation of the output gate:

[0043]

[0044]

[0045] In this way, weight matrices W o (including weight matrices W t-1 accepting hidden layer outputs H Ho , weight matrices W t accepting inputs BEH BEHo , and weight matrices W t-1 accepting cell states C co ) and bias vectors b o are determined. Finally, the output o tand the output of the tanh layer, to obtain a final output H t .

[0046] After the training of the neural network is completed, the parameters determined in the training process constitute the behavior characteristic model of the node.

[0047] When B and C access the gateway, the construction process of the behavior characteristic model of the B and C nodes is similar to that of the A node, except that the training data is the QoS measurement data of the corresponding node.

[0048] Finally, the behavior characteristic models of all nodes are saved in the gateway in the form of parameters.

[0049] 2. Using the constructed node behavior characteristic model to predict the future behavior of the node, and calculating the error between the predicted behavior and the real behavior.

[0050] After the model training is completed, the QoS information of each node is continuously collected in a time window, the behavior of each node is predicted using the behavior pattern model of the corresponding node, the future behavior of each node is obtained, and the mean square error algorithm is used to calculate the real behavior of the node, to obtain the error between them, when enough errors of the node are collected, the maximum likelihood estimation can be used to estimate the parameters of its normal distribution.

[0051] The present application uses the constructed node behavior pattern model to predict the future behavior of the node:

[0052] Pred t+1 = ConvLSTM (BEH 1,...,t )

[0053] When the real next step behavior BEH t+1 is obtained, the error between them can be calculated:

[0054]

[0055] The above error should obey the normal distribution with an expectation of 0, that is And when the node is in an abnormal state, the error probability distribution will be inconsistent with this distribution. The difference between the real value and the ideal value can be represented by the distance, which can represent the current state of the node.

[0056] Through the process, the error distribution of the A, B and C nodes can be counted for the present embodiment.

[0057] 3. Calculate the offset degree of the node, and determine the trust degree of the node by using the offset degree of the node, to perform trust authentication on the node.

[0058] The difference between the real value and the ideal value can be represented by a distance, which can represent the current state of the node, taking the error distribution in the ideal case as a reference The offset degree of the node is calculated using the KL divergence:

[0059]

[0060] The trust degree of node i is calculated based on the offset degree between the actual probability and the ideal probability of the node:

[0061]

[0062] The front half uses exponential operation to realize trust accumulation in trust iterative calculation, and the back half introduces a penalty measure, k is a penalty factor, which is used to avoid the node from hiding its current malicious behavior with historical accumulated trust, so as to realize slow increase and fast decrease of the trust degree.

[0063] The error distribution parameters σ2, σ3, … in a plurality of time windows are obtained, and the KL divergences KL 1,2 , 2,3 … between them are calculated. According to the KL divergence values obtained in different time windows, the trust degree values of node A in different time windows are calculated and saved in the node trust degree table of the gateway. The trust degree values in different time windows obtained in the accumulation are the current trust degree value of node A. If the trust degree value is lower than a pre-set threshold value, the connection between A and the IoT network is interrupted by the gateway (in Figure 1 , it is assumed that A has a communication failure, and the QoS information has a large deviation from the normal state).

[0064] The trust degree calculation of nodes B and C is the same as that of node A, which will not be described in detail here. Finally, the current trust degree values of nodes B and C are obtained, and whether to allow them to continue to access the IoT network is arbitrated. In Figure 1 , it is assumed that node B is attacked by malicious software, and the QoS state has changed greatly, so the connection needs to be interrupted; node C remains in a normal state, so the connection is maintained.

[0065] Compared with the node authentication method based on cryptography, the method proposed by the application transfers the operation from the node to the gateway, or can use the offline training and online detection mode, further transfers the training step with the largest consumption of computing resources to a computing platform or cloud platform with stronger performance, and the gateway only needs to use the trained model to predict the node behavior, and the node does not need to bear any additional computing overhead, because the method proposed by the application is completely transparent to the node, which fundamentally avoids the problem of limited node resources.

[0066] Compared with the node authentication method based on attack or malicious program detection, the method proposed by the application does not focus on whether the node receives a specific form of attack or is infected with a known malicious code, but judges whether the node is in an abnormal state by calculating the deviation between the predicted behavior and the real behavior of the node. This abnormal state may be due to the node being attacked, infected with malicious code, misoperation or network link failure, but no matter what abnormal state will affect the reliability of the perception data obtained by the node, so the node in abnormal state, that is, the trust degree calculated is lower than the threshold, is regarded as an untrusted node, which can effectively avoid the defect that the current method cannot detect unknown or newly emerging attack paradigm and malicious code.

Claims

1. A trust authentication method for IoT nodes based on behavioral characteristics, characterized in that, The method includes the following steps: 1) Using the QoS metric of the node as a basis, an LSTM neural network is used to construct a node behavior feature model; 2) Use the constructed node behavior feature model to predict the future behavior of nodes, and calculate the error between the predicted behavior and the actual behavior; 3) Calculate the degree of node offset based on the error distribution between predicted behavior and actual behavior, and use the degree of node offset to determine the trust level of the node, thereby performing trust authentication on the node. The formula for calculating the trust level of a node is as follows: ； T i Let KL be the trust level of the i-th time-order node. i is the offset of the i-th time node, k is the penalty factor, and e is the natural constant; Used to accumulate trust in the iterative calculation of trust value, k×KL i This is used to prevent nodes from using historically accumulated trust to mask their current malicious behavior; The formula used to calculate the offset of a node is: ； Where σ1 2 Let σ² be the error distribution parameter between the predicted behavior and the actual behavior under ideal conditions. 2 This refers to the error distribution parameters between the predicted behavior and the actual behavior of the node.

2. The IoT node trust authentication method based on behavioral characteristics according to claim 1, characterized in that, In step 1), the QoS measurement data of IoT nodes within a set time period is used as training data when training the LSTM neural network.

3. The IoT node trust authentication method based on behavioral characteristics according to claim 2, characterized in that, The training data is represented by a node behavior matrix within a time window: ； BEH node For training data, where This represents the j-th QoS metric data at the i-th time-order node.

4. The IoT node trust authentication method based on behavioral characteristics according to claim 1, characterized in that, The QoS metrics include hop count, latency, and power consumption.

5. The IoT node trust authentication method based on behavioral characteristics according to claim 1 or 2, characterized in that, The behavioral feature model of the node constructed in step 1) is stored in the gateway in the form of parameters.

6. The IoT node trust authentication method based on behavioral characteristics according to claim 5, characterized in that, The parameters of the error distribution between the node's predicted behavior and the actual behavior are calculated by using the mean squared error algorithm, and the parameters of its normal distribution are estimated by using maximum likelihood estimation.

7. The IoT node trust authentication method based on behavioral characteristics according to claim 1, characterized in that, The node behavior feature model adopts an offline training and online detection mode.

8. The IoT node trust authentication method based on behavioral characteristics according to claim 7, characterized in that, After calculating the trust level of a node in different time windows, the trust level values ​​of different time windows are accumulated to obtain the current trust level value of the node. If the trust level value is lower than the set threshold, the node is not currently trusted.

Images