A sensor network data security detection system

Abstract

The application discloses a kind of sensor network data security detection systems, it is related to sensor network security detection technical field, by setting network attack collection module, the basic information of network attack in sensor network is collected in advance, and network attack is divided into single node detection class and regional detection class;Setting node security detection module in each sensor node, detecting single node detection class network attack;Setting regional security detection module in each sensor connected wireless base station in cluster, real-time detection regional detection class network attack;Setting node reputation rating module is for each sensor node and the reputation rating of each sensor connected wireless base station in cluster;Setting host security rating module calculates the probability of network attack in host end;Reduce the interference of malicious node to detection result and the possibility of network attack false alarm.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of network security, and relates to data security detection technology, in particular to a sensor network data security detection system. BACKGROUND

[0002] The sensor network is a self-organizing distributed network system composed of a large number of micro-sensor nodes with sensing, computing and communication capabilities.

[0003] Due to the characteristics of the sensor network such as non-uniform technical standards, network self-organization and unreliable communication, the sensor network is extremely vulnerable to external attacks. The network attack means is also various, such as congestion attack, DDOS attack, replay attack, flooding attack and Byzantine attack. The detection methods for each attack means are also different. Some network attacks can be detected in a single sensor node, such as fake attack. Some network attacks need to be detected by multiple sensor nodes in the region, such as DDOS attack.

[0004] At present, most detection systems are mainly used for detecting single network attack, or fail to consider the existence of malicious nodes in the sensor network, or fail to consider the network attack false alarm, which wastes a lot of computing resources.

[0005] Therefore, a sensor network data security detection system is proposed. SUMMARY

[0006] The present application aims to at least solve one of the technical problems existing in the prior art. For this purpose, the present application proposes a sensor network data security detection system which comprehensively considers two types of network attack methods of single node detection and regional detection, and adopts a weighted probability calculation method for network attack information sent by each sensor node and wireless base station, thereby reducing the interference of malicious nodes on the detection result and the possibility of network attack false alarm.

[0007] To achieve the above-mentioned purpose, according to the first aspect of the embodiment of the present application, a sensor network data security detection system is provided, which comprises a network attack collection module, a node security detection module, a regional security detection module, a node reputation rating module and a host security rating module. Each module is connected by electrical means.

[0008] The network attack collection module is mainly used for pre-collecting the basic information of network attacks in the sensor network.

[0009] The basic information of the network attack includes the name of the discovered network attack, the characteristics of the network attack and the detection procedure corresponding to the network attack in the sensor network; and the network attack is classified according to the detection method corresponding to the network attack; specifically, the network attack is classified into single-node detection and regional detection; the network attack collection module sends the collected basic information of the network attack to the node security detection module and the regional security detection module according to the type of the network attack;

[0010] The node security detection module is mainly used for detecting the single-node detection type network attack in each sensor node.

[0011] The node security detection module includes all detection procedures for detecting the single-node detection type network attack installed in each sensor node; each detection procedure detects the characteristics of the data packet received by the sensor node in real time according to the corresponding procedure function, judges whether the network attack occurs according to the characteristics of the data packet, and sends the attack information of the occurred network attack to the host security rating module; the characteristics of the data packet can include but are not limited to the sender of the data packet, the receiving speed of the data packet, the content of the data packet and the identity authentication information of the data packet; the attack information can include but are not limited to the network attack mode, the data packet sending address, the data packet destination address and the network attack intensity; preferably, the network attack intensity is evaluated by the detection procedure according to the actual intensity of the network attack, and different network attack modes adopt different intensity evaluation standards.

[0012] The regional security detection module is mainly used for detecting the regional detection type network attack in each wireless base station connected to the sensor in the cluster in real time.

[0013] The regional security detection module includes all detection procedures for detecting the regional detection type network attack installed in each wireless base station connected to the sensor; each detection procedure acquires the characteristics of the data packet received by the sensor in the cluster in real time according to the corresponding procedure function; and judges whether the network attack occurs according to the characteristics of the received data packet, and sends the attack information of the occurred network attack to the host security rating module; preferably, the attack information includes the attack mode, the sensor address of the abnormal data packet, the abnormal data packet content, the abnormal data packet receiving speed and the network attack intensity.

[0014] The node reputation rating module is mainly used for reputation rating of each sensor node and each wireless base station connected to the sensor in the cluster.

[0015] The node reputation rating module rates the reputation of each sensor node in the cluster through the wireless base station; specifically, the way of rating the reputation of the sensor is: according to the data forwarding characteristics of each sensor node in the cluster, the probability of each sensor node being a malicious node is calculated; preferably, the data forwarding characteristics include data packet forwarding speed, the proportion of abnormal data packets, and the number of next-hop sensors of data packet forwarding data packets; each sensor node is marked as i; the probability of sensor i being a malicious node is marked as Pi;

[0016] The node reputation rating module rates the reputation of other wireless base stations through the wireless base station; specifically, the way of rating the reputation of the wireless base station is: after each wireless base station or the sensors included in the sensor cluster of the base station detects a network attack, the last-hop wireless base station of the network attack data packet is obtained; and according to the traffic characteristics of the network attack traffic packet sent by the wireless base station, the probability of the last-hop wireless base station being a malicious base station is calculated; each wireless base station is marked as s, and the last-hop wireless base station is marked as t; then the reputation rating of the wireless base station s to the last-hop wireless base station t is marked as Pst;

[0017] Each wireless base station s sends the malicious node probability Pi of each sensor i in its sensor cluster and the reputation rating Pst of the last-hop wireless base station t to the host security rating module in real time;

[0018] The host security rating module is mainly used for calculating the probability of a network attack occurring at the host end;

[0019] The host security rating module calculates the occurrence of single-node detection type network attacks in the following manner: each single-node detection type network attack type is marked as x; for each network attack type x, the number of trusted nodes Nx is set in advance according to actual experience; the host calculates the sensor set Rx that sends information about encountering network attack type x in real time; and the probability of the host encountering network attack type x is

[0020] The host security rating module calculates the occurrence of regional detection type network attacks in the following manner: each regional detection type network attack type is marked as y; for each network attack type y, the number of trusted nodes Ny is set in advance according to actual experience; the host calculates the average value of the malicious node probability calculated by other wireless base stations for the wireless base station s, and marks the average value as Ps; the host calculates the wireless base station set Rs that sends information about encountering network attack type y in real time; and the probability of the host encountering network attack type y is

[0021] Compared with the prior art, the present application has the following advantages:

[0022] 1、The present application considers the case that there is a malicious node inside the sensor, through the calculation of the malicious node probability of each wireless base station to the sensor nodes in the cluster and other wireless base stations, and then according to the malicious node probability, the corresponding weight mode is taken to the information sent by the node, which reduces the interference of the malicious node to the detection result;

[0023] 2、The present application considers the false alarm of the sensor node or the wireless base station, and sets the trusted number in advance; when the number of nodes sending attack information is less than the trusted number, the cumulative method is used for the probability of network attack; that is, until the cumulative probability reaches a certain value, it is confirmed that the network attack is encountered, thereby reducing the possibility of network attack false alarm. BRIEF DESCRIPTION OF DRAWINGS

[0024] Figure 1 The schematic diagram of the present application. DETAILED DESCRIPTION

[0025] The technical solutions of the present application will be described below in conjunction with the embodiments, obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor belong to the scope of protection of the present application.

[0026] As shown in Figure 1 A sensor network data security detection system, comprising a network attack collection module, a node security detection module, a regional security detection module, a node reputation rating module and a host security rating module; wherein each module is connected by electrical means;

[0027] Due to the characteristics of sensor network such as non-uniform technical standard, network self-organization and unreliable communication, the sensor network is easily attacked from the outside. The means of network attack is also various, such as congestion attack, DDOS attack, replay attack, flooding attack and byzantine attack. The detection method of each attack means is not the same, part of the network attack can be detected in a single sensor node, such as fake attack; and part of the network attack needs to be detected by multiple sensor nodes in the region, such as DDOS attack.

[0028] The network attack collection module is mainly used for collecting the basic information of network attack in the sensor network in advance;

[0029] In a preferred embodiment, the basic information of the network attack includes the name of the discovered network attack, the characteristics of the network attack and the detection procedure corresponding to the network attack in the sensor network; and the network attack is classified according to the detection method corresponding to the network attack; specifically, the network attack is classified into single-node detection and regional detection; it can be understood that the detection procedure of the single-node detection type detection method is installed in each sensor node; and the detection procedure of the regional detection type detection method is installed in the wireless base station connected to the sensor node cluster; the network attack collection module sends the collected basic information of the network attack to the node security detection module and the regional security detection module respectively according to the type of the network attack.

[0030] In order to reduce the burden of the sensor network, reduce the amount of communication conflict and delay, and reduce communication redundancy, the sensor network is usually divided into regions, that is, managed by clusters, and each cluster is responsible for filtering and forwarding data within the cluster and communication with other clusters through a base station.

[0031] The node security detection module is mainly used for detecting single-node detection type network attacks in each sensor node.

[0032] In a preferred embodiment, the node security detection module includes a detection procedure installed in each sensor node, which includes all detection procedures for detecting single-node detection type network attacks; each detection procedure detects the characteristics of the data packet received by the sensor node in real time according to the corresponding procedure function, judges whether a network attack occurs according to the characteristics of the data packet, and sends the attack information of the occurred network attack to the host security rating module; preferably, the characteristics of the data packet can include but are not limited to the sender of the data packet, the receiving speed of the data packet, the content of the data packet and the identity verification information of the data packet; the attack information can include but is not limited to the network attack method, the data packet sending address, the data packet destination address and the network attack strength; preferably, the network attack strength is evaluated by the detection procedure according to the actual strength of the network attack, and different network attack methods adopt different strength evaluation standards; as an example: the DDOS attack can adopt the amount of data packets received per second as the strength evaluation unit;

[0033] The regional security detection module is mainly used for real-time detection of regional detection type network attacks in each sensor connected wireless base station in the cluster.

[0034] In a preferred embodiment, the regional security detection module comprises a detection program installed in each wireless base station to which the sensors are connected, which detects all detection area detection network attacks; each detection program acquires the characteristics of the data packets received by the sensors in the cluster in real time according to the corresponding program functions; and determines whether a network attack has occurred according to the characteristics of the received data packets, and sends the attack information of the network attack to the host security rating module; preferably, the attack information includes the attack mode, the sensor address of the abnormal data packet forwarding, the abnormal data packet content, the abnormal data packet receiving speed, and the network attack strength;

[0035] The node reputation rating module is mainly used for reputation rating of each sensor node and each wireless base station connected to the sensors in the cluster;

[0036] It should be understood that in the sensor network, some attackers may be able to communicate with a certain sensor node in the cluster through certain means, so that the node becomes a malicious node and attacks other nodes; therefore, the reputation of each sensor in the cluster needs to be rated; for the same reason, the reputation of the wireless base station also needs to be rated;

[0037] In a preferred embodiment, the node reputation rating module rates the reputation of each sensor node in the cluster through the wireless base station; specifically, the way to rate the reputation of the sensor is to calculate the probability of each sensor node being a malicious node according to the data forwarding characteristics of each sensor node in the cluster; preferably, the data forwarding characteristics include data packet forwarding speed, proportion of abnormal data packets, and number of next-hop sensors for data packet forwarding; it can be understood that the probability of the malicious node is the reputation of each sensor; each sensor node is marked as i; the probability of sensor i being a malicious node is marked as Pi;

[0038] The node reputation rating module rates the reputation of other wireless base stations through the wireless base station; specifically, the way to rate the reputation of the wireless base station is that when each wireless base station or the sensors included in the sensor cluster of the base station detect a network attack, the last-hop wireless base station of the network attack data packet is obtained; and according to the traffic characteristics of the network attack traffic packet sent by the wireless base station, the probability of the last-hop wireless base station being a malicious base station is calculated; each wireless base station is marked as s, and the last-hop wireless base station is marked as t; then the reputation rating of the wireless base station s to the last-hop wireless base station t is marked as Pst;

[0039] Each wireless base station s sends the malicious node probability Pi of each sensor i in its sensor cluster and the reputation rating Pst of the last-hop wireless base station t to the host security rating module in real time;

[0040] The host security rating module is mainly used for calculating the probability of network attack on the host side;

[0041] In the embodiment, the host security rating module calculates the single-node detection type network attack in the following manner: each single-node detection type network attack type is marked as x; for each network attack type x, a trust number Nx is set in advance according to actual experience; the trust number is the number of sensors that declare encountering network attack type x attack; when the number of sensors that declare encountering network attack type x attack is greater than the trust number Nx, it is considered that the host encounters x type network attack; the host real-time calculates a sensor set Rx that sends information about encountering network attack type x; and the probability of the host encountering network attack type x is

[0042] Further, the host security rating module calculates the area detection type network attack in the following manner: each area detection type network attack type is marked as y; for each network attack type y, a trust number Ny is set in advance according to actual experience; the host real-time calculates the average value of the malicious node probability calculated by other wireless base stations for the wireless base station s, and marks the average value as Ps; the host real-time calculates a wireless base station set Rs that sends information about encountering network attack type y; and the probability of the host encountering network attack type y is

[0043] The above embodiments are only used to illustrate the technical method of the present application and are not limiting. Although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present application can be modified or replaced equivalently without departing from the spirit and scope of the technical method of the present application.

Claims

1. A sensor network data security detection system, characterized in that: It includes a network attack collection module, a node security detection module, a regional security detection module, a node reputation rating module, and a host security rating module; wherein each module is electrically connected; The network attack collection module pre-collects basic information of network attacks in the sensor network; and sends the collected basic information of network attacks to the node security detection module and the regional security detection module respectively according to the network attack type; The node security detection module detects single-node detection network attacks in each sensor node and sends the attack information of the network attacks to the host security rating module; The regional security detection module detects regional detection type network attacks in real time in the wireless base station connected to each sensor in the cluster; The node reputation rating module performs reputation rating for each sensor node and the wireless base station to which each sensor in the cluster is connected; each wireless base station s sends the malicious node probability Pi of each sensor i in its sensor cluster and the reputation rating Pst of the previous hop wireless base station t to the host security rating module in real time; The host security rating module calculates the probability of a network attack occurring on the host side.

2. A sensor network data security detection system according to claim 1, characterized in that: The basic information of the network attack includes the name of the network attack that has been discovered in the sensor network, the characteristics of the network attack, and the detection procedure of the detection method corresponding to the network attack; According to the corresponding detection methods of network attacks, network attacks are divided into two categories: single node detection and regional detection.

3. A sensor network data security detection system according to claim 1, characterized in that: The node security detection module includes a detection program installed in each sensor node including all detection single node detection type network attacks; Each detection program detects the characteristics of the data packets received by the sensor node in real time according to the corresponding program function, and determines whether a network attack occurs based on the characteristics of the data packets.

4. A sensor network data security detection system according to claim 1, characterized in that: The regional security detection module includes a detection program for detecting network attacks of all detection areas installed in the wireless base station to which each sensor is connected; Each detection program obtains the characteristics of the data packets received by the sensors in the cluster in real time according to the corresponding program function; and determines whether a network attack occurs based on the characteristics of the received data packets.

5. A sensor network data security detection system according to claim 1, characterized in that: The way to rate the reputation of sensors is as follows: according to the data forwarding characteristics of each sensor node in the cluster, the probability of each sensor node being a malicious node is calculated; each sensor node is marked as i; the probability of sensor i being a malicious node is marked as Pi.

6. A sensor network data security detection system according to claim 1, characterized in that: The credit rating method for wireless base stations is as follows: After each wireless base station or a sensor in a sensor cluster included in the base station detects a network attack, it obtains the previous hop wireless base station of the network attack data packet; Calculate the probability that the previous-hop wireless base station is a malicious base station based on the traffic characteristics of the network attack traffic packet sent by the wireless base station; Each wireless base station is marked as s, and the previous wireless base station is marked as t; then the reputation rating of the wireless base station s to the previous wireless base station t is marked as Pst.

7. A sensor network data security detection system according to claim 1, characterized in that: The host security rating module calculates the occurrence of single-node detection network attacks in the following way: When the number of nodes that send attack information is less than the number of nodes that receive information, the probability of suffering a network attack is accumulated; each type of single-node detection network attack type is marked as x; For each type of network attack x, the number of trusted credentials Nx is set in advance based on actual experience; The host counts the sensor set Rx that sends information about encountering network attack type x in real time; then the probability of the host encountering network attack type x is 8. A sensor network data security detection system according to claim 1, characterized in that: The host security rating module calculates the occurrence area detection type network attack in the following way: When the number of nodes that send attack information is less than the number of nodes that receive information, the probability of suffering a network attack is accumulated; the network attack type of each area detection type is marked as y; For each type of network attack y, the number of trusted credentials Ny is set in advance based on actual experience; The host calculates in real time the average value of the malicious node probabilities calculated by other wireless base stations for wireless base station s, and marks the average value as Ps; The host counts the wireless base station set Rs that sends information about encountering network attack type y in real time; then the probability of the host encountering network attack type y is

Images