A method, device and storage medium for identifying malicious nodes

Abstract

This invention discloses a method, device, and storage medium for identifying malicious nodes. The method includes: constructing an approximate trust distribution for a mobile node based on the historical trust distribution of the source trust domain; updating the approximate trust distribution to the trust distribution of a target trust domain, and determining a dynamic trust threshold based on the updated trust distribution of the target trust domain; identifying the mobile node as a malicious node when its trust level is less than the dynamic trust threshold. This invention can quickly identify malicious nodes in dynamic environments, meet the need for accurate identification of malicious nodes after crossing trust domains, and improve the overall trust quality and security of the system.

Description

[0001] A method, device and storage medium for identifying malicious nodes Technical Field

[0002] This invention relates to the field of distributed edge computing security technology, and in particular to a method, device and storage medium for identifying malicious nodes. Background Technology

[0003] In a distributed computing environment, due to the mobility and wide coverage of computing nodes, the entire system is essentially composed of many trust domains and ultimately exists in an untrusted environment. When nodes move, their mobility can cause changes in the trust distribution across trust domains. Therefore, cross-trust domain trust management is one of the key issues in node trust management in a dynamic distributed environment.

[0004] Traditional node trust management typically uses historical interactions between nodes within a trust domain to assess a node's trust status. This approach assumes that distributed nodes are fixed and unchanging. However, a large number of roaming computing nodes (such as connected vehicles) may discard historical trust status accumulated in the original edge computing during their movement, thus affecting the trust distribution within the new trust domain. Consequently, traditional malicious node identification based on preset trust thresholds can no longer meet the requirement for accurate identification of malicious nodes across trust domains. Summary of the Invention

[0005] This invention provides a method, device, and storage medium for identifying malicious nodes, which can quickly identify malicious nodes in a dynamic environment, meet the need for accurate identification of malicious nodes after crossing trust domains, and improve the overall trust quality and security of the system.

[0006] In a first aspect, embodiments of the present invention provide a method for identifying malicious nodes, including:

[0007] Based on the historical trust distribution of the mobile node in the source trust domain, an approximate trust distribution of the mobile node is constructed.

[0008] The approximate trust distribution is updated to the trust distribution of the target trust domain, and a dynamic trust threshold is determined based on the updated trust distribution of the target trust domain.

[0009] When the trust level of the mobile node is less than the dynamic trust threshold, the mobile node is identified as a malicious node.

[0010] As an improvement to the above scheme, constructing an approximate trust distribution for the mobile node based on its historical trust distribution in the source trust domain includes:

[0011] Based on the historical trust distribution of the mobile node in the source trust domain, a BP neural network is used to predict the mean and variance of the trust distribution after the mobile node is added to the target trust domain.

[0012] Based on the mean and the variance, determine the estimated trust distribution value after the mobile node is added to the target trust domain;

[0013] A similarity analysis is performed between the estimated trust distribution and the historical trust distribution;

[0014] When the similarity is less than a set similarity threshold, the estimated trust distribution value is determined to be the approximate trust distribution for adding the mobile node to the target trust domain.

[0015] As an improvement to the above scheme, determining the estimated trust distribution value after the mobile node is added to the target trust domain based on the mean and the variance includes:

[0016] Construct a posterior distribution based on the mean and the variance;

[0017] The posterior distribution is sampled using random sampling to generate an estimated trust distribution value after the mobile node is added to the target trust domain.

[0018] As an improvement to the above scheme, constructing the posterior distribution based on the mean and the variance includes:

[0019] Perform normal distribution statistical analysis on the mean and variance to obtain the predicted trust distribution value after multiple mobile nodes are added to the target trust domain;

[0020] A posterior distribution is constructed based on the predicted values ​​from the multiple trust distributions.

[0021] As an improvement to the above scheme, the similarity analysis of the estimated trust distribution and the historical trust distribution includes:

[0022] KL divergence is used to measure the similarity between multiple trust distribution estimates and the historical trust distribution.

[0023] As an improvement to the above scheme, updating the approximate trust distribution to the trust distribution of the target trust domain, and determining the dynamic trust threshold based on the updated trust distribution of the target trust domain, includes:

[0024] After updating the approximate trust distribution to the trust distribution of the target trust domain, the average trust value and median trust value of the target trust domain are calculated based on the updated trust distribution of the target trust domain.

[0025] The dynamic trust threshold is calculated based on the average and median trust levels of the target trust domain.

[0026] As an improvement to the above scheme, the step of calculating the dynamic trust threshold based on the average and median trust levels of the target trust domain includes:

[0027] The dynamic trust threshold is calculated according to formula (1);

[0028] (1);

[0029] in, This represents the average trust level of the target trust domain; This represents the median of the target trust domain; This represents the average trust level of all nodes in the target trust domain before the mobile node was added. This represents the average trust level of all nodes in the target trust domain after the mobile node is added. This represents the median trust level of all nodes in the target trust domain before the mobile node was added. N represents the median trust level of all nodes in the target trust domain after the mobile node is added; m This represents the number of interactions between all nodes within the target trust domain.

[0030] As an improvement to the above solution, the method further includes:

[0031] When the similarity is not less than a set similarity threshold, the network parameters of the BP neural network are adjusted.

[0032] In a second aspect, embodiments of the present invention provide a malicious node identification device, comprising: a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the malicious node identification method as described in any one of the first aspects.

[0033] Thirdly, embodiments of the present invention provide a computer-readable storage medium storing a computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the malicious node identification method as described in any one of the first aspects.

[0034] Compared to existing technologies, the beneficial effects of this invention are as follows: An approximate trust distribution for the mobile node is constructed based on the historical trust distribution of the source trust domain; this approximate trust distribution is updated in the trust distribution of the target trust domain, and a dynamic trust threshold is determined based on the updated trust distribution of the target trust domain; when the trust level of the mobile node is less than the dynamic trust threshold, the mobile node is identified as a malicious node. This invention can quickly identify malicious nodes in dynamic environments, meeting the need for accurate identification of malicious nodes after crossing trust domains, and improving the overall trust quality and security of the system. Attached Figure Description

[0035] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 This is a flowchart of a malicious node identification method provided in an embodiment of the present invention;

[0037] Figure 2 This is a schematic diagram of a malicious node identification device provided in an embodiment of the present invention. Detailed Implementation

[0038] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0039] Example 1

[0040] Please see Figure 1 This is a flowchart of a malicious node identification method provided by an embodiment of the present invention. The malicious node identification method includes:

[0041] S1: Construct an approximate trust distribution for the mobile node based on the historical trust distribution of the mobile node in the source trust domain;

[0042] In a distributed computing environment, considering the potential loss of accumulated trust history records in the source trust domain or the significant transmission resource consumption during data transfer, which could lead to task distribution not meeting business testing requirements, this invention, based on a cross-trust domain trust transfer framework, preserves the historical trust distribution of mobile nodes in the source trust domain. It then utilizes the historical trust distribution of newly entering mobile nodes in the target trust domain, obtained from the cloud server, to generate an approximate trust distribution for the mobile node in the target trust domain. The trust history records include the number and frequency of interactions between the mobile node and the server, and the number and frequency of interactions between the mobile node and its neighboring nodes.

[0043] Taking a mobile node as an example of an autonomous driving car, assuming the car is driving from the road to an underground parking lot, the road can be understood as the source trust domain. The car will interact with the vehicle network server and other surrounding vehicles while on the road. At this time, the car's historical trust distribution in the source trust domain is determined by the scoring data from multiple vehicle network servers and other surrounding vehicles. Considering that this is the car's first time entering the underground parking lot and it has not previously interacted with the underground parking lot server or other vehicles in the parking lot, the car needs to be re-evaluated by the underground parking lot server and other vehicles in the parking lot. This ensures that some computing services in the underground parking lot can safely allow it to enter. In this embodiment of the invention, the historical trust distribution of the mobile node in other source trust domains within a set time period (e.g., within 3 months) is obtained from the cloud, and an approximate trust distribution of the mobile node in the target trust domain is constructed.

[0044] S2: Update the approximate trust distribution to the trust distribution of the target trust domain, and determine the dynamic trust threshold based on the updated trust distribution of the target trust domain;

[0045] S3: When the trust level of the mobile node is less than the dynamic trust threshold, the mobile node is identified as a malicious node.

[0046] In this embodiment of the invention, an approximate trust distribution constructed based on the historical trust distribution of mobile nodes is added to the target trust domain, which is regarded as the trust distribution of mobile nodes in the target trust domain. This enables a trust management strategy across trust domains. Then, the trust distribution in the target trust domain is used to adaptively generate a dynamic trust threshold, thereby enabling the classification of dynamically added mobile nodes and quickly identifying malicious nodes in the dynamic environment. This meets the requirement of accurate identification of malicious nodes after crossing trust domains, improving the overall trust quality and security of the system.

[0047] In an optional embodiment, S1: Constructing an approximate trust distribution for the mobile node based on its historical trust distribution in the source trust domain includes:

[0048] S11: Based on the historical trust distribution of the mobile node in the source trust domain, a BP neural network is used to predict the mean and variance of the trust distribution after the mobile node is added to the target trust domain.

[0049] S12: Determine the estimated trust distribution value after the mobile node is added to the target trust domain based on the mean and the variance;

[0050] Further, determining the estimated trust distribution value after the mobile node is added to the target trust domain based on the mean and the variance includes:

[0051] Construct a posterior distribution based on the mean and the variance;

[0052] Specifically, normal distribution statistical analysis is performed on the mean and variance to obtain the predicted trust distribution value after multiple mobile nodes are added to the target trust domain;

[0053] A posterior distribution is constructed based on the predicted values ​​from the multiple trust distributions.

[0054] The posterior distribution is sampled using random sampling to generate an estimated trust distribution value after the mobile node is added to the target trust domain.

[0055] S13: Perform a similarity analysis between the estimated trust distribution and the historical trust distribution;

[0056] Furthermore, the similarity analysis of the estimated trust distribution and the historical trust distribution includes:

[0057] KL divergence is used to measure the similarity between multiple trust distribution estimates and the historical trust distribution.

[0058] S14: When the similarity is less than a set similarity threshold, determine that the estimated trust distribution value is used as the approximate trust distribution for adding the mobile node to the target trust domain.

[0059] In this embodiment of the invention, a BP neural network is used to predict the mean and variance of the trust distribution after the mobile node is added to the target trust domain, as follows:

[0060] Assume the input to the BP neural network is The hidden layer has d neurons, resulting in:

[0061] ;

[0062] Among them, X k Let x represent the k-th historical trust distribution. i This represents the score data given by node i to the mobile node. This represents the calculation results for each hidden layer. This represents the connection weights from the i-th input layer neuron to the h-th hidden layer neuron. This represents the bias variable from the i-th input layer neuron to the h-th hidden layer neuron.

[0063] From hidden layer to output layer:

[0064] Assuming there are n output layers, and each neuron in a hidden layer is connected to a neuron in an output layer, we get:

[0065] ;

[0066] By combining the outputs of the n output layers and averaging them with weights, the mean of the trust distribution of the target trust domain of the mobile node is obtained:

[0067] ;

[0068] Based on the above average The corresponding variance can be calculated. .

[0069] Repeat the above mean and variance prediction steps for the historical trust distribution of mobile nodes in other source trust domains within a set time period (e.g., within 3 months) to obtain multiple sets of means and variances.

[0070] Assuming the posterior distribution follows a normal distribution, and that the distribution is normal, the predicted trust distribution value after the mobile node is added to the target trust domain is:

[0071] ;

[0072] in, This represents noise that is normally distributed, following a distribution with a mean of 0 and a variance of 1. This represents the Hadamard product, which is the product of corresponding elements.

[0073] By combining the obtained means and variances from multiple sets, multiple confidence distribution predictions can be obtained, and a posterior distribution p( Combined with the posterior distribution p( Randomly sample k data points, assuming the randomly sampled data are... By combining the generator, the estimated trust distribution after the mobile node is added to the target trust domain is obtained:

[0074] ;

[0075] Where G() represents the generator, This represents the estimated value of the trust distribution.

[0076] KL divergence is used to measure the estimated trust distribution after the generated mobile node is added to the target trust domain. Historical Trust Distribution Similarity:

[0077] ;

[0078] in, This represents the rating data of node i for the mobile node in the target trust domain; This represents the scoring data of node i for the mobile node in the source trust domain.

[0079] The KL divergence calculated above As an estimate of the trust distribution Historical Trust Distribution The similarity is calculated, and if the similarity is less than a set similarity threshold, then a trust distribution estimate is generated. The quality meets the requirements, and the trust distribution estimate is... Incorporate it into the trust distribution of the target trust domain.

[0080] In an optional embodiment, updating the approximate trust distribution to the trust distribution of the target trust domain, and determining the dynamic trust threshold based on the updated trust distribution of the target trust domain, includes:

[0081] After updating the approximate trust distribution to the trust distribution of the target trust domain, the average trust value and median trust value of the target trust domain are calculated based on the updated trust distribution of the target trust domain.

[0082] The dynamic trust threshold is calculated based on the average and median trust levels of the target trust domain.

[0083] Once the approximate trust distribution of a newly added mobile node is incorporated into the target trust domain, its original trust distribution will change. Therefore, it is necessary to recalculate the dynamic trust threshold within the target trust domain. This dynamic trust threshold depends on the number of interactions N between all nodes within the target trust domain. m The average trust level in the target trust domain and the median trust level in the new trust domain.

[0084] Specifically, the dynamic trust threshold is calculated according to formula (1);

[0085] (1);

[0086] in, This represents the average trust level of the target trust domain; This represents the median of the target trust domain; This represents the average trust level of all nodes in the target trust domain before the mobile node was added. This represents the average trust level of all nodes in the target trust domain after the mobile node is added. This represents the median trust level of all nodes in the target trust domain before the mobile node was added. N represents the median trust level of all nodes in the target trust domain after the mobile node is added; m This represents the number of interactions between all nodes within the target trust domain.

[0087] Based on the addition of mobile nodes, a dynamic trust threshold is dynamically generated in the target trust domain, and combined with the trust level of the newly added mobile nodes, it is used to identify whether the newly added mobile nodes are malicious nodes; specifically, when the trust level of the mobile node is less than the dynamic trust threshold, the mobile node is identified as a malicious node.

[0088] Furthermore, the method also includes:

[0089] When the similarity is not less than a set similarity threshold, the network parameters of the BP neural network are adjusted.

[0090] In this embodiment of the invention, when the similarity is not less than a set similarity threshold, the neural network parameters and generator parameters will be readjusted, and the process will return to step S1. The quality of the approximate trust distribution generated by the mobile node will be improved through multiple iterations.

[0091] Compared with the prior art, the beneficial effects of the embodiments of the present invention are as follows:

[0092] By establishing a trust transfer framework across trust domains, the historical trust distribution of mobile nodes in other source trust domains is preserved, and the dynamic trust threshold is adaptively generated using the trust distribution in the target trust domain, thereby achieving dynamic classification of new nodes.

[0093] Trust management strategies across trust domains are implemented by reconstructing the approximate trust distribution of mobile nodes within the target trust domain and using KL divergence to measure the difference in trust levels of newly added mobile nodes within the target trust domain.

[0094] By adaptively generating dynamic trust thresholds within the target trust domain based on trust distribution, malicious nodes can be accurately identified, improving the overall trust quality and security of the system. At the same time, it avoids the situation where trust thresholds remain unchanged, and multiple malicious nodes can collude to attack after joining a certain trust domain.

[0095] Example 2

[0096] See Figure 2This is a schematic diagram of a malicious node identification device provided in an embodiment of the present invention. The malicious node identification device of this embodiment includes: a processor 100, a memory 200, and a computer program stored in the memory 200 and executable on the processor 100, such as a malicious node identification program. When the processor 100 executes the computer program, it implements the steps in the various malicious node identification method embodiments described above, for example... Figure 1 Steps S1-S3 are shown.

[0097] For example, the computer program may be divided into one or more modules / units, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules / units may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the malicious node identification device.

[0098] The malicious node identification device may include, but is not limited to, a processor and a memory. Those skilled in the art will understand that the schematic diagram is merely an example of a malicious node identification device and does not constitute a limitation on the device. It may include more or fewer components than illustrated, or combine certain components, or use different components. For example, the malicious node identification device may also include input / output devices, network access devices, buses, etc.

[0099] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the malicious node identification device, connecting all parts of the device via various interfaces and lines.

[0100] The memory can be used to store the computer programs and / or modules. The processor implements various functions of the malicious node identification device by running or executing the computer programs and / or modules stored in the memory and by calling the data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0101] If the modules / units integrated into the malicious node identification device are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0102] It should be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0103] The above description is a preferred embodiment of the present invention. It should be noted that, for those skilled in the art, many improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A malicious node identification method, characterized by, The method comprises the following steps: constructing an approximate trust distribution of the mobile node according to a historical trust distribution of the mobile node in a source trust domain; updating the approximate trust distribution into a trust distribution of a target trust domain, and determining a dynamic trust threshold according to the updated trust distribution of the target trust domain; identifying the mobile node as a malicious node when a trust degree of the mobile node is less than the dynamic trust threshold; the step of constructing the approximate trust distribution of the mobile node according to the historical trust distribution of the mobile node in the source trust domain comprises the following steps: predicting a mean value and a variance of a trust distribution of the mobile node after joining the target trust domain by using a BP neural network according to the historical trust distribution of the mobile node in the source trust domain; determining a trust distribution estimation value of the mobile node after joining the target trust domain according to the mean value and the variance; performing a similarity analysis on the trust distribution estimation value and the historical trust distribution; determining the trust distribution estimation value as the approximate trust distribution of the mobile node after joining the target trust domain when a similarity is less than a set similarity threshold.

2. The malicious node recognition method of claim 1, wherein, the step of determining the trust distribution estimation value of the mobile node after joining the target trust domain according to the mean value and the variance comprises the following steps: constructing a posterior distribution according to the mean value and the variance; generating the trust distribution estimation value of the mobile node after joining the target trust domain by data sampling on the posterior distribution in a random sampling manner.

3. The method of claim 2, wherein, the step of constructing the posterior distribution according to the mean value and the variance comprises the following steps: performing a normal distribution statistical analysis on the mean value and the variance to obtain a plurality of trust distribution prediction values of the mobile node after joining the target trust domain; constructing a posterior distribution according to the plurality of trust distribution prediction values.

4. The malicious node recognition method of claim 1, wherein, the step of performing the similarity analysis on the trust distribution estimation value and the historical trust distribution comprises the following step: measuring a similarity of the plurality of trust distribution estimation values and the historical trust distribution by using a KL divergence.

5. The method of claim 1, wherein, the step of updating the approximate trust distribution into the trust distribution of the target trust domain, and determining the dynamic trust threshold according to the updated trust distribution of the target trust domain comprises the following steps: after updating the approximate trust distribution into the trust distribution of the target trust domain, calculating a trust degree mean value and a trust degree median of the target trust domain according to the updated trust distribution of the target trust domain; calculating the dynamic trust threshold according to the trust degree mean value and the trust degree median of the target trust domain.

6. The malicious node recognition method of claim 5, wherein, the step of calculating the dynamic trust threshold according to the trust degree mean value and the trust degree median of the target trust domain comprises the following step: calculating the dynamic trust threshold according to formula (1); （1）； wherein, represents the average of the trust values of all nodes in the target trust domain; represents the median of the trust values of all nodes in the target trust domain; represents the average of the trust values of all nodes in the target trust domain before the mobile node joins; represents the average of the trust values of all nodes in the target trust domain after the mobile node joins; represents the median of the trust values of all nodes in the target trust domain before the mobile node joins; represents the median of the trust values of all nodes in the target trust domain after the mobile node joins;N m represents the number of interactions of all nodes in the target trust domain.

7. The malicious node recognition method of claim 1, wherein, the method further comprises the following step: when the similarity is not less than the set similarity threshold, adjusting network parameters of the BP neural network.

8. A malicious node identification device characterized by comprising: The apparatus comprises: a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the malicious node identification method according to any one of claims 1 to 7 when executing the computer program.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, wherein the computer program controls a device where the computer readable storage medium is located to perform the malicious node identification method as claimed in any one of claims 1 to 7 when the computer program is running.

Images