A method for preventing malware propagation based on network resistance

Abstract

The present application relates to a kind of anti-malware propagation methods based on network resistance, specifically includes: using network science theory to construct energy internet topology, and define the concept of network resistance;Based on the real-time feature analysis of each node neighbor node, identify the node attacked by virus malicious in network;By network topology formed by the rest of unqualified nodes network resistance maximization, the network is divided and detected, and the block of malicious software or virus propagation is realized.The present application method can be distinguished from the related research in the aspect of existing virus propagation dynamics, the network resistance concept is defined by using network science theory, the virus propagation risk is reduced by changing network structure, and the anti-malware propagation method is studied at the theoretical level.

Description

Technical Field

[0001] This invention relates to a method for preventing the spread of malicious software based on network resistance, belonging to the field of industrial internet security. Background Technology

[0002] The lack of resilience in traditional security defense systems has become a major bottleneck in the protection of my country's critical information infrastructure. Although some corresponding measures have been developed to address network information security and protection issues, such as firewall systems, network intrusion detection systems, and network intrusion prevention systems, they are difficult to overcome in the face of large-scale, distributed network attacks when used individually. The security provided by any single-point defense measure will become increasingly limited. Without a holistic security solution, the power energy internet will find it difficult to combat ubiquitous security risks, and a holistic approach to security protection is key to identifying threats.

[0003] The Energy Internet can be viewed as a massive, interdependent binary network composed of an information network and a physical network. A core security challenge in the Energy Internet scenario is ensuring the security of both networks themselves, as well as the security of their interaction and integration. For such massive, binary networks as the Energy Internet, malware propagation is a major threat. Its security defense faces two main challenges: first, the sheer scale makes propagation difficult to control and prevent; second, the interdependence of the two networks, their increasing interaction, and the blurred boundaries exacerbate the risk of malware propagation.

[0004] Currently, some scholars both domestically and internationally have focused on research into methods to prevent the spread of malware. However, the vast majority of these studies concentrate primarily on virus propagation models, considering only the characteristics of the virus propagation process without taking into account the impact of the network structure itself on virus propagation and its defensive capabilities. Utilizing the network's inherent structure and functions to prevent the spread of malware in the energy internet is a pressing issue that needs to be addressed. Summary of the Invention

[0005] To address the aforementioned technical shortcomings, this invention aims to provide a method for preventing malware propagation based on network resistance. By establishing an energy internet network topology model and applying the concept of network resistance, this method analyzes the real-time characteristics of nodes and controls a small number of critical nodes to partition the network, thereby blocking the propagation of malware and promoting the safe and stable operation of the energy internet. This invention enables the energy internet to defend against virus attacks through a small number of controllers, thus limiting the spread and outbreak of malicious programs and achieving the safe and stable operation of the energy internet.

[0006] The technical solution adopted by this invention to achieve the above objectives is: a method for preventing the spread of malicious software based on network resistance, comprising the following steps:

[0007] Establish a network topology model;

[0008] Based on the average network efficiency index, network resistance is constructed to address the information transmission characteristics between energy internet nodes;

[0009] Based on real-time feature analysis of each node's neighboring nodes, identify nodes in the network that have been maliciously attacked by viruses.

[0010] Select a subset of nodes from those maliciously attacked by the virus as potential disconnection nodes;

[0011] All candidate nodes to be cut off are treated as a set. A genetic algorithm is used to select the target node, which makes the network resistance of the target node greater than the threshold, and then the target node is cut off.

[0012] The establishment of the network topology model includes the following steps:

[0013] Terminal devices, sensing devices, and relay servers in the energy internet are used as network nodes;

[0014] If any two network nodes exchange information, then there is one edge connecting these two nodes;

[0015] By traversing each network node, a network topology model is obtained.

[0016] The network resistance Ω(G) is the sum of the shortest path lengths between node pairs:

[0017] Ω(G)=∑ i≠i d ij

[0018] Where, d ij This represents the shortest path length between node i and node j.

[0019] When all nodes are not in the same connected component, the shortest path is the sum of the number of nodes in the network.

[0020] The method of identifying nodes in the network that have been maliciously attacked by viruses based on real-time feature analysis of each node's neighbor nodes includes the following steps:

[0021] (1) Monitor the sum of traffic changes of each node's neighboring nodes within time interval T, and the traffic changes of each neighboring node within time interval T; if the sum of traffic changes of a node's neighboring nodes within time interval T exceeds a threshold, or if the traffic changes of a neighboring node within time interval T exceed a threshold, then the node is recorded as a dangerous node and disconnected.

[0022] (2) Monitor the sum of traffic of all second-level neighbor nodes of each node within the time interval T; when the change value of the sum of traffic of a node's second-level neighbor nodes within the time interval T exceeds the threshold, the node is recorded as a dangerous node and disconnected.

[0023] (3) Repeat steps (1) to (2); if the node is a dangerous node during the repetition, the change is caused by the node, the node is determined to have been invaded by the virus, and the connection is completely disconnected for repair; if the node is not a dangerous node during the repetition, the change is caused by other nodes, and the dangerous node mark of the node is removed.

[0024] The second-level neighbor nodes are those whose shortest path to the reference node is equal to 2.

[0025] The selection of certain nodes as candidate cutoff nodes includes the following steps:

[0026] Select M indicators;

[0027] For each metric, the nodes that are maliciously attacked by the virus are sorted according to the metric, and the 2N nodes with the highest values ​​for each metric are selected.

[0028] Among 2N*M nodes, select the N nodes that rank highest in all M indicators as candidate cutoff nodes.

[0029] The indicators include degree value, intermediate value, and proximity value.

[0030] The process of treating all candidate nodes to be cut off as a set, selecting a target node using a genetic algorithm, ensuring that the network resistance of the target node exceeds a threshold, and then cutting off the target node includes the following steps:

[0031] All candidate severance nodes are treated as a set, the candidate severance nodes are treated as chromosomes, and the network resistance is treated as the fitness value. A genetic algorithm is used to select N nodes as target nodes, and these nodes are severed.

[0032] A computer-readable storage medium storing a computer program that, when executed by a processor, implements a method for preventing the spread of malicious software based on network resistance.

[0033] The present invention has the following beneficial effects and advantages:

[0034] 1. This invention establishes a mechanism to prevent the spread of malicious software in the energy internet, providing a tool for the security defense of the energy internet.

[0035] 2. This invention differs from existing research on virus propagation dynamics by using network science theory to define the concept of network resistance and reduce the risk of virus propagation by changing the network structure, thus studying methods to prevent the spread of malicious software at the theoretical level.

[0036] 3. To meet the application background of the energy internet, this invention introduces complex network science to model the energy internet and analyze its topology and functions. Attached Figure Description

[0037] Figure 1 This is a flowchart of a method for preventing the spread of malware based on network resistance;

[0038] Figure 2 This is a schematic diagram of the energy internet model;

[0039] Figure 3 This is a schematic diagram of the task partitioning model. Detailed Implementation

[0040] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments.

[0041] This invention relates to a method for preventing malware propagation based on network resistance. The method addresses the security of the energy internet against virus attacks by designing a method to prevent malware propagation. Based on the structural information of the energy internet, it defines the concept of network resistance and limits the spread and outbreak of malicious programs by controlling a small number of controllers in the network. This provides a theoretical analysis and research on energy internet security defense methods. Specifically, it includes: constructing the energy internet topology using network science theory and defining the concept of network resistance; identifying nodes under malicious virus attack based on real-time feature analysis of each node's neighbor nodes; and maximizing network resistance by dividing and detecting the network topology formed by the remaining unidentified nodes to block the propagation of malware or viruses. This invention differs from existing research on virus propagation dynamics by defining the concept of network resistance using network science theory and reducing the risk of virus propagation by changing the network structure, thus providing a theoretical approach to preventing malware propagation.

[0042] like Figure 1 As shown, this invention proposes a method for preventing the spread of malicious software based on network resistance. By modeling the energy internet as a complex network, it differs from traditional methods that only target the dynamics of virus propagation. By controlling a small number of controllers in the network to limit the spread and outbreak of malicious programs, this invention analyzes and studies the security defense methods for the energy internet from a theoretical perspective.

[0043] Establish a complex network topology model for the propagation of viruses in the energy internet, as shown in the attached figure. Figure 2As shown, the establishment of the energy internet model specifically includes:

[0044] Terminal devices, sensing devices, and relay servers in the energy internet are considered as network nodes. If any two node units exchange information, then there is a connection between these two nodes.

[0045] Based on the average network efficiency index in complex networks, and considering the information transmission characteristics between nodes in the energy internet, network resistance is defined. The average network efficiency E is defined as follows:

[0046]

[0047] Where N is the number of nodes, d ij This represents the shortest path length between node i and node j.

[0048] Network average efficiency represents the efficiency of information transmission between nodes in a network. By definition, the magnitude of network average efficiency is related to the shortest path length between pairs of nodes. According to the mean-mean inequality:

[0049]

[0050] Where n is the number of mean values, x i This is the i-th value;

[0051] Substituting the above inequality into the definition of average network efficiency, we get:

[0052]

[0053] Therefore, the lower bound of the average network efficiency can be estimated using the sum of the shortest path lengths between node pairs; that is, the larger the sum of the shortest path lengths between node pairs, the smaller the average network efficiency. In view of this, the present invention defines the network resistance (Ω(G)) as the sum of the shortest path lengths between node pairs:

[0054] Ω(G)=∑ i≠j d ij

[0055] It is worth noting that in complex network theory, the shortest path between nodes is defined only within the same connected component. This invention defines the shortest path not within the same connected component as the sum of the number of nodes in the network. According to this definition, when a virus invades the network, the spread of the virus can be slowed by disconnecting a small number of nodes, increasing network resistance.

[0056] Based on real-time feature analysis of each node's neighbor nodes, nodes in the network that have been maliciously attacked by viruses are identified. Specifically, this real-time feature analysis includes:

[0057] Since attacked nodes may be out of control and cannot guarantee they will send alerts to administrators, it is necessary to locate attacked nodes by using other healthy nodes. This invention employs two methods to identify nodes in the network that have been maliciously attacked by viruses.

[0058] (1) Monitor the change in the sum of traffic of each node's neighboring nodes within the time interval T, as well as the change in traffic of each neighboring node within the time interval T. If the change in the sum of traffic of a node's neighboring nodes within the time interval T exceeds 30%, or the change in traffic of a neighboring node within the time interval T exceeds 50%, then the node is recorded as a dangerous node and will be disconnected for the next test.

[0059] (2) Monitor the sum of traffic of all second-layer neighbor nodes of each node within the time interval T. The second-layer neighbors are shown in the attached table. Figure 3 As shown (black represents the target node, red represents its neighboring nodes, and blue represents its second-level neighboring nodes). To reduce the impact of normal fluctuations in information volume between neighboring nodes on monitoring accuracy, the sum of traffic of all second-level neighboring nodes of each node within a time interval T is detected. If the change in the sum of traffic of a node's second-level neighboring nodes within a time interval T exceeds 50%, the node is recorded as a dangerous node and will be disconnected for further testing.

[0060] After disconnecting the node, repeat the above processes (1) and (2). If the node is a dangerous node during the repetition, the changes are caused by the node, and the node is determined to have been invaded by a virus. Completely disconnect the connection and repair it. If the node is not a dangerous node during the repetition, the changes are caused by other nodes, and the dangerous node mark of the node is removed.

[0061] By maximizing network resistance across the network topology comprised of the remaining healthy nodes, the network is partitioned and detected, and the attacked nodes are disconnected. Specifically, maximizing network resistance involves:

[0062] To avoid impacting network structure and functionality due to pausing too many healthy nodes, the number of nodes cut off during the network resistance maximization process should be limited in actual production applications. In this invention, the number of cut-off nodes is set to 5% of the remaining healthy nodes. Furthermore, to improve the efficiency of network resistance maximization, this invention selects some important nodes as candidate cut-off nodes, based on three criteria:

[0063] (1) The 10% of nodes with the highest degree value in the network topology composed of the remaining healthy nodes. The degree value is defined as: deg i =∑ j∈N a ij a ijLet a be an element in the adjacency matrix. If there is an edge connecting node i and node j, then a ij =1, otherwise a ij =0 indicates the connection status of the node with other nodes. Nodes with higher disconnection values ​​are more likely to increase network resistance.

[0064] (2) The remaining healthy nodes constitute the top 10% of the network topology nodes with the highest median values. The median value is defined as: n xy n represents the number of shortest paths between nodes x and y. xy (i) represents the number of nodes i that pass through in the shortest path between nodes x and y, indicating the importance of the node in the information transmission process. Cutting off nodes with higher intermediate values ​​is more likely to increase network resistance.

[0065] (3) The 10% of nodes in the network topology composed of the remaining healthy nodes that are closest to the highest value. The closest value is defined as: N represents the number of nodes, d ij This represents the shortest path length between node i and node j, indicating the importance of the node in the information transmission process. Cutting off nodes with higher values ​​is more likely to increase network resistance.

[0066] Finally, all selected candidate nodes to be cut off are grouped into a set, and a genetic algorithm is used to select 5% of the remaining healthy nodes as target nodes for maximizing network resistance. These nodes are then cut off. This process reduces the risk of the virus continuing to spread in the network. Next, for each network segment after the cut-off process, the steps of identifying nodes maliciously attacked by the virus are repeated, and the identified attacked nodes are cut off. Finally, the nodes cut off during the process of maximizing network resistance are restored.

[0067] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of embodiments combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0068] This invention is described with reference to a process flowchart according to embodiments of this application. It should be understood that each step in the flowchart can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing device, generate instructions for implementing the process. Figure 1A device for a function specified in one or more processes.

[0069] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 The function specified in one or more processes.

[0070] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 Steps of a specified function in one or more processes.

[0071] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for preventing the spread of malicious software based on network resistance, characterized in that, Includes the following steps: Establish a network topology model; Based on the average network efficiency index, network resistance is constructed to address the information transmission characteristics between energy internet nodes; Based on real-time feature analysis of each node's neighboring nodes, identify nodes in the network that have been maliciously attacked by viruses. Select a subset of nodes from those maliciously attacked by the virus as potential disconnection nodes; All candidate nodes to be cut off are treated as a set. A genetic algorithm is used to select the target node, which makes the network resistance of the target node greater than the threshold, and then the target node is cut off. The network resistance The sum of the shortest path lengths between node pairs: ； in, This represents the shortest path length between node i and node j.

2. The method for preventing malware propagation based on network resistance according to claim 1, characterized in that, The establishment of the network topology model includes the following steps: Terminal devices, sensing devices, and relay servers in the energy internet are used as network nodes; If any two network nodes exchange information, then there is one edge connecting these two nodes; By traversing each network node, a network topology model is obtained.

3. The method for preventing malware propagation based on network resistance according to claim 1, characterized in that, When all nodes are not in the same connected component, the shortest path is the sum of the number of nodes in the network.

4. The method for preventing malware propagation based on network resistance according to claim 1, characterized in that, The method of identifying nodes in the network that have been maliciously attacked by viruses based on real-time feature analysis of each node's neighbor nodes includes the following steps: (1) Monitor the change in the sum of traffic of each node's neighboring nodes within the time interval T, and the change in traffic of each neighboring node within the time interval T; if the change in the sum of traffic of a node's neighboring nodes within the time interval T exceeds the threshold, or if the change in traffic of a neighboring node within the time interval T exceeds the threshold, then the node is recorded as a dangerous node and disconnected. (2) Monitor the sum of traffic of all second-layer neighbor nodes of each node within the time interval T; when the change value of the sum of traffic of a node's second-layer neighbor nodes within the time interval T exceeds the threshold, the node is recorded as a dangerous node and disconnected. (3) Repeat steps (1) to (2); if the node is a dangerous node during the repetition, the change is caused by the node, the node is determined to have been invaded by the virus, and the connection is completely disconnected for repair; if the node is not a dangerous node during the repetition, the change is caused by other nodes, and the dangerous node mark of the node is removed.

5. A method for preventing malware propagation based on network resistance according to claim 4, characterized in that, The second-level neighbor nodes are those whose shortest path to the reference node is equal to 2.

6. The method for preventing malware propagation based on network resistance according to claim 1, characterized in that, The selection of certain nodes as candidate cutoff nodes includes the following steps: Select M indicators; For each metric, the nodes that are maliciously attacked by the virus are sorted according to the metric, and the 2N nodes with the highest values ​​for each metric are selected. In 2N Among M nodes, select the N nodes that rank highest in all M indicators as candidate cutoff nodes.

7. A method for preventing malware propagation based on network resistance according to claim 6, characterized in that, The indicators include degree value, intermediate value, and proximity value.

8. A method for preventing malware propagation based on network resistance according to claim 1, characterized in that, The process of treating all candidate nodes to be cut off as a set, selecting a target node using a genetic algorithm, ensuring that the network resistance of the target node exceeds a threshold, and then cutting off the target node includes the following steps: All candidate severance nodes are treated as a set, the candidate severance nodes are treated as chromosomes, and the network resistance is treated as the fitness value. A genetic algorithm is used to select N nodes as target nodes, and these nodes are severed.

9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements a method for preventing the spread of malicious software based on network resistance as described in any one of claims 1-8.

Images