A method for quickly locating malicious node units for large-scale internet of things

Abstract

The application belongs to the technical field of information security detection, and relates to a fast positioning method for malicious node units of a large-scale Internet of Things, comprising the following steps: respectively calculating trust network subgraphs of network initial running time and network normal running time according to transmission data of the two kinds of data; combining the trust network subgraphs of the same nodes of the two kinds of data to obtain a training set; training a graph neural network model by using the training set; obtaining the latest trust network subgraph and the trust network subgraph of the network initial running time; obtaining a subgraph pair according to the trust network subgraph; inputting the subgraph pair into the graph neural network model to obtain a similarity score of the subgraph pair; comparing the similarity score of the subgraph pair with a threshold value to obtain an Internet of Things unit with a malicious node; the application combines the graph neural network and the trust topology graph to calculate the similarity of a pair of graphs, can timely locate a large-scale trust attack in the Internet of Things network, and can perform differential management on the Internet of Things unit with a group of malicious nodes.

Description

Technical Field

[0001] This invention belongs to the field of information security detection technology and relates to a method for rapid location of malicious node units in large-scale Internet of Things. Background Technology

[0002] The Internet of Things (IoT) is a large network composed of interconnected physical devices and virtual entities such as agents. Its openness inevitably provides opportunities for malicious users to launch attacks. IoT security is a fundamental requirement for meeting its network service quality requirements. Identifying malicious nodes in the IoT effectively ensures that nodes can perceive and transmit data effectively and truthfully. Therefore, rapidly locating malicious nodes in the IoT is particularly important for ensuring network reliability.

[0003] Traditional network security mechanisms such as key management are often used to deal with external attacks. However, for some nodes that have been captured by external attacks and become malicious internal nodes, trust management is currently an effective method for detecting such nodes. The trust management method evaluates the trust value of network nodes by combining different trust evidence, thereby ensuring network security.

[0004] However, existing trust management systems are unable to analyze trust information in large-scale IoT systems due to the limited computing power of nodes, and also cannot meet the need to locate groups of malicious nodes in large-scale IoT systems, especially against large-scale trust attacks launched by malicious nodes, such as self-promotion attacks and defamation attacks. Summary of the Invention

[0005] To address the problems of the prior art, this invention employs a rapid location method for malicious node units in large-scale Internet of Things (IoT) applications, comprising:

[0006] S1. Obtain the transmission data of the IoT device, including the transmission data during the initial network operation and the transmission data during normal network operation;

[0007] S2. Calculate multiple trusted network subgraphs G based on the transmission data during the initial network runtime. <G1,G2,...,G N Calculate multiple trusted network subgraphs G' based on the data transmitted during normal network operation. <G1',G2'...,G N The nodes of the trust network subgraph are IoT devices, and the edges represent the trust relationships between devices.

[0008] S3. Combine the trust network subgraphs G and G' formed by the same nodes to obtain multiple pairs of trust network subgraphs. Combine all the trust network subgraph pairs to obtain the training dataset.

[0009] S4. Construct a graph neural network model. Use the training dataset to train the graph neural network model to obtain the trained graph neural network model.

[0010] S5. Obtain the latest transmission data from IoT devices and calculate multiple trust network subgraphs G”= based on the latest transmission data. <G”1,G”2,...,G” N >; Combine the trust network subgraph G" consisting of the same nodes with the trust network subgraph G to obtain multiple sets of subgraph pairs;

[0011] S6. Input multiple sets of subgraph pairs into the trained graph neural network model to obtain the similarity score of each set of subgraph pairs;

[0012] S7. Set a similarity score threshold, compare the similarity score of each subgraph pair with the threshold, and obtain the IoT units with malicious nodes.

[0013] The process of acquiring transmission data from IoT devices includes: dividing IoT devices into multiple clusters according to a clustering algorithm, selecting a cluster head for each cluster; cluster members sending the transmission data in operation to the cluster head through multi-hop communication, and the cluster head sending the received transmission data to the server through multi-hop communication.

[0014] Calculate multiple trust network subgraphs G based on the transmission data during the initial network runtime. <G1,G2,...,G N >Including:

[0015] S21. Calculate the trust relationship between devices based on the data transmitted during the initial network operation;

[0016] S22. Construct a trust network diagram based on the trust relationships between devices.

[0017] S23, Trust Network Diagram Group detection was performed, resulting in multiple trust network subgraphs G = <G1,G2,...,G N >

[0018] The trust relationships between devices are calculated based on the data transmitted during the initial network runtime, including:

[0019] S211. Calculate the trust evidence for each device based on the transmission data during the initial network operation, and construct the trust vector for each device based on the trust evidence;

[0020] S212. Use PCA principal component analysis to reduce the dimensionality of the trust vector of each device to obtain the dimensionality-reduced trust vector Q.

[0021] S213. Use the K-means clustering algorithm to cluster the Q of all devices, resulting in two groups; the group with fewer Qs is the low trust level group, and the group with more Qs is the high trust level group; S214. Set the trust relationship between the neighboring devices of the low trust level group and the corresponding low trust level group devices to a negative trust rating; set the trust relationship between the neighboring devices of the high trust level group and the corresponding high trust level group devices to a positive trust rating.

[0022] Trust evidence includes communication trust, data packet trust, and energy trust.

[0023] Construct a trust network graph based on the trust relationships between devices. include:

[0024] S221. Define a trust network diagram based on the trust relationships between devices. In this graph, vertex V represents an IoT device, and edge T = {T + ,T -} represents the trust rating between devices, T + With a positive trust rating, T - It has a negative trust rating.

[0025] S222, Calculate the graph based on the trust relationship between devices. The adjacency matrix A;

[0026] S223. Calculate the graph based on the adjacency matrix A. The degree matrix H.

[0027] The graph neural network model includes a first node-level embedding module, a second node-level embedding module, a first graph-level embedding module, a second graph-level embedding module, a graph-level embedding interaction module, and a similarity score calculation module; the training process of the graph neural network model is as follows:

[0028] S41. Input the subgraph G in the trust network subgraph pair into the first node-level embedding module for feature extraction to obtain the node embedding representation u.

[0029] S42. Input u into the first graph-level embedding module for feature extraction to obtain the graph-level embedding h;

[0030] S43. Input the subgraph G' in the trust network subgraph pair into the second node-level embedding module for feature extraction to obtain the node embedding representation u'.

[0031] S44. Input u' into the first graph-level embedding module for feature extraction to obtain the graph-level embedding h';

[0032] S45. Input the graph-level embedding h' and the graph-level embedding h into the graph-level embedding interaction module to obtain the interaction result;

[0033] S46. Input the interaction results into the similarity score calculation module to obtain the similarity score;

[0034] S47. Calculate the loss function value based on the similarity score and the loss function, update the model parameters based on the loss function value, and complete the model training when the loss function value converges.

[0035] The first generation node-level embedding module includes multiple graph convolutional layers.

[0036] The process by which the first graph-level embedding module processes the node embedding representation u includes:

[0037] S421. Calculate the global graph context based on u;

[0038] S422. Calculate the attention weight of each node based on the global graph context;

[0039] S423. Calculate the graph-level embedding h based on the attention weight of each node.

[0040] The graph-level embedded interaction module is an NTN neural tensor network.

[0041] Beneficial effects:

[0042] 1. This invention combines graph neural networks to detect malicious nodes in the Internet of Things (IoT), effectively avoiding the problem of difficult determination of the weights of influencing factors in traditional malicious node detection methods. 2. This invention uses a clustering algorithm to classify device trust vectors based on communication trust, data packet trust, and energy trust, achieving better trust decision-making results in IoT environments lacking prior trust decision-making criteria. 3. The graph neural network of this invention, combined with a trust topology graph, can better represent node embeddings and enhance the expressive power of embeddings. 4. This invention uses a graph neural network model to find the similarity between pairs of graphs, which can analyze the potential trust structure of IoT networks. Compared with other methods that rely on direct and indirect observation of neighboring devices, this invention can effectively identify network subgraphs with groups of malicious nodes in large-scale IoT networks. 5. This invention can promptly locate large-scale trust attacks in IoT networks and perform differentiated management of IoT units with groups of malicious nodes, improving the overall security of the IoT. Attached Figure Description

[0043] Figure 1 A flowchart illustrating a method for rapidly locating malicious node units in a large-scale Internet of Things (IoT) according to an embodiment of the present invention;

[0044] Figure 2 This is a schematic diagram of a malicious device attack provided in an embodiment of the present invention;

[0045] Figure 3 This is an overall framework diagram provided for an embodiment of the present invention. Detailed Implementation

[0046] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0047] like Figure 1 , Figure 3 As shown, a method for rapid location of malicious node units in a large-scale Internet of Things includes:

[0048] S1. By collecting cluster member data through the cluster head device, the transmitted data of IoT devices is stored on the server;

[0049] The IoT devices are divided into multiple clusters based on the clustering algorithm. The cluster members aggregate the transmission data in the network operation and send it to the cluster head. The cluster head aggregates the data of the cluster members and sends the aggregated data to the server.

[0050] In this system, IoT devices can be divided into multiple clusters based on a clustering algorithm. Each cluster contains a cluster head and several cluster members. For example, using the Hybrid Energy-Efficient Distributed Clustering (HEED) algorithm, the clustering algorithm mainly relies on two parameters: the remaining energy of the nodes and the node density. Nodes with more remaining energy have a higher probability of becoming temporary cluster heads. The final cluster head is determined by the average reachable energy level (AMRP) of multiple temporary cluster head nodes within the same cluster range. The formula for calculating the AMRP of a cluster is as follows:

[0051]

[0052] Wherein, min(p) i ) represents the minimum radio frequency power for the i-th node in the cluster to communicate with the cluster head, and m represents the number of all neighboring nodes of that node.

[0053] After successfully selecting the final cluster head, cluster members aggregate the transmitted data in the network and send it to the cluster head via multi-hop communication. The cluster head then sends the aggregated data to the server in the same way.

[0054] Internet of Things (IoT) devices include, but are not limited to, smart devices such as computers, mobile phones, drones, Bluetooth headsets, smart cars, and Bluetooth speakers.

[0055] S2. The server calculates trust evidence for each device based on the collected transmission data, and performs clustering operations on the trust vector composed of trust evidence generated from multiple interactions between devices to obtain the trust relationship between devices.

[0056] Trust evidence mainly includes communication trust, data packet trust, and energy trust. Among them, communication trust mainly reflects whether IoT devices successfully forward data packets or whether packet loss occurs. Data packet trust indicates the consistency of the number of messages sent by the device and can identify the device's behavior of dropping data packets or tampering with data. In addition, considering that attackers may send a large number of fake communication requests, causing their energy consumption to be too fast, energy trust, which reflects the device's energy consumption rate, is also an important component of trust evidence.

[0057] Communication trust is primarily represented by the proportion of successful communication with neighboring nodes. If, over a period of time, the number of successful communication attempts is *a* and the number of failed communication attempts is *b*, then the communication trust is *T*. c The calculation is as follows:

[0058]

[0059] Malicious nodes do not collect information like normal nodes. Instead, they receive data packets from normal nodes and discard or tamper with the data within them. Therefore, the number of packets sent by a malicious node will differ significantly from the number of packets sent by its normal neighbors. Over a period of time, the data packet trust value T... p The calculation is as follows:

[0060]

[0061] Wherein, PNS represents the number of messages sent to the current node by neighboring nodes, and PNR represents the average number of messages received by the current node from all neighboring nodes.

[0062] Regarding energy trust, when a device's energy is below a certain threshold, the energy trust is 0. When the device's energy is above the threshold, it needs to be considered in conjunction with the device's energy consumption. A higher energy trust should be assigned when the device's energy consumption rate is similar to its neighbors. Therefore, over a period of time, the energy trust T... e The calculation is as follows:

[0063]

[0064] Among them, E res E represents the current remaining energy of the device. min E represents the energy threshold. rate The energy consumption rate of a device over a certain period of time, expressed in μ. e θ represents the average energy efficiency of the device and its neighbors.e It is the rate of change.

[0065] After the network has been running for a period of time, trust vectors for each device are constructed by collecting trust evidence generated from multiple interactions between devices. Principal component analysis (PCA) is then used to reduce the feature dimensionality of the trust vectors. Finally, K-means clustering algorithm is used to cluster the trust vectors of all devices into two trust groups, corresponding to high and low trust levels, respectively. The group with fewer trust vectors is the low trust level group, and the group with more trust vectors is the high trust level group. Devices belonging to the low trust level have a negative trust rating from neighboring devices, otherwise they have a positive trust rating.

[0066] S3. Construct a trust network graph with two edge types for the devices and their trust relationships, and perform group detection on the trust network graph. During the initial run of the network, construct the training dataset of the graph neural network by dividing it into multiple network subgraphs.

[0067] In this invention, the trust network graph is defined as... Where the graph vertices V = {v1, v2, ..., v} n} represents IoT devices, N = |V| represents the number of devices, and T = {T} + ,T -} represents the trust rating between devices, where t i,j ∈T + This indicates that device j is trustworthy of device i, t i,j ∈T - This indicates that device j is not trusted by device i. (Figure) The adjacency matrix is ​​denoted by A, and its elements are:

[0068]

[0069] H represents the graph. The degree matrix is ​​a diagonal matrix, and its elements are:

[0070]

[0071] Large-scale IoT networks typically consist of multiple IoT units. Compared to networks with overlapping user product graphs, IoT networks are easier to distinguish. When devices belonging to the same IoT unit operate, the interactions between devices generate a large number of trust relationships, resulting in a higher edge density than the density between units. Based on this, the present invention can easily detect the boundaries between units and perform subgraph partitioning.

[0072] Typically, in the early stages of network deployment, the number of malicious nodes is relatively small. Therefore, in the data transmission round, multiple sets of trust network graph pairs consisting of the same nodes from the previous round and the current round are used as the training dataset. Each trust network graph is a network subgraph that includes node features and trust relationships between nodes. These multiple sets of trust network graph pairs are regarded as real samples to train the graph neural network.

[0073] S4. Construct a graph neural network model that can obtain graph similarity scores.

[0074] In this invention, the graph neural network model mainly includes stages such as generating node-level embeddings, generating graph-level embeddings, graph-level embedding interactions, and calculating similarity scores. In the stage of generating node-level embeddings, firstly, nodes are one-hot encoded and local information is smoothed through the propagation and aggregation operations of a graph convolutional network (GCN) for feature extraction. After passing through multiple layers of graph convolutional networks, the embedding representation of the nodes can be learned.

[0075] After the convolution operation, the embedding of node i is defined as:

[0076]

[0077] Where N(i) is the set of first-order neighbors of node i plus the set of node i itself, and d i This represents the degree of node i. This is the weight matrix associated with the l-th GCN layer, where D is the number of neurons in the GCN layer. f1(·) represents the bias, f1(·) represents the activation function, and u i For the embedding of node i, u j Let i be the embedding of the j-th first-order neighbor node of node i.

[0078] In the graph-level embedding generation stage, the input node embedding is represented as Where the i-th row It is the embedding of node i; first, compute the global graph context. The calculation is as follows:

[0079]

[0080] Where I represents the number of nodes, and tanh represents the nonlinear transformation. It is a learnable weight matrix.

[0081] By learning the weight matrix, the global graph context *c* can provide global structural and feature information about the graph, adapting to a given similarity metric. Based on *c*, this invention computes an attention weight for each node by performing an inner product between the global graph context *c* and its node embeddings. Nodes similar to the global graph context receive higher attention weights, and a sigmoid function is used. To ensure that the attention weights are within the range (0, 1), the final attention weight 'a' of the node is obtained. i .

[0082] Finally, based on the attention weight a of the node i By embedding nodes, we obtain graph-level embeddings. The calculation is as follows:

[0083]

[0084] In the graph embedding interaction phase, based on the graph-level embeddings of the two graphs generated in the previous phase, the relationship between the two graph-level embeddings is simulated using an NTN neural tensor network:

[0085]

[0086] Among them, h i ,h j These represent the graph-level embeddings of the two graphs, This represents the weight tensor, and [] represents the degradation concatenation operation. Represents the weight vector. f3 is the bias vector, and f3(·) is the activation function. Additionally, K is a hyperparameter that controls the number of interaction scores generated for each graph embedding pair.

[0087] Finally, in the graph similarity calculation stage, g(h) i ,h j Similarity scores are obtained through a standard multilayer fully connected network. Then, the mean squared error loss function is used to compare it with the true similarity score.

[0088]

[0089] Where M is the training graph pair set, s(G i G j ) represents graph G i and G j The true similarity between them.

[0090] S5. Combine the latest trust network subgraph composed of the same nodes and the subgraphs partitioned during the initial runtime of the network into a set of test datasets and input them into the trained graph neural network model to obtain the similarity score of the subgraph pair.

[0091] Figure 2This diagram illustrates a malicious device attack. Figure (a) represents a self-promotion attack, and Figure (b) represents a defamation attack. Black nodes represent malicious devices, white nodes represent normal devices, dashed lines represent negative trust ratings, and solid lines represent positive trust ratings. After a period of node data exchange, the IoT network may be attacked externally, causing some nodes to be captured and become malicious. A group of malicious nodes will launch a self-promotion attack, giving each other positive ratings to increase their trust scores without attracting attention, and launch a defamation attack, giving normal nodes negative ratings to decrease their trust scores. Therefore, the trust relationships of some nodes in the subgraph will change significantly. For example, if a group of malicious nodes launches a defamation attack on a normal node, giving it a negative trust rating, it will have more node degrees than a normal node. A well-trained graph neural network can capture the structural changes in the trust network graph and output a lower similarity score.

[0092] S6. Given an appropriate similarity score threshold, quickly locate IoT units with malicious nodes by comparing the similarity scores of subgraph pairs with the threshold.

[0093] If the similarity score of a subgraph pair is less than a predetermined similarity score threshold, it indicates that there is a malicious node in the subgraph launching a large-scale trust attack. Subsequently, other trust management methods can be used to find the specific malicious node in the subgraph.

[0094] The above-described embodiments further illustrate the purpose, technical solution, and advantages of the present invention. It should be understood that the above-described embodiments are merely preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made to the present invention within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for rapid location of malicious node units in a large-scale Internet of Things (IoT), characterized in that, include: S1. Obtain the transmission data of the IoT device, including the transmission data during the initial network operation and the transmission data during normal network operation; S2. Calculate multiple trusted network subgraphs G based on the transmission data during the initial network runtime. <G1,G2,...,G N Calculate multiple trusted network subgraphs G' based on the data transmitted during normal network operation. <G1',G2'...,G N The nodes of the trust network subgraph are IoT devices, and the edges represent the trust relationships between devices. S3. Combine the trust network subgraphs G and G' formed by the same nodes to obtain multiple pairs of trust network subgraphs. Combine all the trust network subgraph pairs to obtain the training dataset. S4. Construct a graph neural network model. Use the training dataset to train the graph neural network model to obtain the trained graph neural network model. S5. Obtain the latest transmission data from IoT devices and calculate multiple trust network subgraphs G”= based on the latest transmission data. <G″1,G″2,...,G″ N >; Combine the trust network subgraph G" consisting of the same nodes with the trust network subgraph G to obtain multiple sets of subgraph pairs; S6. Input multiple sets of subgraph pairs into the trained graph neural network model to obtain the similarity score of each set of subgraph pairs; S7. Set a similarity score threshold, compare the similarity score of each subgraph pair with the threshold, and obtain the IoT units with malicious nodes.

2. The method for rapid location of malicious node units in a large-scale Internet of Things according to claim 1, characterized in that, The process of acquiring transmission data from IoT devices includes: dividing IoT devices into multiple clusters according to a clustering algorithm, selecting a cluster head for each cluster; cluster members sending the transmission data in operation to the cluster head through multi-hop communication, and the cluster head sending the received transmission data to the server in the same way.

3. The method for rapid location of malicious node units in a large-scale Internet of Things according to claim 1, characterized in that, Calculate multiple trust network subgraphs G based on the transmission data during the initial network runtime. <G1,G2,...,G N >Including: S21. Calculate the trust relationship between devices based on the data transmitted during the initial network operation; S22. Construct a trust network graph G based on the trust relationships between devices; S23. Perform group detection on the trust network graph G to obtain multiple trust network subgraphs G = <G1,G2,...,G N > 4. The method for rapid location of malicious node units in a large-scale Internet of Things according to claim 3, characterized in that, The trust relationships between devices are calculated based on the data transmitted during the initial network runtime, including: S211. Calculate the trust evidence for each device based on the transmission data during the initial network operation, and construct the trust vector for each device based on the trust evidence; S212. Use PCA principal component analysis to reduce the dimensionality of the trust vector of each device to obtain the dimensionality-reduced trust vector Q. S213. Use the K-means clustering algorithm to cluster the Q of all devices to obtain two groups; the group with fewer Qs is the low trust level group, and the group with more Qs is the high trust level group. S214. Set the trust relationship between neighboring devices of low trust level group devices and corresponding low trust level group devices to a negative trust rating; set the trust relationship between neighboring devices of high trust level group devices and corresponding high trust level group devices to a positive trust rating.

5. A method for rapid location of malicious node units in a large-scale Internet of Things according to claim 4, characterized in that, Trust evidence includes communication trust, data packet trust, and energy trust.

6. The method for rapid location of malicious node units in a large-scale Internet of Things according to claim 3, characterized in that, A trust network graph G is constructed based on the trust relationships between devices, including: S221. Define a trust network diagram based on the trust relationships between devices. In this graph, vertex V represents an IoT device, and edge T = {T + ,T - } represents the trust rating between devices, T + With a positive trust rating, T - It has a negative trust rating. S222, Calculate the graph based on the trust relationship between devices. The adjacency matrix A; S223. Calculate the graph based on the adjacency matrix A. The degree matrix H.

7. The method for rapid location of malicious node units in a large-scale Internet of Things according to claim 1, characterized in that, The graph neural network model includes a first node-level embedding module, a second node-level embedding module, a first graph-level embedding module, a second graph-level embedding module, a graph-level embedding interaction module, and a similarity score calculation module; the training process of the graph neural network model is as follows: S41. Input the subgraph G in the trust network subgraph pair into the first node-level embedding module for feature extraction to obtain the node embedding representation u. S42. Input u into the first graph-level embedding module for feature extraction to obtain the graph-level embedding h; S43. Input the subgraph G' in the trust network subgraph pair into the second node-level embedding module for feature extraction to obtain the node embedding representation u'. S44. Input u' into the second graph-level embedding module for feature extraction to obtain the graph-level embedding h'; S45. Input the graph-level embedding h' and the graph-level embedding h into the graph-level embedding interaction module to obtain the interaction result; S46. Input the interaction results into the similarity score calculation module to obtain the similarity score; S47. Calculate the loss function value based on the similarity score and the loss function, update the model parameters based on the loss function value, and complete the model training when the loss function value converges.

8. A method for rapid location of malicious node units in a large-scale Internet of Things according to claim 7, characterized in that, The first generation node-level embedding module includes multiple graph convolutional layers.

9. A method for rapid location of malicious node units in a large-scale Internet of Things according to claim 7, characterized in that, The process by which the first graph-level embedding module processes the node embedding representation u includes: S421. Calculate the global graph context based on u; S422. Calculate the attention weight of each node based on the global graph context; S423. Calculate the graph-level embedding h based on the attention weight of each node.

10. A method for rapid location of malicious node units in a large-scale Internet of Things according to claim 7, characterized in that, The graph-level embedded interaction module is an NTN neural tensor network.

Images