Malicious node detection and protection method, device and equipment

Abstract

The invention discloses a malicious node detection and protection method, device and equipment, and the method comprises the steps: determining the forwarding success rate, the message integrity, the energy level and the resource score of each node based on the monitoring data of each node in a network, the energy level represents the activeness and the electric quantity state of the node, and the resource score represents the transmission capability of the node; based on the forwarding success rate, the message integrity and the energy level of each node, a comprehensive trust value of each node is determined, and the comprehensive trust value represents the credibility of the node; and inputting the comprehensive trust value, the message integrity and the resource score of each node into a pre-trained classification decision model, and dividing each node into a trusted node and a non-trusted node based on an output classification result. According to the method, the non-trusted nodes can be identified before malicious behaviors are completely exposed, so that the overall security of the network is improved.

Description

Technical Field

[0001] The present application belongs to the field of network security technology, and in particular, relates to a malicious node detection and protection method, device and equipment. Background Art

[0002] Mobile Ad-hoc Networks (MANET) are a group of self-organizing networks without fixed infrastructure support. Nodes in the network communicate with each other through wireless links. Black hole attacks and gray hole attacks are common forms of network attacks in MANET. Among them: black hole attack refers to a malicious node disguising itself as a normal node to attract other nodes to send data packets to itself, and then not forwarding and discarding these data packets; while gray hole attack refers to a malicious node selectively discarding or delaying the forwarding of some data packets after receiving them. Both attacks will affect the reliability of communication.

[0003] In the related technology, the protection method against the above-mentioned attacks is to first refer to the blacklist and whitelist to filter out nodes that have been confirmed to be malicious when the node makes route selection, and then determine whether the behavior of the next-hop node conforms to the behavior pattern of the normal node by analyzing the routing information returned by the next-hop node, thereby determining whether the next-hop node is a malicious node. Once a node is confirmed to be a malicious node, it will be added to the blacklist to prevent it from continuing to affect the network.

[0004] However, the judgment dimension of the above-mentioned behavior pattern judgment method based on routing information is relatively single, and it is only effective for malicious nodes that have revealed malicious behavior. However, it reacts slowly to malicious nodes before the malicious behavior is fully revealed, and there may still be false positives or missed positives. Summary of the invention

[0005] In response to the above problems, the present application provides a malicious node detection and protection method, device and equipment for identifying untrusted nodes before malicious behavior is fully revealed, thereby improving the overall security of the network.

[0006] In a first aspect, the present application provides a malicious node detection method, the method comprising:

[0007] Based on the monitoring data of each node in the network, determine the forwarding success rate, message integrity, energy level and resource score of each node, wherein the message integrity represents the integrity of the data packet forwarded by the node, the energy level represents the activity and power status of the node, and the resource score represents the transmission capacity of the node;

[0008] Determine the comprehensive trust value of each node based on the forwarding success rate, message integrity and energy level of each node, wherein the comprehensive trust value represents the credibility of the node;

[0009] The comprehensive trust value, message integrity and resource score of each node are input into the pre-trained classification decision model, and each node is divided into trusted nodes and untrusted nodes based on the output classification results.

[0010] In an embodiment of the present application, firstly, based on the monitoring data of each node in the network, the forwarding success rate, message integrity, energy level and resource score of each node are determined, and then, based on the forwarding success rate, message integrity and energy level of each node, the comprehensive trust value of each node is determined; finally, the comprehensive trust value, message integrity and resource score of each node are input into the pre-trained classification decision model, and each node is divided into a trusted node and an untrusted node based on the output classification result. By comprehensively considering the forwarding success rate, message integrity, energy level and resource score of the node, the present application can more comprehensively evaluate the credibility of the node, identify the untrusted node before the malicious behavior is fully revealed, and improve the overall security of the network.

[0011] In a possible implementation manner, for any node, the forwarding success rate of the any node is determined by:

[0012] Determine a ratio of the number of data packets successfully sent by any one node to the same destination node to the number of data packets sent to the same destination node;

[0013] From the determined ratios, selecting the smallest ratio as the forwarding success rate of any one of the nodes;

[0014] For any node, the message integrity of the node is determined in the following manner:

[0015] Selecting the message integrity of the data packet with the most modifications from the message integrity record log corresponding to any one of the nodes as the message integrity of any one of the nodes, wherein the message integrity in the message integrity record log corresponding to any one of the nodes is determined based on the message integrity carried by the data packet received by any one of the nodes and the number of modifications made to the target data packet by any one of the nodes; wherein the target data packet is the data packet forwarded after being modified by any one of the nodes;

[0016] For any node, the energy level of the node is determined in the following manner:

[0017] Determining the energy level of any one node based on the ratio of the sum of the number of data packets sent and received by any one node and the battery power of any one node to the total number of nodes in the network;

[0018] For any node, the resource score of the node is determined in the following manner:

[0019] The resource score of the any one of the nodes is determined based on a result of weighted summation of the energy level, processing capability, memory and communication range of the any one of the nodes.

[0020] In an embodiment of the present application, a specific method for calculating the forwarding success rate, message integrity, energy level and resource score of a calculation node is given, wherein: by selecting the minimum ratio as the forwarding success rate of the node, it can be ensured that the forwarding success rate of the node can reflect the forwarding stability of the node under the worst conditions; by selecting the message integrity of the data packet with the most modifications as the message integrity of the node, the message integrity of the node can reflect the most extreme and frequent malicious tampering degree of the node during the forwarding process; the energy level determined by the number of data packets sent and received by the node and the battery power can reflect the activity and power status of the node; the resource score of the node is determined by the node's energy level, processing power, memory and communication range, and by adjusting the weight according to the specific application scenario, the resource score of the node can reflect the data transmission capability of the node under different scenario requirements.

[0021] In a possible implementation, the message integrity record log corresponding to any one of the nodes is obtained in the following manner:

[0022] Based on the number of times the target data packet is modified by any one of the nodes, the message integrity carried by the target data packet is updated, and the updated message integrity of the target data packet and the number of times the target data packet is modified by any one of the nodes are saved in a message integrity record log corresponding to the any one of the nodes;

[0023] For a data packet that is not modified and forwarded by any one of the nodes, the message integrity and zero modification times carried by the data packet that is not modified and forwarded are directly saved in the message integrity record log corresponding to the any one of the nodes.

[0024] In the embodiment of the present application, for each data packet received by the node, the number of modifications of the target data packet modified by the node is monitored and the message integrity of the target data packet is updated. At the same time, the number of modifications and message integrity of the data packet forwarded by the node are recorded in the message integrity record log corresponding to the node, so as to achieve the purpose of recording the tampering behavior of the node during the transmission process in detail and providing a basis for subsequent analysis and decision-making.

[0025] In a possible implementation, the updating of the message integrity carried by the target data packet based on the number of times the data packet is modified by any one of the nodes includes:

[0026] Determine the message change value based on the product of a preset reduction coefficient and the number of times the target data packet is modified by any one of the nodes, wherein the reduction coefficient is a preset fixed value or a value dynamically adjusted according to a preset rule, and the preset rule includes adjusting based on a comparison result of at least one of the network real-time load and the delay time for data packet transmission by any one of the nodes with a preset threshold;

[0027] The difference between the message integrity carried by the target data packet and the message change value is determined, and the message integrity carried by the target data packet is updated to the difference.

[0028] In an embodiment of the present application, a method for updating the message integrity of a target data packet is provided. By using a value based on a preset value or a value adaptively adjusted according to the actual situation of the network as a reduction coefficient, and updating the message integrity based on the product of the reduction coefficient and the number of modifications, the impact of real-time network changes and the number of modifications can be quantified, so that the message integrity can reflect the integrity of the data packet forwarded by the node, thereby helping to more accurately evaluate the malicious behavior of the node.

[0029] In a possible implementation, the classification decision model is trained in the following manner:

[0030] After receiving sample data of normal nodes and malicious nodes, preprocessing the sample data, the sample data includes comprehensive trust value, message integrity and resource score;

[0031] Divide the preprocessed sample data into a training set and a validation set;

[0032] The classification decision model is trained based on the training set, and the weights and bias values ​​of the classification decision model are optimized based on the gradient descent method and the loss function until the classification decision model meets the preset end condition, and the end condition is that the classification accuracy of the classification decision model on the validation set meets the preset requirements or the number of training times reaches a preset threshold.

[0033] In a possible implementation, the method further includes:

[0034] An authentication node is selected from each trusted node based on the comprehensive trust value of each trusted node, and the selected authentication node is notified to the trusted nodes in the network, so that when the authentication node determines that the source node and the destination node corresponding to the forwarding request are both trusted nodes, the source node and the destination node generate a certificate for encrypting and verifying the data packet.

[0035] In an embodiment of the present application, the authentication node selected by the trusted node in the network is notified so that the authentication node generates a certificate for encrypting and verifying data packets between the trusted nodes that need to forward data packets, which can effectively identify and isolate non-trusted nodes and improve the security of the network.

[0036] In a second aspect, the present application provides a malicious node protection method, the method comprising:

[0037] After determining itself as an authentication node based on the notification received from the network, receiving forwarding requests from other nodes in the network; wherein the authentication node is selected by the network from the trusted nodes based on the comprehensive trust value of each trusted node, and the trusted node is determined by the network based on the classification result obtained by inputting the comprehensive trust value, message integrity and resource score of each node into a pre-trained classification decision model;

[0038] After receiving the forwarding request, determining the source node and the destination node corresponding to the forwarding request according to the source node identifier and the destination node identifier in the forwarding request;

[0039] If the source node and the destination node are trusted nodes, a first certificate is generated for the source node and the first certificate is sent to the source node, so that the source node uses the first certificate to encrypt the data packet and sends it to the destination node; and a second certificate is generated for the destination node and the second certificate is sent to the destination node, so that the destination node uses the second certificate to decrypt the data packet received from the source node.

[0040] In an embodiment of the present application, the authentication node verifies the forwarding requests sent by other nodes, and generates certificates for encrypting and verifying data packets for the verified source nodes and destination nodes, which can effectively identify and isolate untrusted nodes, ensure the security and integrity of data packets during transmission, and improve the security of the network.

[0041] In a possible implementation manner, generating a first certificate for the source node and generating a second certificate for the destination node includes:

[0042] Generate a first public key and a first private key for the source node, wherein the first public key is used to encrypt a data packet, and the first private key is used to decrypt the data packet encrypted by the first public key;

[0043] Generate a second public key and a second private key for the destination node, wherein the second public key is used to encrypt a data packet, and the second private key is used to decrypt the data packet encrypted by the second public key;

[0044] Based on the generated first public key, first private key, second public key and second private key, a first certificate is generated for the source node, and a second certificate is generated for the destination node, wherein the first certificate includes the first private key and the second public key, and the second certificate includes the second private key and the first public key.

[0045] In a third aspect, the present application provides a malicious node protection method, the method comprising:

[0046] Determine, based on the notification received from the network, an authentication node, wherein the authentication node is selected by the network from the trusted nodes based on the comprehensive trust value of each trusted node, wherein the trusted node is determined by the network based on a classification result obtained by inputting the comprehensive trust value, message integrity and resource score of each node into a pre-trained classification decision model;

[0047] When it is necessary to forward a data packet to a destination node, a forwarding request is initiated to the authentication node, the forwarding request includes a source node identifier and a destination node identifier, so that after the authentication node determines that a source node corresponding to the source node identifier and a destination node corresponding to the destination node identifier are trusted nodes, the authentication node sends a first certificate to the source node and sends a second certificate to the destination node, the first certificate includes a first private key and a second public key, the second certificate includes a second private key and a first public key, the first public key is used to encrypt a data packet, the first private key is used to decrypt a data packet encrypted by the first public key, the second public key is used to encrypt a data packet, and the second private key is used to decrypt a data packet encrypted by the second public key;

[0048] After receiving the first certificate from the authentication node, the data packet is encrypted using the second public key included in the first certificate and then forwarded to the destination node.

[0049] In an embodiment of the present application, when a source node needs to forward a data packet to a destination node with which it has not communicated, it first sends a forwarding request generated based on its own source node identifier and the destination node identifier of the destination node to the authentication node, and uses the first certificate received from the authentication node to encrypt the data packet and transmit it to the destination node. This can effectively identify and isolate untrusted nodes, thereby ensuring the security and integrity of the data packet during transmission and improving the security of the network.

[0050] In a fourth aspect, the present application provides a malicious node protection method, the method comprising:

[0051] receiving a second certificate sent by an authentication node, the authentication node being selected by the network from trusted nodes based on comprehensive trust values ​​of the trusted nodes, the trusted nodes being determined by the network based on a classification result obtained by inputting the comprehensive trust values, message integrity, and resource scores of the nodes into a pre-trained classification decision model, the second certificate being generated by the authentication node after determining that a source node and a destination node corresponding to a forwarding request are trusted nodes, the forwarding request being sent by the source node to the authentication node, and the second certificate comprising a second private key and a first public key;

[0052] receiving a data packet sent by the source node, where the data packet sent by the source node is obtained by encrypting the data packet by the source node using the second public key included in the first certificate, where the first certificate is generated after the authentication node determines that the source node and the destination node corresponding to the forwarding request are trusted nodes, where the first certificate includes a first private key and the second public key, where the first public key is used to encrypt the data packet, where the first private key is used to decrypt the data packet encrypted by the first public key, where the second public key is used to encrypt the data packet, where the second private key is used to decrypt the data packet encrypted by the second public key;

[0053] The data packet sent by the source node is decrypted using the second private key.

[0054] In an embodiment of the present application, after the destination node receives the second certificate from the authentication node, it uses the second certificate to decrypt the data packet received from the source node, which can effectively identify and isolate untrusted nodes, thereby ensuring the security and integrity of the data packet during transmission and improving the security of the network.

[0055] In a fifth aspect, the present application provides a malicious node detection device, the device comprising:

[0056] A first evaluation data preparation module is used to determine the forwarding success rate, message integrity, energy level and resource score of each node based on the monitoring data of each node in the network, wherein the message integrity represents the integrity of the data packet forwarded by the node, the energy level represents the activity and power status of the node, and the resource score represents the transmission capacity of the node;

[0057] A second evaluation data preparation module is used to determine a comprehensive trust value of each node based on the forwarding success rate, message integrity and energy level of each node, wherein the comprehensive trust value represents the credibility of the node;

[0058] The node attribute classification module is used to input the comprehensive trust value, message integrity and resource score of each node into the pre-trained classification decision model, and classify each node into a trusted node and an untrusted node based on the output classification results.

[0059] In a sixth aspect, the present application provides a malicious node protection device, the device comprising:

[0060] An authentication node identity confirmation module, used to receive forwarding requests from other nodes in the network after determining that it is an authentication node based on a notification received from the network; wherein the authentication node is selected by the network from the trusted nodes based on the comprehensive trust value of each trusted node, and the trusted node is determined by the network based on the classification result obtained after the comprehensive trust value, message integrity and resource score of each node are input into a pre-trained classification decision model;

[0061] A forwarding request verification module, configured to determine the source node and the destination node corresponding to the forwarding request according to the source node identifier and the destination node identifier in the forwarding request after receiving the forwarding request;

[0062] A certificate generation module is used to generate a first certificate for the source node and send the first certificate to the source node if the source node and the destination node are trusted nodes, so that the source node uses the first certificate to encrypt a data packet and sends it to the destination node; and to generate a second certificate for the destination node and send the second certificate to the destination node, so that the destination node uses the second certificate to decrypt the data packet received from the source node.

[0063] In a seventh aspect, the present application provides a malicious node protection device, the device comprising:

[0064] An authentication node determination module, for determining an authentication node according to a notification received from the network, wherein the authentication node is selected by the network from the trusted nodes based on the comprehensive trust value of each trusted node, wherein the trusted node is determined by the network based on a classification result obtained by inputting the comprehensive trust value, message integrity and resource score of each node into a pre-trained classification decision model;

[0065] a request initiation module, configured to initiate a forwarding request to the authentication node when a data packet needs to be forwarded to a destination node, the forwarding request including a source node identifier and a destination node identifier, so that the authentication node sends a first certificate to the source node and sends a second certificate to the destination node after determining that the source node corresponding to the source node identifier and the destination node corresponding to the destination node identifier are trusted nodes, the first certificate including a first private key and a second public key, the second certificate including a second private key and a first public key, the first public key being used to encrypt a data packet, the first private key being used to decrypt a data packet encrypted by the first public key, the second public key being used to encrypt a data packet, and the second private key being used to decrypt a data packet encrypted by the second public key;

[0066] The encryption module is used to, after receiving the first certificate from the authentication node, encrypt the data packet using the second public key included in the first certificate and then forward it to the destination node.

[0067] In an eighth aspect, the present application provides a malicious node protection device, the device comprising:

[0068] a certificate receiving module, configured to receive a second certificate sent by an authentication node, wherein the authentication node is selected by the network from the trusted nodes based on the comprehensive trust value of each trusted node, the trusted node is determined by the network according to a classification result obtained by inputting the comprehensive trust value, message integrity and resource score of each node into a pre-trained classification decision model, the second certificate is generated by the authentication node after determining that the source node and the destination node corresponding to the forwarding request belong to the trusted nodes, the forwarding request is sent by the source node to the authentication node, and the second certificate includes a second private key and a first public key;

[0069] a data packet receiving module, configured to receive a data packet sent by the source node, wherein the data packet sent by the source node is obtained by encrypting the data packet by the source node using the second public key contained in the first certificate, wherein the first certificate is generated after the authentication node determines that the source node and the destination node corresponding to the forwarding request are trusted nodes, wherein the first certificate contains a first private key and the second public key, wherein the first public key is used to encrypt a data packet, and the first private key is used to decrypt a data packet encrypted by the first public key, and the second public key is used to encrypt a data packet, and the second private key is used to decrypt a data packet encrypted by the second public key;

[0070] A decryption module is used to decrypt the data packet sent by the source node using the second private key.

[0071] In the ninth aspect, an embodiment of the present application provides a device, comprising at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a malicious node detection method as described in any one of the first aspect of the present application, or execute a malicious node protection method as described in any one of the second aspect of the present application, or execute a malicious node protection method as described in any one of the third aspect of the present application, or execute a malicious node protection method as described in any one of the fourth aspect of the present application.

[0072] In the tenth aspect, an embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the terminal device can execute a malicious node detection method as described in any one of the first aspects of the present application, or execute a malicious node protection method as described in any one of the second aspects of the present application, or execute a malicious node protection method as described in any one of the third aspects of the present application, or execute a malicious node protection method as described in any one of the fourth aspects of the present application.

[0073] The technical solution provided by the embodiments of the present application brings at least the following beneficial effects:

[0074] The present application provides a malicious node detection and protection method, device and equipment. First, based on the monitoring data of each node in the network, the forwarding success rate, message integrity, energy level and resource score of each node are determined, wherein the message integrity represents the integrity of the data packet forwarded by the node, the energy level represents the activity and power status of the node, and the resource score represents the transmission capacity of the node; then, based on the forwarding success rate, message integrity and energy level of each node, the comprehensive trust value of each node is determined, and the comprehensive trust value represents the credibility of the node; finally, the comprehensive trust value, message integrity and resource score of each node are input into the pre-trained classification decision model, and each node is divided into a trusted node and an untrusted node based on the output classification result. The present application determines the trusted node by comprehensively considering the forwarding success rate, message integrity, energy level and resource score of the node, which can more comprehensively evaluate the credibility of the node, identify the untrusted node before the malicious behavior is fully revealed, and improve the overall security of the network.

[0075] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. Obviously, the drawings introduced below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0077] Figure 1 A schematic diagram of a malicious node detection method provided in an embodiment of the present application;

[0078] Figure 2A multi-dimensional decision representation scheme for describing node context provided in an embodiment of the present application;

[0079] Figure 3 A schematic diagram of the authentication node selection process provided in an embodiment of the present application;

[0080] Figure 4 A schematic diagram of node interaction provided in an embodiment of the present application;

[0081] Figure 5 A schematic diagram of a malicious node detection device provided in an embodiment of the present application;

[0082] Figure 6 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0083] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0084] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0085] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0086] Before introducing the malicious node detection and protection method provided in the embodiment of the present application, in order to facilitate understanding, the technical background of the embodiment of the present application is first introduced in detail below.

[0087] Mobile Ad-hoc Networks (MANET) are a group of self-organizing networks without fixed infrastructure support. Nodes in the network communicate with each other through wireless links. Black hole attacks and gray hole attacks are common forms of network attacks in MANET. Among them: black hole attack refers to a malicious node disguising itself as a normal node to attract other nodes to send data packets to itself, and then not forwarding and discarding these data packets; while gray hole attack refers to a malicious node selectively discarding or delaying the forwarding of some data packets after receiving them. Both attacks will affect the reliability of communication.

[0088] In the related technology, the protection method against the above-mentioned attacks is to first refer to the blacklist and whitelist to filter out nodes that have been confirmed to be malicious when the node makes route selection, and then determine whether the behavior of the next-hop node conforms to the behavior pattern of the normal node by analyzing the routing information returned by the next-hop node, thereby determining whether the next-hop node is a malicious node. Once a node is confirmed to be a malicious node, it will be added to the blacklist to prevent it from continuing to affect the network.

[0089] However, the judgment dimension of the above-mentioned behavior pattern judgment method based on routing information is relatively single, and it is only effective for malicious nodes that have revealed malicious behavior. However, it reacts slowly to malicious nodes before the malicious behavior is fully revealed, and there may still be false positives or missed positives.

[0090] In view of this, in order to identify untrusted nodes before malicious behavior is fully revealed and improve the overall security of the network, the embodiments of the present application provide a malicious node detection and protection method, device, equipment and medium. The following describes some preferred embodiments of the present application in conjunction with the drawings of the specification.

[0091] Embodiment 1:

[0092] Figure 1 A schematic diagram of a malicious node detection method provided in some embodiments of the present application is shown in FIG. Figure 1 As shown, the process includes the following steps:

[0093] S101: Based on the monitoring data of each node in the network, determine the forwarding success rate, message integrity, energy level and resource score of each node.

[0094] Among them, the message integrity represents the integrity of the data packet forwarded by the node, the energy level represents the activity and power status of the node, and the resource score represents the transmission capability of the node.

[0095] The malicious node detection method provided in the embodiment of the present application is applied to the virtual computing node corresponding to each node in the mobile ad hoc network, and the virtual computing node can monitor each node in the mobile ad hoc network and obtain monitoring data. Specifically, the number of data packets sent and received by each node, the number of data packet modifications, the message integrity of the sent data packets, and the resource status value can be monitored in the virtual computing node. The resource status value includes battery power, processing power, memory, and communication range. The processing power represents the number of operations that a node can perform per unit time.

[0096] In a black hole attack or gray hole attack, malicious nodes can easily disguise themselves as normal nodes to tamper with, forward, and discard messages. Therefore, in order to identify untrusted nodes before malicious behavior is fully revealed and improve the overall security of the network, this application starts from the three dimensions of node forwarding stability, packet tampering degree, and resource nature under each routing path, and calculates the forwarding success rate, message integrity, energy level, and resource score of each node based on the monitoring data of each node, so as to comprehensively evaluate the malicious behavior of the node in the future.

[0097] In some embodiments, the present application may execute the malicious node detection method of the present application according to a set detection cycle. That is, the monitoring data used by the present application to calculate the forwarding success rate, message integrity, energy level and resource score of each node is the monitoring data collected within the current set detection cycle.

[0098] The following introduces the calculation method of forwarding success rate, message integrity, energy level and resource score.

[0099] 1. Forwarding success rate:

[0100] As a feasible implementation mode, for any node, the forwarding success rate of the any node is determined by the following method:

[0101] Determine a ratio of the number of data packets successfully sent by any one node to the same destination node to the number of data packets sent to the same destination node;

[0102] From the determined ratios, the smallest ratio is selected as the forwarding success rate of the any one node.

[0103] For example, when the forwarding success rate of node A needs to be determined, if node A has sent data packets to nodes B and C respectively, then nodes B and C are the destination nodes of node A. The two ratios calculated based on the above method can respectively characterize the forwarding stability of node A on routing path AB and routing path AC. By selecting the minimum ratio as the forwarding success rate of node A, it can be ensured that the forwarding success rate of the node can reflect the forwarding stability of the node in the worst case.

[0104] Optionally, the present application counts the number of data packets sent and received by each node by setting a self-addable data packet sending field and a data packet receiving field for each node.

[0105] For example, for the above node A, its data packet sending field can be defined as F nA ; For the above node B, its data packet receiving field can be defined as Rec nB When forwarding a data packet from node A to node B, the data packet sends field F nA When it is determined that Node B has received the data packet, Node B's Rec nB After that, the ratio of the number of packets successfully sent by node A to node B to the number of packets sent to node B is calculated. AB , as shown in the following formula:

[0106]

[0107] In the formula, (P s ) A Indicates the number of packets sent from node A to node B, which is represented by the packet sending field F nA It can be seen that (P r ) B Indicates the number of data packets received by node B from node A, which is represented by the data packet reception field Rec nB It is knowable.

[0108] It should be noted that the node ratio can be used to evaluate the stability of the node on the forwarding path. If a node can maintain a high forwarding success rate on all paths, it indicates that its reliability is high under various conditions, and the minimum ratio can reflect the performance of the node in the worst case. Therefore, by selecting the minimum ratio as the forwarding success rate of the node, this application can ensure that the forwarding success rate of the node can reflect the forwarding stability of the node in the worst case.

[0109] Optionally, the present application also performs a threshold judgment on the minimum value of the ratio calculated by each node according to Formula 1. If the minimum ratio of the node is lower than the preset threshold, the node can be directly judged as an untrusted node, and subsequent steps are no longer executed. In some embodiments, based on the fact that the minimum ratio of the node is lower than the preset threshold, after directly judging the node as an untrusted node, subsequent steps are no longer executed for the untrusted node, which may be to no longer execute malicious node detection this time, or to no longer execute malicious node detection for the untrusted node in the future.

[0110] Optionally, considering that a malicious node that conducts a black hole attack or a gray hole attack may receive a large number of data packets from other nodes by masquerading but not forwarding them, the present application also performs a threshold judgment on the total number of data packets received by each node. If the total number of data packets received by the node exceeds the critical value, it can be inferred that the node is an untrusted node, which is prone to data packet loss, and the subsequent steps are no longer executed. Among them, the critical value is set based on the empirical value, such as it can be set according to the total number of nodes.

[0111] In some embodiments, based on the total number of data packets received by the node exceeding a critical value, the node is directly judged to be an untrusted node, and subsequent steps are no longer executed for the untrusted node. This may be the case of no malicious node detection being performed on the untrusted node this time, or no malicious node detection being performed on the untrusted node in the future.

[0112] 2. Message Integrity Value (MIV):

[0113] For any node, the message integrity of the node is determined in the following manner:

[0114] Selecting the message integrity of the data packet with the most modification times from the message integrity record log corresponding to the any one node as the message integrity of the any one node;

[0115] Among them, the message integrity in the message integrity record log corresponding to any one of the nodes is determined based on the message integrity carried by the data packet received by any one of the nodes and the number of times the target data packet is modified by any one of the nodes; wherein the target data packet is the data packet forwarded after modification by any one of the nodes.

[0116] In the present application, each node corresponds to a message integrity record log, in which the message integrity of the data packets forwarded by the node and the number of times the node has modified the forwarded data packets are recorded.

[0117] The number of modifications to a data packet can reflect the malicious behavior tendency of a node. The message integrity of a data packet forwarded by a node is relatively high, indicating that it is highly trustworthy. Among the data packets modified by the node, the data packets with the most modifications reflect the most frequent tampering behavior of the node during the forwarding process, representing the extreme behavior of the node during the forwarding process. These extreme behaviors can better reflect the potential malicious intentions of the node.

[0118] In an embodiment of the present application, by focusing on the data packets with the most modifications, the abnormal behavior of the node can be amplified, making it easier to detect. Even if the node behaves normally in most cases, but exhibits obvious malicious behavior in some cases, the present application can capture these abnormal behaviors by focusing on the data packets with the most modifications.

[0119] Therefore, the present application selects the message integrity of the data packet with the most modifications among the data packets forwarded by the node as the message integrity of the node, so that the message integrity of the node can reflect the most extreme and frequent malicious tampering level of the node during the forwarding process.

[0120] Optionally, for any node, this application selects the message integrity of the data packet with the most modifications as the message integrity of the node, and then performs a threshold judgment on the message integrity of the node. If the message integrity of the node is lower than the preset threshold, the node can be directly judged as an untrusted node, and the subsequent steps are no longer executed. For example, when the message integrity of the node is 0, it means that the message integrity of the node is 0 when the node transmits the data packet, and the node is directly defined as a malicious node among the untrusted nodes.

[0121] In some embodiments, a threshold judgment is performed based on the message integrity of the node. After the node is directly judged to be an untrusted node, subsequent steps are no longer executed for the untrusted node. This may be no malicious node detection is performed on the untrusted node this time, or no malicious node detection is performed on the untrusted node in the future.

[0122] As a feasible implementation, the message integrity record log corresponding to any one of the nodes is obtained through steps S201-S202 in the following manner:

[0123] S201, based on the number of times the target data packet is modified by any one of the nodes, the message integrity carried by the target data packet is updated, and the updated message integrity of the target data packet and the number of times the target data packet is modified by any one of the nodes are saved in a message integrity record log corresponding to the any one of the nodes;

[0124] S202: For a data packet that is not modified and forwarded by any one of the nodes, directly save the message integrity and zero modification times carried by the data packet that is not modified and forwarded to a message integrity record log corresponding to the any one of the nodes.

[0125] In the embodiment of the present application, for each data packet received by the node, the number of modifications of the target data packet modified by the node is monitored and the message integrity of the target data packet is updated. At the same time, the number of modifications and message integrity of the data packet forwarded by the node are recorded in the message integrity record log corresponding to the node, so as to achieve the purpose of recording the tampering behavior of the node during the transmission process in detail and providing a basis for subsequent analysis and decision-making.

[0126] Exemplarily, for any node, if N data packets are forwarded by the node within the detection period, the message integrity record log of the node includes N MIV values ​​(representing the message integrity when N data packets flow through the node) and the number of times the node modifies the N data packets, where N is an integer.

[0127] As a feasible implementation manner, updating the message integrity carried by the target data packet based on the number of times the data packet is modified by any one of the nodes includes the following steps S301-S302:

[0128] S301, determining a message change value based on a product of a preset reduction coefficient and the number of times a target data packet is modified by any one of the nodes.

[0129] Among them, the above-mentioned reduction coefficient is a preset fixed value or a value dynamically adjusted according to preset rules, and the preset rules include adjustment based on the comparison result of at least one of the network real-time load and the delay time of data packet transmission of any node with a preset threshold.

[0130] S302, determining the difference between the message integrity carried by the target data packet and the message change value, and updating the message integrity carried by the target data packet to the difference.

[0131] In some embodiments, the present application can effectively improve the security of data transmission by monitoring changes in data packets at nodes and reducing the MIV of modified data packets when modification actions are detected.

[0132] In a specific implementation, the number of times the target data packet (the data packet whose content has been modified by the node) is modified is determined, and the update value of the MIV is calculated based on the number of modifications. The MIV carried by the target data packet is updated using the calculated update value, and the updated MIV value and the number of modifications are recorded in the message integrity log of the node. The node then sends the target data packet carrying the updated MIV value to the next node, and the next node generates a new data packet and MIV in this way.

[0133] Specifically, the calculation method of the updated value of the MIV of the target data packet is as shown in the following formula:

[0134] MIV new =MIV cur -ΔMIV*m Formula 2

[0135] Where, MIV new is the updated value of MIV, MIV cur is the message integrity of the target data packet when the node receives it, ΔMIV is the reduction coefficient, and m is the number of times the node modifies the target data packet.

[0136] It should be noted that in the embodiment of the present application, the MIV carried by each data packet is initialized to a set positive number when it is initially generated.

[0137] Optionally, if the malicious node detection method of the present application is executed according to a set detection cycle, then in the present application, each time the end time point of a detection cycle is reached, based on the number of modifications of the target data packet by the node in the current detection cycle, the message integrity of the target data packet forwarded by the node in the current detection cycle is calculated using the above formula 2; optionally, the present application can also reduce ΔMIV by immediately updating the MIV value of the target data packet after each detection cycle in which the node modifies the target data packet, that is, removing m from the above formula 2, and calculating the message integrity of the target data packet forwarded by the node in the current detection cycle by (MIV new =MIV cur -ΔMIV) can achieve that each time a node is detected to have modified a target data packet within the current detection cycle, the message integrity of the target data packet is updated to reduce ΔMIV.

[0138] Optionally, as mentioned above, the reduction coefficient ΔMIV in the present application is a preset fixed value or a value dynamically adjusted according to preset rules, and the preset rules include adjustment based on the comparison result of at least one of the real-time network load and the delay time of the node for data packet transmission with a preset threshold.

[0139] In some embodiments, the above-mentioned preset rule may be to adjust the reduction coefficient ΔMIV according to certain real-time network conditions or security status, and the preset rule may include the following reference items:

[0140] Reference Item 1, Network Delay (Latency): If the data packet encounters a long delay during transmission, it means that the network may be unstable or there is a risk of attack, then the value of ΔMIV can be increased.

[0141] Reference Item 2, Packet Loss Rate: A higher packet loss rate may indicate an unreliable network environment, which may lead to data tampering or loss, and the ΔMIV value may be increased.

[0142] Reference Item 3, Network Load: If the network load is high, it may mean that the intermediate nodes are more vulnerable to attack or abuse, so the value of ΔMIV can be increased.

[0143] Reference item 4, Path Security: If the path that a data packet passes through involves multiple unsafe nodes or the intermediate nodes are untrusted, the value of ΔMIV can be increased.

[0144] Reference Item 5, Attack Detection: If the system detects potential attacks or abnormal behaviors (such as tampering, replay attacks, etc.) in real time, the value of ΔMIV can be increased to reflect the potential risk.

[0145] In an embodiment of the present application, a method for updating the message integrity of a target data packet is provided. By using a value based on a preset value or a value adaptively adjusted according to the actual situation of the network as a reduction coefficient, and updating the message integrity based on the product of the reduction coefficient and the number of modifications, the impact of real-time network changes and the number of modifications can be quantified, so that the message integrity can reflect the integrity of the data packet forwarded by the node, thereby helping to more accurately evaluate the malicious behavior of the node.

[0146] 3. Energy level:

[0147] For any node, the energy level of the node is determined in the following manner:

[0148] The energy level of any one node is determined based on the ratio of the sum of the number of data packets sent and received by any one node and the battery power of any one node to the total number of nodes in the network.

[0149] In this application, the number of packets sent and received by a node reflects its activity in the network, and the battery power reflects the energy reserve of the node. Nodes with sufficient power have stronger sustainability and can remain active for a longer period of time. The activity and power status of a single node in the network can be evaluated by the ratio of the sum of the number of packets sent and received by the node and the battery power to the total number of nodes in the network.

[0150] Therefore, the energy level determined by the application based on the number of packets sent and received by the node and the battery power can reflect the activity and power status of the node. Specifically, the energy level of a node is calculated as shown in the following formula:

[0151]

[0152] Where, Energy node is the energy level, PF is the number of packets sent by the node, PR is the number of packets received by the node, BP is the battery power of the node, i-j is the number of nodes in the network, indicating that the number of nodes in the network ranges from i to j.

[0153] 4. Resource scoring:

[0154] For any node, the resource score of the node is determined in the following manner:

[0155] The resource score of the any one of the nodes is determined based on a result of weighted summation of the energy level, processing capability, memory and communication range of the any one of the nodes.

[0156] As can be seen from the above embodiments, the energy level of the present application reflects the power status and activity of the node, so in the embodiments of the present application, the energy level can be used as a reference indicator for resource scoring of a node. The reasons for selecting the other three reference indicators: processing power, memory and communication range are as follows:

[0157] Processing capacity: refers to the number of operations that a node can perform per unit time. Processing capacity reflects the computing power of a node. Nodes with high processing capacity can process data packets faster and improve the response speed of the network.

[0158] Memory: Memory reflects the storage capacity of a node. A node with high memory can store more data and has higher data forwarding efficiency.

[0159] Communication range: The communication range reflects the coverage capability of a node. A node with a high communication range can communicate with more nodes and has stronger data forwarding capabilities.

[0160] Therefore, in an embodiment of the present application, the resource score of a node is determined by the node's energy level, processing power, memory, and communication range, and the weight of each indicator in the resource score is adjusted according to the specific application scenario, so that the resource score of the node can fully reflect the node's data transmission capabilities under different scenario requirements.

[0161] Specifically, the resource score of a node is calculated as shown in the following formula:

[0162] R=w1·Energy node +w2·P node +w3·Mem node +w4·C node Formula 4

[0163] Where R is the resource score, Energy node is the energy level, P node is the processing power, Mem node is memory, C node is the communication range, w1~w4 are the weight coefficients of various indicators, and the sum of the weight coefficients is 1.

[0164] Among them, the processing capacity of a node P node The calculation method is shown in the following formula:

[0165] P node =f·i Formula 5

[0166] Where f is the processor clock frequency (in Hertz), and i is the number of packets that the node can forward per clock cycle.

[0167] Mem of a node node The calculation method is shown in the following formula:

[0168] Mem node =RAM total -Mem used Formula 6

[0169] In the formula, RAM total is the total memory of the node, Mem used Is the memory used by the node, Mem used Maintained by the memory usage table in the node.

[0170] The communication range of a node is determined by the transmission power and receiving sensitivity of the wireless signal. node The calculation method of can refer to the existing technology and will not be introduced here.

[0171] Optionally, for any node, after determining its battery power, processing power, memory and communication range, and before determining the node's energy level and resource score, the present application also performs a threshold judgment on the node's battery power, processing power, memory and communication range to confirm whether the node is in an abnormal state. If the node is in an abnormal state, the node can be directly judged as an untrusted node, and the malicious node detection will no longer be performed on the node. For example, when the node's battery power is 0 or the communication range is lower than the set value, the node is directly considered to be in an abnormal state, and the malicious node detection will no longer be performed on the node.

[0172] S102: Determine the comprehensive trust value of each node based on the forwarding success rate, message integrity and energy level of each node, where the comprehensive trust value represents the credibility of the node.

[0173] It can be seen from the above embodiments that a high forwarding success rate indicates that a node can stably forward data packets in the network with high reliability; a high message integrity indicates that a node can maintain the integrity of data when forwarding data packets, and the degree of data tampering is low; a high energy level indicates that a node is highly active and has strong long-term survival ability. Moreover, considering that the forwarding success rate, message integrity and energy level can be adjusted and changed dynamically in real time according to the actual behavior of the node, in comparison, although the resource score is also dynamic, it changes relatively slowly.

[0174] Therefore, the comprehensive trust value obtained by combining the three indicators of forwarding success rate, message integrity and energy level in this application can initially and comprehensively reflect the credibility of the node and serve as a dimension of data for subsequent input classification decision models.

[0175] Optionally, the present application determines the comprehensive trust value of each node based on the sum of the forwarding success rate, message integrity and energy level of each node. The calculation method of the comprehensive trust value of a node is shown in the following formula:

[0176] InteTrust node =Trust node +MIV node +Energy node Formula 7

[0177] In the formula, InteTrust node Is the comprehensive trust value, Trust node is the forwarding success rate of the node, MIV node is the message integrity of the node, Energy node is the energy level of the node.

[0178] Optionally, for Formula 7, the present application can also determine the comprehensive trust value of each node based on the weighted sum of the forwarding success rate, message integrity and energy level of each node, and the specific weight of each indicator is set according to the actual scenario and needs.

[0179] In some embodiments, for any node, the present application converts the comprehensive trust value InteTrust of each node into node After normalizing to 0 to 1, and dividing each node into different trust levels according to the normalization results, it is also confirmed based on the trust level of the node whether the node is in an abnormal state and whether subsequent steps need to be performed on the node.

[0180] For example, this application sets the normalized comprehensive trust value to correspond to 4 trust levels: 0-0.4 is "low trust", 0.41-0.6 is "medium trust", 0.61-0.8 is "high trust", and 0.81-1 is "extremely high trust". If the trust level of a node is low trust, the node can be directly judged as an untrusted node, and the current and subsequent malicious node detections will no longer be performed on the node; if the trust level of a node is medium trust, the node can be directly judged as an untrusted node, and the current malicious node detection will no longer be performed on the node, but the next malicious node detection can still be performed.

[0181] Specifically, for a node, its comprehensive trust value InteTrust node The normalization formula is as follows:

[0182]

[0183] In the formula, InteTrust norm InteTrust node The normalized result, μ is InteTrust node The mean of InteTrust node The standard deviation of .

[0184] S103: The comprehensive trust value, message integrity and resource score of each node are input into the pre-trained classification decision model, and each node is divided into a trusted node and an untrusted node based on the output classification result.

[0185] It can be seen from the aforementioned embodiments that the comprehensive trust value can initially and relatively comprehensively reflect the credibility of the node; the message integrity characterizes the integrity and degree of tampering of the data when the node forwards the data packet; the resource score characterizes the transmission capacity of the node. Therefore, in order to identify untrusted nodes before malicious behavior is fully revealed and improve the overall security of the network, the present application inputs the comprehensive trust value, message integrity and resource score of each node into the pre-trained classification decision model, and divides each node into a trusted node and an untrusted node based on the output classification result.

[0186] As a feasible implementation method, the present application generates and stores node attributes and node classification results through a multidimensional decision table (MDT). Figure 2 The figure shows a schematic diagram of a multidimensional decision table describing a node context provided by an embodiment of the present application. Specifically, the multidimensional decision table consists of a context classification table and a result output T output The context classification table is used to store the three context dimensions of the node (comprehensive trust value, message integrity and resource score) and the values ​​related to the three dimensions. The result is output as T output The table is used to store the classification results of the nodes. If there are n nodes, the formula of the multidimensional decision table is as follows:

[0187]

[0188] Where, T out (Node i ) is the classification result of node i, T trust (Node i ) is the comprehensive trust value of node i, T MIV (Node i ) is the message integrity of node i, T prop (Node i ) is the resource score of node i.

[0189] 3 context classification tables including comprehensive trust value table T trust , message completeness table T MIV , resource rating table T prop ; Specifically, 3 context classification tables and result output table T output The steps for generating are as follows.

[0190] 1. Comprehensive trust value table T trust

[0191] T trust The comprehensive trust value of the node InteTrust node The normalized value InteTrust normThe value is 0-1. Each row represents a node, and a column represents the comprehensive trust value of the node. The table structure is as follows:

[0192] Node <![CDATA[InteTrust norm ]]>

[0193] Table 1 T_trust table structure

[0194] 2. Message completeness table T MIV

[0195] T MIV It consists of the message integrity MIV field of the node. Each row represents a node, one column represents the message integrity MIV of the data packet forwarded by the node, and one column represents the number of times the node has modified the data packet. Each time the message integrity of the node is determined, only the MIV of the row with the largest number of times is taken from the data in the table. The table structure is as follows:

[0196] Node MIV Times

[0197] Table 2T MIV Table Structure

[0198] 3. Resource Rating Table T prop

[0199] T prop It is composed of the node's resource score R value, which changes continuously during network changes. prop By energy levelEnergy node , Processing Capacity node , Memory Mem node 、Communication range C node Each row represents a node, and the table structure is as follows:

[0200] Node R <![CDATA[Energy node ]]> <![CDATA[P node ]]> <![CDATA[Mem node ]]> <![CDATA[C node ]]>

[0201] Table 3T prop Table Structure

[0202] 4. Result output table T output

[0203] T output It consists of the classification result Output of the node by the classification decision model.

[0204] Node Output

[0205] Table 4T output Table Structure

[0206] In some embodiments, the present application detects malicious nodes based on a multidimensional decision table, which can integrate the contextual information of all nodes in the network, effectively handle uncertainties in the network, and improve the comprehensiveness of malicious node detection. Moreover, the decision logic of the multidimensional decision table has strong scalability and can be adjusted through machine learning or expert knowledge. By adding tables corresponding to different dimensions, it can adapt to the ever-changing network environment and optimize the detection effect.

[0207] As a feasible implementation, the classification decision model is trained using the following steps S401-S403:

[0208] S401, after receiving sample data of normal nodes and malicious nodes, pre-process the sample data, the sample data includes comprehensive trust value, message integrity and resource score.

[0209] S402, dividing the preprocessed sample data into a training set and a validation set.

[0210] S403, training the classification decision model based on the training set, and optimizing the weight and bias value of the classification decision model based on the gradient descent method and the loss function until the classification decision model meets the preset end condition.

[0211] Optionally, the above-mentioned end condition is that the classification accuracy of the classification decision model on the validation set meets the preset requirements or the number of training times reaches a preset threshold.

[0212] In some embodiments, the classification decision model is formed by the perceptron linear decision function PLA, and the feature vector of each node input classification decision model is composed of the items in the above three tables 1-3: comprehensive trust value InteTrust norm , message integrity MIV and resource score R.

[0213] If there are n nodes in the network, the sample vector input to the classification decision model can be expressed as: X n ={x1,x2…x t} T , t represents the number of dimensions (in this application, t=3, corresponding to the three input dimensions of comprehensive trust value, message integrity and resource score), n represents the nth node; the sample output y can be classified into malicious nodes (1) and malicious nodes (-1).

[0214] For example, when the training set includes 100 samples, 50 positive samples and 50 negative samples, the feature dimension is set to 1. The decision rule formula of the classification decision model is as follows:

[0215]

[0216] In the formula, x∈X n, for example, the trust node boundary value is set at 0.41, so the bias value b is -0.41. For each training sample (x i ,y i ), calculate the perceptron output y i ′ =w T x i +b, and output y according to the perceptron i ′ Compared with the actual situation i In contrast, if the predicted distance is too large, the weight vector w and bias b can be updated according to the PLA learning rule:

[0217] w←w+η·(y i ′ -y i )·x i

[0218] b←b+η·(y i ′ -y i )

[0219] Among them, η is the learning rate. In order to reduce the computational cost and improve the efficiency of model training, the gradient descent method is used to optimize the classification line by calculating the gradient and updating the parameters as follows:

[0220]

[0221] The overall loss function sums the losses of all training samples as follows:

[0222]

[0223] Among them, L(w,b) is the loss function, are the gradients of the loss function with respect to weights and biases, respectively.

[0224] According to the weight vector w and bias b finally obtained from the training, the final f(x)=sign(w·x+b) function is obtained by the above-mentioned perceptron method, and a classification decision model that can judge malicious nodes in the mobile ad hoc network is obtained.

[0225] As a feasible implementation manner, the method further includes:

[0226] An authentication node is selected from each trusted node based on the comprehensive trust value of each trusted node, and the selected authentication node is notified to the trusted nodes in the network, so that when the authentication node determines that the source node and the destination node corresponding to the forwarding request are both trusted nodes, the authentication node generates a certificate for encrypting and verifying the data packet for the source node and the destination node.

[0227] It can be seen from the aforementioned embodiments that the present application obtains a comprehensive trust value by combining the three indicators of forwarding success rate, message integrity and energy level, which can initially and comprehensively reflect the credibility of the node. Therefore, the present application selects an authentication node from each trusted node based on the comprehensive trust value of each node, and notifies the trusted nodes in the network of the selected authentication node, so that the authentication node can generate a certificate for encrypting and verifying data packets for the trusted nodes that need to forward data packets, which can effectively identify and isolate non-trusted nodes and improve the security of the network.

[0228] Optionally, this application selects the trusted node with the highest comprehensive trust value as the authentication node, such as Figure 3 As shown, it is a schematic diagram of the authentication node selection process provided in an embodiment of the present application, including the following steps S501-S503.

[0229] S501, determining the comprehensive trust value of each node.

[0230] The method for confirming the comprehensive trust value of each node can refer to the above-mentioned embodiment and will not be repeated here.

[0231] S502, select the trusted node with the highest comprehensive trust value as the authentication node, and notify other trusted nodes in the network of the selected authentication node.

[0232] S503, determining whether the certificate generated by the current authentication node is expired, if so, executing step S501, if not, executing step S503.

[0233] Optionally, the validity period of the certificate generated by the authentication node depends on the period of malicious node detection, that is, each time the malicious node detection method provided in the aforementioned embodiment is executed and a new authentication node is selected, the certificate of the previous authentication node expires.

[0234] Optionally, in addition to reaching the detection cycle, the triggering condition of the malicious node detection method in the aforementioned embodiment also includes detecting that the authentication node is disconnected from the network. At this time, the network will select a new authentication node and notify other trusted nodes in the network.

[0235] In some embodiments, when the authentication node cannot communicate, the malicious node detection method in the aforementioned embodiment may be executed again to select a new authentication node.

[0236] In some embodiments, when the authentication node cannot communicate, the trusted node with the highest trust value among the remaining trusted nodes is selected as the new authentication node. By replacing the authentication, the single point failure when the node moves out of range in the network is avoided, and the network security bottleneck is avoided. As long as the issued certificate is valid, the trusted nodes will communicate with each other.

[0237] The malicious node protection method performed by the authentication node, source node and destination node is described below.

[0238] In some embodiments, the present application provides a malicious node protection method applied to an authentication node, the method comprising the following steps S601-S603:

[0239] S601, after determining that it is an authentication node based on a notification received from the network, it receives forwarding requests from other nodes in the network.

[0240] Among them, the above-mentioned authentication nodes are selected by the network from the trusted nodes based on the comprehensive trust value of each trusted node, and the trusted nodes are determined by the network based on the classification results obtained after inputting the comprehensive trust value, message integrity and resource score of each node into the pre-trained classification decision model.

[0241] S602: After receiving the forwarding request, determine the source node and the destination node corresponding to the forwarding request according to the source node identifier and the destination node identifier in the forwarding request.

[0242] S603, if the source node and the destination node are trusted nodes, a first certificate is generated for the source node and the first certificate is sent to the source node, so that the source node uses the first certificate to encrypt the data packet and sends it to the destination node, and a second certificate is generated for the destination node and the second certificate is sent to the destination node, so that the destination node uses the second certificate to decrypt the data packet received from the source node.

[0243] In an embodiment of the present application, the authentication node verifies the forwarding requests sent by other nodes, and generates certificates for encrypting and verifying data packets for the verified source nodes and destination nodes, which can effectively identify and isolate untrusted nodes, ensure the security and integrity of data packets during transmission, and improve the security of the network.

[0244] Optionally, generating a first certificate for a source node and generating a second certificate for a destination node include the following steps S701-S703:

[0245] S701, generating a first public key and a first private key for a source node, wherein the first public key is used to encrypt a data packet, and the first private key is used to decrypt a data packet encrypted by the first public key;

[0246] S702, generating a second public key and a second private key for the destination node, wherein the second public key is used to encrypt the data packet, and the second private key is used to decrypt the data packet encrypted by the second public key;

[0247] S702, based on the generated first public key, first private key, second public key and second private key, generate a first certificate for the source node and a second certificate for the destination node, the first certificate containing the first private key and the second public key, and the second certificate containing the second private key and the first public key.

[0248] In some embodiments, the present application provides a malicious node protection method applied to a source node, the method comprising the following steps S801-S803:

[0249] S801, determining an authentication node according to a notification received from the network.

[0250] The above authentication nodes are selected by the network from the trusted nodes based on the comprehensive trust values ​​of each trusted node. The trusted nodes are determined by the network based on the classification results obtained after the comprehensive trust values, message integrity and resource scores of each node are input into the pre-trained classification decision model;

[0251] S802, when it is necessary to forward a data packet to a destination node, initiate a forwarding request to the authentication node, the forwarding request includes a source node identifier and a destination node identifier, so that after the authentication node determines that the source node corresponding to the source node identifier and the destination node corresponding to the destination node identifier are trusted nodes, the authentication node sends a first certificate to the source node and sends a second certificate to the destination node, the first certificate includes a first private key and a second public key, the second certificate includes a second private key and a first public key, the first public key is used to encrypt a data packet, the first private key is used to decrypt a data packet encrypted by the first public key, the second public key is used to encrypt a data packet, and the second private key is used to decrypt a data packet encrypted by the second public key.

[0252] It should be noted that, in this application, when the source node needs to forward a data packet to the destination node and does not have a valid second public key, it initiates a forwarding request to the authentication node.

[0253] S803, after receiving the first certificate from the authentication node, encrypt the data packet using the second public key included in the first certificate and forward it to the destination node.

[0254] In an embodiment of the present application, when a source node needs to forward a data packet to a destination node with which it has not communicated, it first sends a forwarding request generated based on its own source node identifier and the destination node identifier of the destination node to the authentication node, and uses the first certificate received from the authentication node to encrypt the data packet and transmit it to the destination node. This can effectively identify and isolate untrusted nodes, thereby ensuring the security and integrity of the data packet during transmission and improving the security of the network.

[0255] In some embodiments, the present application provides a malicious node protection method applied to a destination node, the method comprising the following steps S901-S903:

[0256] S901, receiving a second certificate sent by an authentication node.

[0257] The above-mentioned authentication node is selected by the network from the trusted nodes based on the comprehensive trust value of each trusted node. The trusted node is determined by the network according to the classification result obtained after the comprehensive trust value, message integrity and resource score of each node are input into the pre-trained classification decision model. The second certificate is generated after the authentication node determines that the source node and the destination node corresponding to the forwarding request belong to the trusted nodes. The forwarding request is sent by the source node to the authentication node. The second certificate contains the second private key and the first public key.

[0258] S902, receiving a data packet sent by a source node.

[0259] The data packet sent by the source node is obtained after the source node encrypts it using the second public key contained in the first certificate. The first certificate is generated after the authentication node determines that the source node and the destination node corresponding to the forwarding request are trusted nodes. The first certificate contains a first private key and a second public key. The first public key is used to encrypt the data packet, and the first private key is used to decrypt the data packet encrypted by the first public key. The second public key is used to encrypt the data packet, and the second private key is used to decrypt the data packet encrypted by the second public key.

[0260] S903: Decrypt the data packet sent by the source node using the second private key.

[0261] In an embodiment of the present application, after the destination node receives the second certificate from the authentication node, it uses the second certificate to decrypt the data packet received from the source node, which can effectively identify and isolate untrusted nodes, thereby ensuring the security and integrity of the data packet during transmission and improving the security of the network.

[0262] In order to better illustrate the interaction steps of the authentication node, source node and destination node corresponding to the malicious node protection method of the present application, take the network including the trusted node, source node A and destination node B, and the source node A needs to forward the data packet to the destination node B as an example, Figure 4 As shown, it is a schematic diagram of node interaction provided in an embodiment of the present application, and the interaction process includes the following steps S1001-S1009:

[0263] S1001, after the authentication node confirms itself as an authentication node, it generates a shared key S.key between trusted nodes, and notifies nodes A and B of its own authentication node identity and shared key.

[0264] The above shared key is used to encrypt messages transmitted between trusted nodes.

[0265] S1002, source node A determines the authentication node and shared key according to the notification received from the network.

[0266] S1003, source point A uses the shared key to encrypt the forwarding request and sends it to the authentication node.

[0267] Specifically, when source node A needs to forward a data packet to destination node B, it generates a forwarding request and encrypts it and sends it to the authentication node to request a certificate from the authentication node. The forwarding request contains the source node ID (S ID ), the destination node ID of the destination node B (D ID ), the request information is encrypted using the shared key S.key received by the authentication node previously.

[0268] S1004, the authentication node decrypts the forwarding request, and when determining that the decrypted source node identifier and destination node identifier are trusted nodes, generates a first public key and a first private key for source node A, and generates a second public key and a second private key for destination node B.

[0269] The first public key (P.key) s Used to encrypt data packets, the first private key (Pr.key) s Used to decrypt the first public key (P.key) s Encrypted data packet; the second public key (P.key) d Used to encrypt data packets, the second private key (Pr.key) d Used to decrypt the second public key (P.key) d Encrypted data packets;

[0270] Optional, if the decrypted S ID and D ID If the forwarding request includes an untrusted node, the forwarding request is discarded.

[0271] S1005, the authentication node generates a first certificate for the source node A, and generates a second certificate for the destination node B.

[0272] For example, the first certificate: A =[S ID ,(Pr.key) s ,(P.key) d ]; Second certificate: Certificate B =[D ID ,(Pr.key) d ,(P.key) s ].

[0273] S1006, the authentication node encrypts the first certificate using a shared key and sends the encrypted certificate to the source node A.

[0274] S1007, the authentication node encrypts the second certificate with the shared key and sends it to the destination node B.

[0275] S1008, after decrypting the first certificate received from the authentication node, the source node A encrypts the data packet using the decrypted second public key and forwards it to the destination node B.

[0276] S1009, the destination node B receives the second certificate sent by the authentication node, and decrypts the data packet using the decrypted second private key.

[0277] It should be noted that when node B needs to send a data packet to node A later, it can confirm the second certificate Certificate B After it is valid, directly use the first public key (P.key) s After encrypting the data packet, it can be forwarded to node A.

[0278] Embodiment 2:

[0279] Based on the same technical concept, on the basis of the above embodiments, in an embodiment of the present application, a malicious node detection device is provided. Figure 5 A schematic diagram of the structure of a malicious node detection device provided in an embodiment of the present application. Figure 5 As shown, the device comprises:

[0280] The first evaluation data preparation module 501 is used to determine the forwarding success rate, message integrity, energy level and resource score of each node based on the monitoring data of each node in the network, wherein the message integrity represents the integrity of the data packet forwarded by the node, the energy level represents the activity and power status of the node, and the resource score represents the transmission capacity of the node;

[0281] A second evaluation data preparation module 502 is used to determine a comprehensive trust value of each node based on the forwarding success rate, message integrity and energy level of each node, wherein the comprehensive trust value represents the credibility of the node;

[0282] The node attribute classification module 503 is used to input the comprehensive trust value, message integrity and resource score of each node into the pre-trained classification decision model, and classify each node into a trusted node and an untrusted node based on the output classification result.

[0283] Embodiment 3:

[0284] Based on the same technical concept, on the basis of the above embodiments, in the embodiment of the present application, a malicious node protection device is provided. The device includes:

[0285] The authentication node identity confirmation module 601 is used to receive forwarding requests from other nodes in the network after determining that it is an authentication node based on the notification received from the network; wherein the authentication node is selected by the network from the trusted nodes based on the comprehensive trust value of each trusted node, and the trusted node is determined by the network based on the classification result obtained by inputting the comprehensive trust value, message integrity and resource score of each node into the pre-trained classification decision model;

[0286] The forwarding request verification module 602 is used to determine the source node and the destination node corresponding to the forwarding request according to the source node identifier and the destination node identifier in the forwarding request after receiving the forwarding request;

[0287] The certificate generation module 603 is used to generate a first certificate for the source node and send the first certificate to the source node if the source node and the destination node are trusted nodes, so that the source node uses the first certificate to encrypt the data packet and sends it to the destination node; and to generate a second certificate for the destination node and send the second certificate to the destination node, so that the destination node uses the second certificate to decrypt the data packet received from the source node.

[0288] Embodiment 4:

[0289] Based on the same technical concept, on the basis of the above embodiments, in an embodiment of the present application, a malicious node protection device is provided, the device comprising:

[0290] The authentication node determination module 701 is used to determine the authentication node according to the notification received from the network, wherein the authentication node is selected by the network from the trusted nodes based on the comprehensive trust value of each trusted node, and the trusted node is determined by the network according to the classification result obtained by inputting the comprehensive trust value, message integrity and resource score of each node into the pre-trained classification decision model;

[0291] The request initiation module 702 is used to initiate a forwarding request to the authentication node when it is necessary to forward a data packet to a destination node, the forwarding request including a source node identifier and a destination node identifier, so that the authentication node sends a first certificate to the source node and sends a second certificate to the destination node after determining that the source node corresponding to the source node identifier and the destination node corresponding to the destination node identifier are trusted nodes, the first certificate including a first private key and a second public key, the second certificate including a second private key and a first public key, the first public key being used to encrypt a data packet, the first private key being used to decrypt a data packet encrypted by the first public key, the second public key being used to encrypt a data packet, and the second private key being used to decrypt a data packet encrypted by the second public key;

[0292] The encryption module 703 is used to, after receiving the first certificate from the authentication node, encrypt the data packet using the second public key included in the first certificate and then forward it to the destination node.

[0293] Embodiment 5:

[0294] Based on the same technical concept, on the basis of the above embodiments, in an embodiment of the present application, a malicious node protection device is provided, the device comprising:

[0295] The certificate receiving module 801 is used to receive a second certificate sent by an authentication node, wherein the authentication node is selected by the network from the trusted nodes based on the comprehensive trust value of each trusted node, and the trusted node is determined by the network according to the classification result obtained after the comprehensive trust value, message integrity and resource score of each node are input into a pre-trained classification decision model, the second certificate is generated by the authentication node after determining that the source node and the destination node corresponding to the forwarding request belong to the trusted nodes, the forwarding request is sent by the source node to the authentication node, and the second certificate includes a second private key and a first public key;

[0296] The data packet receiving module 802 is used to receive a data packet sent by the source node, where the data packet sent by the source node is obtained by encrypting the data packet by the source node using the second public key contained in the first certificate, where the first certificate is generated after the authentication node determines that the source node and the destination node corresponding to the forwarding request are trusted nodes, where the first certificate contains a first private key and the second public key, where the first public key is used to encrypt the data packet, where the first private key is used to decrypt the data packet encrypted by the first public key, where the second public key is used to encrypt the data packet, where the second private key is used to decrypt the data packet encrypted by the second public key;

[0297] The decryption module 803 is used to decrypt the data packet sent by the source node using the second private key.

[0298] Embodiment 6:

[0299] Based on the same technical concept, on the basis of the above embodiments, in the embodiment of the present application, an electronic device 900 is further provided. Figure 6 As shown, it includes at least one processor 902; and a memory 901 that is communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the malicious node detection method or the malicious node protection method described in the aforementioned embodiments.

[0300] The memory 901 is used to store programs. Specifically, the program may include program code, and the program code includes computer operation instructions. The memory 901 may be a volatile memory, such as a random access memory (RAM); or a non-volatile memory, such as a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or a combination of any one or more of the above volatile memories and non-volatile memories.

[0301] The processor 902 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and a NP. It may also be a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0302] Embodiment 7:

[0303] Based on the same technical concept, an embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. The computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the malicious node detection method or the malicious node protection method described in the aforementioned embodiment.

[0304] The above-mentioned computer-readable storage medium can be any available medium or data storage device that can be accessed by the processor in the electronic device, including but not limited to magnetic storage such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc., optical storage such as CD, DVD, BD, HVD, etc., and semiconductor storage such as ROM, EPROM, EEPROM, non-volatile memory (NANDFLASH), solid-state drive (SSD), etc.

[0305] Based on the same inventive concept, an embodiment of the present application also provides a computer program product, which includes: a computer program code, when the computer program code runs on a computer, enables the computer to execute any malicious node detection method or malicious node protection method discussed above.

[0306] Since the principle of solving the problem by the above-mentioned computer program product is similar to that of the malicious node detection method, the implementation of the above-mentioned computer program product can refer to the implementation of the method, and the repeated parts will not be repeated.

[0307] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and modules can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0308] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0309] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0310] In addition, each functional module in each embodiment of the present application can be integrated into a processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above-mentioned integrated module can be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium.

[0311] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0312] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, a computer, a server, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server, or data center. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or a data center that includes one or more available media integrations. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state drive (SSD)), etc.

[0313] The technical solution provided by the present application is introduced in detail above. The principles and implementation methods of the present application are explained by using specific examples in the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

[0314] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0315] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0316] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0317] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0318] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A malicious node detection method, characterized in that: include: Based on the monitoring data of each node in the network, determine the forwarding success rate, message integrity, energy level and resource score of each node, wherein the message integrity represents the integrity of the data packet forwarded by the node, the energy level represents the activity and power status of the node, and the resource score represents the transmission capacity of the node; Determine the comprehensive trust value of each node based on the forwarding success rate, message integrity and energy level of each node, wherein the comprehensive trust value represents the credibility of the node; The comprehensive trust value, message integrity and resource score of each node are input into the pre-trained classification decision model, and each node is divided into trusted nodes and untrusted nodes based on the output classification results.

2. The method according to claim 1, characterized in that For any node, the forwarding success rate of the any node is determined by: Determine a ratio of the number of data packets successfully sent by any one node to the same destination node to the number of data packets sent to the same destination node; From the determined ratios, selecting the smallest ratio as the forwarding success rate of any one of the nodes; For any node, the message integrity of the node is determined in the following manner: Selecting the message integrity of the data packet with the most modifications from the message integrity record log corresponding to any one of the nodes as the message integrity of any one of the nodes, wherein the message integrity in the message integrity record log corresponding to any one of the nodes is determined based on the message integrity carried by the data packet received by any one of the nodes and the number of modifications made to the target data packet by any one of the nodes; wherein the target data packet is the data packet forwarded after being modified by any one of the nodes; For any node, the energy level of the node is determined in the following manner: Determining the energy level of any one node based on the ratio of the sum of the number of data packets sent and received by any one node and the battery power of any one node to the total number of nodes in the network; For any node, the resource score of the node is determined in the following manner: The resource score of the any one of the nodes is determined based on a result of weighted summation of the energy level, processing capability, memory and communication range of the any one of the nodes.

3. The method according to claim 2, characterized in that The message integrity record log corresponding to any of the nodes is obtained in the following manner: Based on the number of times the target data packet is modified by any one of the nodes, the message integrity carried by the target data packet is updated, and the updated message integrity of the target data packet and the number of times the target data packet is modified by any one of the nodes are saved in a message integrity record log corresponding to the any one of the nodes; For a data packet that is not modified and forwarded by any one of the nodes, the message integrity and zero modification times carried by the data packet that is not modified and forwarded are directly saved in the message integrity record log corresponding to the any one of the nodes.

4. The method according to claim 3, characterized in that The updating of the message integrity carried by the target data packet based on the number of times the data packet is modified by any one of the nodes includes: Determine the message change value based on the product of a preset reduction coefficient and the number of times the target data packet is modified by any one of the nodes, wherein the reduction coefficient is a preset fixed value or a value dynamically adjusted according to a preset rule, and the preset rule includes adjusting based on a comparison result of at least one of the network real-time load and the delay time for data packet transmission by any one of the nodes with a preset threshold; The difference between the message integrity carried by the target data packet and the message change value is determined, and the message integrity carried by the target data packet is updated to the difference.

5. The method according to claim 1, characterized in that The classification decision model is trained in the following way: After receiving sample data of normal nodes and malicious nodes, preprocessing the sample data, the sample data includes comprehensive trust value, message integrity and resource score; Divide the preprocessed sample data into a training set and a validation set; The classification decision model is trained based on the training set, and the weights and bias values ​​of the classification decision model are optimized based on the gradient descent method and the loss function until the classification decision model meets the preset end condition, and the end condition is that the classification accuracy of the classification decision model on the validation set meets the preset requirements or the number of training times reaches a preset threshold.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: An authentication node is selected from each trusted node based on the comprehensive trust value of each trusted node, and the selected authentication node is notified to the trusted nodes in the network, so that when the authentication node determines that the source node and the destination node corresponding to the forwarding request are both trusted nodes, the source node and the destination node generate a certificate for encrypting and verifying the data packet.

7. A malicious node protection method, characterized in that: include: After determining itself as an authentication node based on the notification received from the network, receiving forwarding requests from other nodes in the network; wherein the authentication node is selected by the network from the trusted nodes based on the comprehensive trust value of each trusted node, and the trusted node is determined by the network based on the classification result obtained by inputting the comprehensive trust value, message integrity and resource score of each node into a pre-trained classification decision model; After receiving the forwarding request, determining the source node and the destination node corresponding to the forwarding request according to the source node identifier and the destination node identifier in the forwarding request; If the source node and the destination node are trusted nodes, a first certificate is generated for the source node and the first certificate is sent to the source node, so that the source node uses the first certificate to encrypt the data packet and sends it to the destination node; and a second certificate is generated for the destination node and the second certificate is sent to the destination node, so that the destination node uses the second certificate to decrypt the data packet received from the source node.

8. The method according to claim 7, characterized in that The generating a first certificate for the source node and generating a second certificate for the destination node comprises: Generate a first public key and a first private key for the source node, wherein the first public key is used to encrypt a data packet, and the first private key is used to decrypt the data packet encrypted by the first public key; Generate a second public key and a second private key for the destination node, wherein the second public key is used to encrypt a data packet, and the second private key is used to decrypt the data packet encrypted by the second public key; Based on the generated first public key, first private key, second public key and second private key, a first certificate is generated for the source node, and a second certificate is generated for the destination node, wherein the first certificate includes the first private key and the second public key, and the second certificate includes the second private key and the first public key.

9. A malicious node protection method, characterized in that: include: Determine, based on the notification received from the network, an authentication node, wherein the authentication node is selected by the network from the trusted nodes based on the comprehensive trust value of each trusted node, wherein the trusted node is determined by the network based on a classification result obtained by inputting the comprehensive trust value, message integrity and resource score of each node into a pre-trained classification decision model; When it is necessary to forward a data packet to a destination node, a forwarding request is initiated to the authentication node, the forwarding request includes a source node identifier and a destination node identifier, so that after the authentication node determines that a source node corresponding to the source node identifier and a destination node corresponding to the destination node identifier are trusted nodes, the authentication node sends a first certificate to the source node and sends a second certificate to the destination node, the first certificate includes a first private key and a second public key, the second certificate includes a second private key and a first public key, the first public key is used to encrypt a data packet, the first private key is used to decrypt a data packet encrypted by the first public key, the second public key is used to encrypt a data packet, and the second private key is used to decrypt a data packet encrypted by the second public key; After receiving the first certificate from the authentication node, the data packet is encrypted using the second public key included in the first certificate and then forwarded to the destination node.

10. A malicious node protection method, characterized in that: include: receiving a second certificate sent by an authentication node, the authentication node being selected by the network from trusted nodes based on comprehensive trust values ​​of the trusted nodes, the trusted nodes being determined by the network based on a classification result obtained by inputting the comprehensive trust values, message integrity, and resource scores of the nodes into a pre-trained classification decision model, the second certificate being generated by the authentication node after determining that a source node and a destination node corresponding to a forwarding request are trusted nodes, the forwarding request being sent by the source node to the authentication node, and the second certificate comprising a second private key and a first public key; receiving a data packet sent by the source node, where the data packet sent by the source node is obtained by encrypting the data packet by the source node using the second public key included in the first certificate, where the first certificate is generated after the authentication node determines that the source node and the destination node corresponding to the forwarding request are trusted nodes, where the first certificate includes a first private key and the second public key, where the first public key is used to encrypt the data packet, where the first private key is used to decrypt the data packet encrypted by the first public key, where the second public key is used to encrypt the data packet, where the second private key is used to decrypt the data packet encrypted by the second public key; The data packet sent by the source node is decrypted using the second private key.

11. A malicious node detection device, characterized in that: include: A first evaluation data preparation module is used to determine the forwarding success rate, message integrity, energy level and resource score of each node based on the monitoring data of each node in the network, wherein the message integrity represents the integrity of the data packet forwarded by the node, the energy level represents the activity and power status of the node, and the resource score represents the transmission capacity of the node; A second evaluation data preparation module is used to determine a comprehensive trust value of each node based on the forwarding success rate, message integrity and energy level of each node, wherein the comprehensive trust value represents the credibility of the node; The node attribute classification module is used to input the comprehensive trust value, message integrity and resource score of each node into the pre-trained classification decision model, and classify each node into a trusted node and an untrusted node based on the output classification results.

12. A malicious node protection device, characterized in that: include: An authentication node identity confirmation module, used to receive forwarding requests from other nodes in the network after determining that it is an authentication node based on a notification received from the network; wherein the authentication node is selected by the network from the trusted nodes based on the comprehensive trust value of each trusted node, and the trusted node is determined by the network based on the classification result obtained after the comprehensive trust value, message integrity and resource score of each node are input into a pre-trained classification decision model; A forwarding request verification module, configured to determine the source node and the destination node corresponding to the forwarding request according to the source node identifier and the destination node identifier in the forwarding request after receiving the forwarding request; A certificate generation module is used to generate a first certificate for the source node and send the first certificate to the source node if the source node and the destination node are trusted nodes, so that the source node uses the first certificate to encrypt a data packet and sends it to the destination node; and to generate a second certificate for the destination node and send the second certificate to the destination node, so that the destination node uses the second certificate to decrypt the data packet received from the source node.

13. A malicious node protection device, characterized in that: include: An authentication node determination module, for determining an authentication node according to a notification received from the network, wherein the authentication node is selected by the network from the trusted nodes based on the comprehensive trust value of each trusted node, wherein the trusted node is determined by the network based on a classification result obtained by inputting the comprehensive trust value, message integrity and resource score of each node into a pre-trained classification decision model; a request initiation module, configured to initiate a forwarding request to the authentication node when a data packet needs to be forwarded to a destination node, the forwarding request including a source node identifier and a destination node identifier, so that the authentication node sends a first certificate to the source node and sends a second certificate to the destination node after determining that the source node corresponding to the source node identifier and the destination node corresponding to the destination node identifier are trusted nodes, the first certificate including a first private key and a second public key, the second certificate including a second private key and a first public key, the first public key being used to encrypt a data packet, the first private key being used to decrypt a data packet encrypted by the first public key, the second public key being used to encrypt a data packet, and the second private key being used to decrypt a data packet encrypted by the second public key; The encryption module is used to, after receiving the first certificate from the authentication node, encrypt the data packet using the second public key included in the first certificate and then forward it to the destination node.

14. A malicious node protection device, characterized in that: include: a certificate receiving module, configured to receive a second certificate sent by an authentication node, wherein the authentication node is selected by the network from the trusted nodes based on the comprehensive trust value of each trusted node, the trusted node is determined by the network according to a classification result obtained by inputting the comprehensive trust value, message integrity and resource score of each node into a pre-trained classification decision model, the second certificate is generated by the authentication node after determining that the source node and the destination node corresponding to the forwarding request belong to the trusted nodes, the forwarding request is sent by the source node to the authentication node, and the second certificate includes a second private key and a first public key; a data packet receiving module, configured to receive a data packet sent by the source node, wherein the data packet sent by the source node is obtained by encrypting the data packet by the source node using the second public key contained in the first certificate, wherein the first certificate is generated after the authentication node determines that the source node and the destination node corresponding to the forwarding request are trusted nodes, wherein the first certificate contains a first private key and the second public key, wherein the first public key is used to encrypt a data packet, and the first private key is used to decrypt a data packet encrypted by the first public key, and the second public key is used to encrypt a data packet, and the second private key is used to decrypt a data packet encrypted by the second public key; A decryption module is used to decrypt the data packet sent by the source node using the second private key.

15. A malicious node protection device, characterized in that: The invention comprises at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method as described in any one of claims 1 to 6, or execute the method as described in any one of claims 7 to 8, or execute the method as described in claim 9, or execute the method as described in claim 10.

Images