Centralized malicious node detection method and system based on neural network sensor

Abstract

The invention discloses a centralized malicious node detection method and system based on a neural network sensor, and relates to the technical field of Internet of Things security protection, and the method comprises the steps: injecting a data packet into an Internet of Things node, and constructing a detection equation set; constructing a node trust matrix, and performing multiple linear regression training on the detection equation set; and inputting the node trust value into a K-means model for clustering. According to the centralized malicious node detection method based on the neural network sensor, the preset specific data packet is injected into the Internet of Things network, so that the applicability of a detection system in different environments is improved, the credibility of the nodes in the network is quantified, the preliminary recognition capability of the system on the malicious nodes is enhanced, and the detection efficiency is improved. According to the method, the nodes are clustered through the K-means model, safe and stable operation of the Internet of Things network is ensured, the detection equation set is trained through the neural network sensor, the adaptability and stability of the algorithm are improved, and the method achieves better effects in the aspects of applicability, safety and stability.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things security protection, and in particular to a centralized malicious node detection method based on a neural network sensor. Background Art

[0002] With the diversification of user service demands and the improvement of service quality requirements, and under the application requirements of different scenarios, the promotion and use of multi-functional standard sources and digital multimeters have made the originally unidirectional and rigid power grid become more and more open. The network nodes widely deployed in the power monitoring network have become the core factor restricting network security.

[0003] While providing powerful detection capabilities, centralized malicious node detection technology also faces limitations such as communication monitoring blind spots, difficulty in locating malicious nodes, high resource consumption, single point failure risks, and limited scalability. Attacks occurring between nodes may be difficult to detect in a timely manner, thereby increasing the security risks of the network. In addition, since the central node cannot directly obtain detailed communication information of nodes within the network, it faces great difficulties in locating the specific location of malicious nodes, which may lead to response delays and increase the potential damage caused by malicious behavior to the network. As the scale of the Internet of Things expands, centralized detection technology may face bottlenecks in processing power and storage capacity. Central nodes need to process data and information from a large number of nodes, which may lead to reduced detection efficiency and even inability to effectively respond to new security threats. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problem solved by the present invention is: the existing centralized malicious node detection method has the problem of difficulty in locating malicious nodes, high resource consumption, and the optimization problem of how to effectively detect and accurately locate malicious nodes.

[0006] To solve the above technical problems, the present invention provides the following technical solutions: a centralized malicious node detection method based on a neural network sensor, comprising injecting a data packet into an Internet of Things node to construct a detection equation set; constructing a node trust matrix and performing multivariate linear regression training on the detection equation set; and inputting the node trust value into a K-means model for clustering.

[0007] As a preferred solution of the centralized malicious node detection method based on neural network sensor described in the present invention, wherein: the injecting of data packets into the Internet of Things node includes injecting data packets into a known Internet of Things node, introducing the data packets to be injected into the network by requesting this node to forward the data packets, or setting the Internet of Things device to generate data for communication as the injected data packets.

[0008] As a preferred solution of the centralized malicious node detection method based on neural network sensor described in the present invention, wherein: the construction of the detection equation set includes constructing the detection equation set based on the data packet received by the base station node, injecting the data packet into the Internet of Things node, and the path is expressed as:

[0009] Path1=<N i ,N 11 ,N 12 ,...,N 1c1 ,D>

[0010] Path2=<N i ,N 21 ,N 22 ,...,N 2c2 ,D>

[0011] …

[0012] Path m =<N i ,N m1 ,N m2 ,...,N mcm ,D>

[0013] Where D is the base station node, N i For IoT nodes.

[0014] As a preferred solution of the centralized malicious node detection method based on neural network sensor described in the present invention, wherein: the construction of the detection equation set also includes defining the trust value of the path as:

[0015]

[0016] Among them, the trust value of the mth path is expressed as:

[0017]

[0018] Among them, N i If ·T and D·T are both 1, the trust value of the mth path is expressed as:

[0019]

[0020]

[0021] Combining all path trust values, the detection equation set is expressed as:

[0022]

[0023] Among them, T is the measure of node trust.

[0024] As a preferred solution of the centralized malicious node detection method based on neural network sensor described in the present invention, wherein: the node trust matrix is ​​constructed including the existence of a path in the Internet of Things to construct a node trust matrix, and the node trust matrix is ​​expressed as:

[0025] R=(ln(N1·T),ln(N2·T),ln(N3·T),...,ln(N n ·T))

[0026] Constructing the existence matrix is ​​expressed as:

[0027]

[0028] Among them, if N i ∈Path j , a ij is 0, a ij is 1, and the constructed path trust matrix is ​​expressed as:

[0029] P=(ln(Path1·T),ln(Path2·T),ln(Path3·T),...,ln(Path m ·T))

[0030] R×E=P

[0031] The goal of malicious node detection is transformed into finding an approximate solution to R. The more accurate the solution to R, the more accurate the node trust value.

[0032] As a preferred solution of the centralized malicious node detection method based on a neural network sensor described in the present invention, wherein: the multivariate linear regression training of the detection equation set includes solving the R approximate solution by performing multivariate linear regression training on the detection equation set through a neural network sensor, and the objective function is expressed as:

[0033]

[0034] Among them, x i is the input of the neural network perceptron, y(t) is the output of the neural network perceptron, and w i For x i The weights occupied, f is the activation function. When the neural network perceptron is trained, each column vector of E is used as the input vector of the perceptron, and each column vector of P is used as the expected output vector of the neural network perceptron during training. During the training process, the neural network perceptron uses gradient descent to train its own w i The parameters are adjusted to make the output vector of the neural network perceptron close to the expected output vector during training. When the training is completed, all w in the model are extracted. iParameters, forming the R approximate solution.

[0035] As a preferred solution of the centralized malicious node detection method based on neural network perceptron described in the present invention, wherein: the node trust value is input into the K-means model for clustering, including R approximate solution is successfully solved, and then restored to (N1·T, N2·T, N3·T, ..., N n ·T), get the trust value of each node, cluster the nodes into trusted group, unknown group and malicious group based on K-means method, and get the final trusted group and malicious group by inputting the final trust value of the node into K-Means model for clustering.

[0036] Another object of the present invention is to provide a centralized malicious node detection system based on a neural network sensor, which can construct a detection equation set based on an injected data packet through an equation set construction module, thereby solving the current problems of difficulty in locating malicious nodes and high complexity of data preprocessing.

[0037] As a preferred solution of the centralized malicious node detection system based on neural network sensor described in the present invention, it includes: an equation set construction module, a matrix training module, and a cluster classification module; the equation set construction module is used to inject data packets into the Internet of Things node to construct a detection equation set; the matrix training module is used to construct a node trust matrix and perform multivariate linear regression training on the detection equation set; the cluster classification module is used to input the node trust value into the K-means model for clustering.

[0038] A computer device includes a memory and a processor, wherein the memory stores a computer program, and is characterized in that the processor executes the computer program to implement a step of a centralized malicious node detection method based on a neural network sensor.

[0039] A computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of a centralized malicious node detection method based on a neural network sensor are implemented.

[0040] Beneficial effects of the present invention: The centralized malicious node detection method based on neural network sensors provided by the present invention improves the applicability of the detection system in different environments by injecting preset specific data packets into the Internet of Things network, quantifies the credibility of nodes in the network, enhances the system's initial recognition capability of malicious nodes, clusters nodes through the K-means model, ensures the overall security and stable operation of the Internet of Things network, trains the detection equation set through the neural network sensor, improves the adaptability and stability of the algorithm, and achieves better results in terms of applicability, security and stability. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them:

[0042] Figure 1 This is an overall flow chart of a centralized malicious node detection method based on a neural network sensor provided in the first embodiment of the present invention.

[0043] Figure 2 K-means clustering diagram of the centralized malicious node detection method based on neural network sensor provided in the first embodiment of the present invention.

[0044] Figure 3 A neural network perceptron solution diagram of a centralized malicious node detection method based on a neural network perceptron provided in the first embodiment of the present invention.

[0045] Figure 4 An overall module diagram of a centralized malicious node detection system based on a neural network sensor provided in the third embodiment of the present invention. DETAILED DESCRIPTION

[0046] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0047] Example 1

[0048] Reference Figure 1-Figure 3 , is an embodiment of the present invention, and provides a centralized malicious node detection method based on a neural network sensor, comprising:

[0049] S1: Inject data packets into IoT nodes and build a set of detection equations.

[0050] Furthermore, injecting the data packet into the IoT node includes injecting the data packet into a known IoT node.

[0051] It should be noted that by requesting this node to forward data packets, the data packets to be injected are introduced into the network, or by setting up the IoT device to generate data for communication as injected data packets.

[0052] Furthermore, constructing the detection equation set includes constructing the detection equation set based on the data packets received by the base station node.

[0053] It should be noted that the path of injecting data packets into IoT nodes is represented as:

[0054] Path1=<N i ,N 11 ,N 12 ,...,N 1c1 ,D>

[0055] Path2=<N i ,N 21 ,N 22 ,...,N 2c2 ,D>

[0056] …

[0057] Path m =<N i ,N m1 ,N m2 ,...,N mcm ,D>

[0058] Where D is the base station node, N i For IoT nodes.

[0059] Furthermore, constructing the detection equation set also includes defining the trust value of the path.

[0060] It should be noted that the trust value of the defined path is expressed as:

[0061]

[0062] Among them, the trust value of the mth path is expressed as:

[0063]

[0064] Among them, N i If ·T and D·T are both 1, the trust value of the mth path is expressed as:

[0065]

[0066]

[0067] Combining all path trust values, the detection equation set is expressed as:

[0068]

[0069] Among them, T is the measure of node trust.

[0070] S2: Construct the node trust matrix and perform multivariate linear regression training on the detection equation set.

[0071] Furthermore, building a node trust matrix includes that there are paths in the Internet of Things that can build a node trust matrix.

[0072] It should be noted that the node trust matrix is ​​expressed as:

[0073] R=(ln(N1·T),ln(N2·T),ln(N3·T),...,ln(N n ·T))

[0074] Constructing the existence matrix is ​​expressed as:

[0075]

[0076] Among them, if N i ∈Path j , a ij is 0, a ij is 1, and the constructed path trust matrix is ​​expressed as:

[0077] P=(ln(Path1·T),ln(Path2·T),ln(Path3·T),...,ln(Path m ·T))

[0078] R×E=P

[0079] The goal of malicious node detection is transformed into finding an approximate solution to R. The more accurate the solution to R, the more accurate the node trust value.

[0080] Furthermore, multiple linear regression training is performed on the detection equation set, including solving the R approximate solution, and multiple linear regression training is performed on the detection equation set through a neural network perceptron.

[0081] It should be noted that the objective function is expressed as:

[0082]

[0083] Among them, x i is the input of the neural network perceptron, y(t) is the output of the neural network perceptron, and w i For x i The weights occupied, f is the activation function. When the neural network perceptron is trained, each column vector of E is used as the input vector of the perceptron, and each column vector of P is used as the expected output vector of the neural network perceptron during training. During the training process, the neural network perceptron uses gradient descent to train its own w iThe parameters are adjusted to make the output vector of the neural network perceptron close to the expected output vector during training. When the training is completed, all w in the model are extracted. i Parameters, forming the R approximate solution.

[0084] S3: Input the node trust value into the K-means model for clustering.

[0085] Furthermore, the node trust values ​​are input into the K-means model for clustering including obtaining cluster classification.

[0086] It should be noted that after the R approximate solution is successfully solved, it is restored to (N1·T, N2·T, N3·T, ..., N n ·T), get the trust value of each node, cluster the nodes into trusted group, unknown group and malicious group based on K-means method, and get the final trusted group and malicious group by inputting the final trust value of the node into K-Means model for clustering.

[0087] Example 2

[0088] An embodiment of the present invention provides a centralized malicious node detection method based on a neural network sensor. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0089] In the experimental environment, all IoT nodes are discretely deployed in a 100x100m 2 The communication distance of each node is 10m to 15m. The Internet of Things is randomly generated under the premise of meeting the following conditions: for each node, there is at least one path starting from this node and ending at the base station node, ensuring that each Internet of Things node can be connected; the node that injects the data packet should be selected from the leftmost side of the rectangular area, and the node base station is deployed to the rightmost side of the rectangular area; ensure that the node that injects the data packet and the node base station are both trustworthy.

[0090] In order to minimize the deviation of the experiment, each round of simulation experiments uses 5 different network topologies to collect data, and then the average value of the detection results is selected as the final experimental result.

[0091] As shown in Table 1, the centralized malicious node detection algorithm based on the neural network sensor is deployed to the base station node for operation. The network administrator only needs to inject the data packet into the network and collect the data packet from the base station for analysis. Therefore, the present invention does not cause additional performance overhead to the IoT node and is deployable in the resource-scarce IoT network. In addition, the simulation test results show that the method can accurately detect the tampering attack and replay attack implemented by the malicious node, and the injected data packet can better reflect the attack probability of the malicious node only after being attacked, thereby more accurately fitting the trust value of the node. The more the number of injected packets, the higher the degree of trust value fitting.

[0092] Table 1 Experimental data table

[0093]

[0094] Example 3

[0095] Reference Figure 4 , as an embodiment of the present invention, provides a centralized malicious node detection system based on a neural network sensor, including: an equation set construction module, a matrix training module, and a cluster classification module.

[0096] The equation set construction module is used to inject data packets into IoT nodes and construct a detection equation set; the matrix training module is used to build a node trust matrix and perform multivariate linear regression training on the detection equation set; the clustering classification module is used to input the node trust value into the K-means model for clustering.

[0097] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0098] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0099] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0100] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc. It should be noted that the above embodiments are only used to illustrate the technical solution of the present invention and are not limited. Although the present invention is described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention, which should be included in the scope of the claims of the present invention.

[0101] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A centralized malicious node detection method based on a neural network sensor, characterized in that: include: Inject data packets into IoT nodes and build a set of detection equations; Construct a node trust matrix and perform multivariate linear regression training on the detection equation set; The node trust values ​​are input into the K-means model for clustering.

2. The centralized malicious node detection method based on a neural network sensor as claimed in claim 1, characterized in that: The injecting of the data packet into the IoT node includes injecting the data packet into a known IoT node, introducing the data packet to be injected into the network by requesting the node to forward the data packet, or setting the IoT device to generate data for communication as the injected data packet.

3. The centralized malicious node detection method based on a neural network sensor as claimed in claim 2, characterized in that: The construction of the detection equation set includes constructing the detection equation set based on the data packet received by the base station node, injecting the data packet into the Internet of Things node, and the path is expressed as: Path1=<N i ,N 11 ,N 12 ,...,N 1c1 ,D> Path2=<N i ,N 21 ,N 22 ,...,N 2c2 ,D> … Path m =<N i ,N m1 ,N m2 ,...,N mcm ,D> Where D is the base station node, N i For IoT nodes.

4. The centralized malicious node detection method based on a neural network sensor as claimed in claim 3, characterized in that: The construction of the detection equation set also includes defining the trust value of the path as: Among them, the trust value of the mth path is expressed as: Among them, N i If ·T and D·T are both 1, the trust value of the mth path is expressed as: Combining all path trust values, the detection equation set is expressed as: Among them, T is the measure of node trust.

5. The centralized malicious node detection method based on a neural network sensor as claimed in claim 4, characterized in that: The node trust matrix construction includes that there is a path in the Internet of Things to construct the node trust matrix, and the node trust matrix is ​​expressed as: R=(ln(N1·T),ln(N2·T),ln(N3·T),…,ln(N n ·T)) Constructing the existence matrix is ​​expressed as: Among them, if N i ∈Path j , a ij is 0, a ij is 1, and the constructed path trust matrix is ​​expressed as: P=(ln(Path1·T),ln(Path2·T),ln(Path3·T),...,ln(Path m ·T)) R×E=P The goal of malicious node detection is transformed into finding an approximate solution to R. The more accurate the solution to R, the more accurate the node trust value.

6. The centralized malicious node detection method based on a neural network sensor as claimed in claim 5, characterized in that: The multivariate linear regression training of the detection equation set includes solving the R approximate solution and performing multivariate linear regression training on the detection equation set through a neural network perceptron. The objective function is expressed as: Among them, x i is the input of the neural network perceptron, y(t) is the output of the neural network perceptron, and w i For x i The weights occupied, f is the activation function. When the neural network perceptron is trained, each column vector of E is used as the input vector of the perceptron, and each column vector of P is used as the expected output vector of the neural network perceptron during training. During the training process, the neural network perceptron uses gradient descent to train its own w i The parameters are adjusted to make the output vector of the neural network perceptron close to the expected output vector during training. When the training is completed, all w in the model are extracted. i Parameters, forming the R approximate solution.

7. The centralized malicious node detection method based on a neural network sensor as claimed in claim 6, characterized in that: The node trust value is input into the K-means model for clustering, including R approximate solution, after successful solution, it is restored to (N1·T, N2·T, N3·T, ..., N n ·T), get the trust value of each node, cluster the nodes into trusted group, unknown group and malicious group based on K-means method, and get the final trusted group and malicious group by inputting the final trust value of the node into K-means model for clustering.

8. A system using the centralized malicious node detection method based on a neural network sensor as claimed in any one of claims 1 to 7, characterized in that: It includes equation set building module, matrix training module and cluster classification module; The equation set building module is used to inject data packets into the IoT node to build a detection equation set; The matrix training module is used to construct a node trust matrix and perform multivariate linear regression training on the detection equation set; The clustering classification module is used to input the node trust value into the K-means model for clustering.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the centralized malicious node detection method based on a neural network sensor as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the centralized malicious node detection method based on a neural network sensor as described in any one of claims 1 to 7 are implemented.

Images