Method for identifying malicious node behavior intention of computing power network

Abstract

The invention relates to a computing power network malicious node behavior intention recognition method, which comprises the following steps that: any computing node added into a computing power network is defaulted to be listed into a normal node set NS, the computing nodes execute tasks in the normal node set NS, and reputation values after each task are collected to construct a reputation data set; the reputation data set is input into a decision tree network model, the decision tree network model judges the node type of the computational node through calculation, and when the node type of the computational node is a normal node type, the computational node is reserved in a normal node set NS; when the node type of the computing node is a malicious node type I, listing the computing node into a malicious node set MS; when the node type of the computing node is a malicious node type II or a malicious node type III, listing the computing node into an observation node set OS; the invention aims to accurately identify the computing nodes which may threaten the network, thereby ensuring the security and stability of the network.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method for identifying the behavioral intentions of malicious nodes in a computing network. Background Art

[0002] With the rapid development of artificial intelligence technology, the demand for computing, storage and communication resources in various application scenarios and businesses has increased dramatically to support the deep mining and efficient batch processing of massive data. However, as the deployment of data and computing power in the network becomes increasingly discrete, that is, these resources are no longer limited to a few central nodes, but are widely distributed in every corner. This ubiquitous resource demand model poses a severe challenge to the traditional centralized cloud computing service architecture. The traditional centralized architecture is unable to cope with the highly decentralized and flexible data processing needs, and it is difficult to efficiently meet the requirements of immediacy, scalability and cost-effectiveness in various application scenarios. To meet this challenge, the concept of computing network came into being. It aims to flexibly schedule resources and optimize resource allocation, thereby significantly improving the utilization efficiency of network resources.

[0003] The computing power network connects geographically dispersed computing resources through ubiquitous network deployment, flexibly dispatches massive ubiquitous computing tasks to computing nodes connected to the network, and realizes on-demand allocation and efficient utilization of resources across the entire network. Due to the different sources of computing nodes that provide computing power and heterogeneous resources, it is difficult for the computing power network to conduct behavioral audits on each node, resulting in some nodes spreading false information for their own interests, excessively occupying network resources (such as bandwidth, storage space or computing power resources), attempting to tamper with data in the network, consuming network resources by launching denial of service attacks (DoS / DDoS), cheating in mining, etc. These nodes are called malicious nodes. The existence of malicious nodes can easily directly lead to the loss of privacy security and time cost of computing power demanders, which in turn leads to a decrease in the credibility of resources in the computing power network, and indirectly threatens the reliability and stability of the entire computing power network. Therefore, how to identify malicious nodes in the computing power network has become one of the key issues facing the green and healthy development of the computing power network.

[0004] Reputation management is considered to be an effective method for identifying and handling malicious nodes in a network environment. This method quantifies the trustworthiness of nodes by analyzing their historical behavior in the system. Once the reputation score of a node drops below the threshold preset by the system, the system will determine that the node is untrustworthy and take appropriate measures to remove it from the network. However, in real systems, it is difficult to accurately capture the true intentions of malicious nodes by simply relying on a fixed reputation threshold. Especially in the system initialization phase, malicious nodes often adopt a variety of strategies to test, aiming to find out the operating rules of the reputation evaluation mechanism, and then formulate more flexible and changeable strategies to seek improper benefits or undermine network stability. Therefore, how to identify the behavioral intentions of malicious nodes and set up a more flexible reputation model is urgently needed, and then take different restrictive measures according to the destructiveness of malicious nodes. Summary of the invention

[0005] The technical problem to be solved by the present invention is to provide a method for identifying the behavioral intentions of malicious nodes in a computing power network, which can accurately identify computing nodes that may pose a threat to the computing power network, thereby ensuring the security and stability of the computing power network.

[0006] The technical solution adopted by the present invention is a method for identifying malicious node behavior intentions in a computing network, the method comprising the following steps:

[0007] S1. Divide the node sets, the node sets include: normal node set NS, observation node set OS and malicious node set MS; the priority of the node sets receiving tasks is: normal node set NS> observation node set OS> malicious node set MS; wherein, the reputation value of the computing nodes in the normal node set NS after each task is executed is calculated according to the benchmark reputation value formula; the reputation values ​​of the computing nodes in the observation node set OS and the computing nodes in the malicious node set MS after each task are calculated according to the behavior reputation value formula;

[0008] S2. Any computing node that joins the computing power network is included in the normal node set NS by default. The computing node performs tasks in the normal node set NS. After the task is completed, the task initiator evaluates it and obtains a reputation feedback report. The reputation value is calculated based on the reputation feedback report. After several tasks, the reputation value after each task is collected to construct a reputation data set;

[0009] S3. Input the reputation data set into a decision tree network model, and the decision tree network model determines the node type of the computing node through calculation. The specific process is as follows:

[0010] S3.1. Calculate the maximum and minimum difference SE of the computing node parameters, where the maximum and minimum difference SE of the computing node parameters represents the difference between the maximum and minimum reputation values ​​of the computing node in the last j tasks; calculate the suspiciousness SP of the computing node parameters j , the calculation node parameter suspiciousness SP j Indicates the number of times the computing node has failed or failed to meet quality standards in the last j tasks;

[0011] S3.2, determine the node type of the computing node: when the computing node satisfies SP<α and SE<β, the computing node is a normal node class; when the computing node satisfies SP>α and SE>β, the computing node is a malicious node type one; when the computing node satisfies SP<α and SE>β, the computing node is a malicious node type two; when the computing node satisfies SP>α and SE<β, the computing node is a malicious node type three;

[0012] S4. When the node type of the computing node is a normal node class, the computing node is retained in the normal node set NS; when the node type of the computing node is a malicious node type one, the computing node is included in the malicious node set MS; when the node type of the computing node is a malicious node type two or a malicious node type three, the computing node is included in the observation node set OS;

[0013] S5. When the computing node is located in the observation node set OS, if the behavior reputation value of the computing node in the observation node set OS is lower than the threshold value θ1, the computing node is transferred from the observation node set OS to the malicious node set MS; if the behavior reputation value of the computing node in the observation node set OS reaches the maximum behavior reputation value and maintains the task success for k1 consecutive times, the computing node leaves the observation node set OS and returns to the normal node set NS; if the computing node fails to perform tasks in the malicious node set MS for two consecutive times, the behavior reputation value of the computing node will drop below the threshold value θ2, and the computing node will be kicked out of the network; if the behavior reputation value of the computing node in the malicious node set MS reaches the maximum behavior reputation value and maintains the task success for k2 consecutive times, the computing node leaves the malicious node set MS and returns to the observation node set OS.

[0014] The beneficial effect of the present invention is that the present invention aims to accurately identify those computing nodes that may pose a threat to the network, thereby ensuring the security and stability of the network. By using machine learning methods and setting suspicious parameters, nodes with suspicious behaviors are effectively screened out and included in the set of nodes to be observed. Then, according to the behavioral reputation value, nodes with serious threats are transferred to the malicious node set or even kicked out of the computing power network, while nodes with suspicious behaviors and a small amount of threats continue to remain in the observation node set. Compared with the prior art, the reputation management scheme adds the node's own computing power factor and the user's satisfaction factor with the service quality, so as to judge the node's malicious intentions and effectively eliminate malicious nodes. On the premise of ensuring that the computing power network improves the average service quality, while reasonably utilizing the computing resources of malicious nodes with less behavioral intention threats, the computing power transaction risk in the computing power network is reduced, and the reliability of the computing power network service and the authenticity of resources are maintained.

[0015] Preferably, the specific process of the computing node performing a task each time includes the following steps:

[0016] (1) The task initiator publishes the computing task to the cloud server. The cloud server abstracts and models the received computing task and extracts the task requirement information, including the maximum tolerable delay, computing data type, and computing power requirement.

[0017] (2) The cloud server collects the resource information of the computing nodes, including the computing power type, computing power size, and remaining storage resources; the cloud server then synchronizes the computing node resource information to the computing network brain;

[0018] (3) Based on the resource information and task requirement information of the computing nodes, the computing network brain uses a scheduling algorithm to derive a scheduling strategy for computing task routing and sends it to the cloud server;

[0019] (4) The cloud server routes and offloads the computing task to the corresponding computing node according to the forwarding decision;

[0020] (5) The computing node executes the task and uploads the task results to the cloud server, and returns the task results to the task initiator through the network connection device;

[0021] (6) The task initiator evaluates the task results and service quality and sends them to the cloud server. The cloud server summarizes and sends a reputation feedback report to the computing network brain.

[0022] (7) The computing network brain updates the reputation value of the computing node based on the reputation feedback report and sends it to the computing node through the network connection device. The computing node obtains the corresponding task benefit or penalty.

[0023] Preferably, the formula of the benchmark reputation value is:

[0024] R n =qL n +(1-q)S n ;

[0025] Among them, q represents the adjustment factor of long-term and short-term reputation value, L n It represents the long-term reputation value of the computing node after the nth task, which is expressed as: L n-1 It is expressed as the long-term reputation value of the node after the (n-1)th task, C n Indicates whether the nth task is completed or not, that is, 1 for completion and 0 for incompleteness; S n It represents the short-term reputation value of the computing node after the nth task, which is expressed as: S n =(1-ρ)S n-1 +ρD n ; S n-1 represents the short-term reputation value of the node after the (n-1)th task, D n It represents the final score of the task initiator for the nth task, which is expressed as: E represents the evaluation of the service quality by the task initiator, E = {E1, E2, ..., E m}, m represents the dimension of the evaluation factor, W represents the weight set of the evaluation factor set by the cloud server for the evaluation factor when abstracting the task requirements, W = {W1, W2, ..., W m}; ρ represents the memory factor.

[0026] Preferably, the formula of the behavior reputation value is:

[0027]

[0028] Wherein, r represents the number of successful task executions when the computing node is located in the observation node set OS or the malicious node set MS, s represents the number of failed task executions when the computing node is located in the observation node set OS or the malicious node set MS, and P represents the penalty parameter. When the computing node is located in the observation node set OS, P is equal to 1; when the node is located in the malicious node set MS,

[0029] Preferably, in step S2, when any computing node joins the computing power network, it is necessary to determine whether the computing node joins the computing power network for the first time. If so, a pseudonym, certificate and initial reputation value are issued to the computing node; after the computing node obtains the initial reputation value, the cloud server arranges multiple built-in computing tasks for the computing node; if not, the historical reputation value of the computing node is checked, and the cloud server arranges a built-in computing task for the computing node.

[0030] Preferably, in step S3.1, the calculation node parameter suspiciousness SP j The expression is:

[0031]

[0032] Where j represents the number of times the task is executed; C i Indicates the completion status of the i-th task, the task completion value is 1, and the task failure value is 0; D i It represents the final score of the task initiator on the i-th task. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 This is a system model diagram of the computing power network in the present invention;

[0034] Figure 2 This is a flow chart of the computing node executing a task in the present invention;

[0035] Figure 3 This is a flow chart of the reputation data collection and intention identification process after the computing node joins the computing power network in the present invention;

[0036] Figure 4 A flowchart of malicious node intention identification in a computing power network described in an embodiment of the present invention;

[0037] Figure 5 Schematic diagram of the changes in the node set to which a computing node belongs after joining the computing power network in an embodiment of the present invention. DETAILED DESCRIPTION

[0038] The invention will be further described below with reference to the accompanying drawings and in combination with specific implementations, so that those skilled in the art can implement the invention with reference to the description. The protection scope of the invention is not limited to the specific implementations.

[0039] The present invention provides a method for identifying malicious node behavior intentions in a computing network. The network system implementing the method is as follows: Figure 1 shown.

[0040] Figure 1 In the whole network system, there are five entities, namely, task initiator, cloud server, computing node, network connection device and computing network brain.

[0041] Task initiator: A task initiator refers to an individual or application that needs to use computing resources in the network to perform computing tasks.

[0042] Cloud Server: Cloud Server has relatively powerful computing and storage resources. It abstractly models the tasks submitted by the task initiator, extracts the basic features of the tasks, stores the list of computing node parameters, and assumes the functions of perceiving computing node resource information and routing and offloading computing tasks.

[0043] Computing node: A computing node refers to a computing device or computing device cluster that uses its own idle computing resources to complete tasks.

[0044] Network connection equipment: Network connection equipment refers to the information transmission channels between cloud servers and computing nodes, and between computing network brains and computing nodes; such as base stations, smart routers, etc., which are mainly responsible for data transmission.

[0045] Computing network brain: The computing network brain is mainly responsible for the scheduling of computing tasks and the allocation and updating of the reputation of computing nodes.

[0046] like Figure 2 As shown, in a specific embodiment, the process of a computing node in a computing power network executing a task is as follows:

[0047] Step 1: The task initiator publishes the computing task to the cloud server; the cloud server abstracts and models the received computing task and extracts the demand information in the task, including indicators such as maximum tolerable delay, computing data type, and computing power requirements;

[0048] Step 2: The cloud server collects the resource information of the computing nodes, including the computing power type and size as well as the remaining storage resources, and then synchronizes the computing node resource information to the computing network brain;

[0049] Step 3: The computing network brain uses the scheduling algorithm to obtain the scheduling strategy for computing task routing based on node resource information and task requirements, and sends it to the cloud server;

[0050] Step 4: The cloud server routes and offloads the computing tasks to the corresponding computing nodes according to the scheduling decision;

[0051] Step 5: The computing node executes the task and uploads the task result to the cloud server, and returns the task result to the task initiator through the network connection device;

[0052] Step 6: The task initiator evaluates the task results and service quality and sends them to the cloud server. The cloud server summarizes and sends a reputation feedback report to the computing network brain.

[0053] Step 7: The computing network brain updates the reputation value of the computing node according to the reputation feedback report and sends it to the computing node through the network connection device. The computing node obtains the corresponding task benefit or penalty.

[0054] The evaluation E of the task initiator on the service quality is composed of multiple dimensional evaluation factors, which can be expressed as: E = {E1, E2, ..., E m}, m is the dimension of the evaluation factor, and the evaluation factor can be latency, computational completion, time consumption, etc. When abstracting the task requirements, the cloud server sets the weight set W of the evaluation factor for the evaluation factor, which is expressed as: W = {W1, W2, ..., W m Among them, many evaluation factors and their weights will vary depending on the task type. For example, in autonomous driving and game image rendering services, the task initiator will pay more attention to the experience during use, so the weight of factors such as latency will be greater. In services such as training models, the task trainer will pay more attention to the final result, so the weight of evaluation factors such as time consumption, calculation completion, and model performance will be greater. Finally, the task initiator's score for this task can be expressed as: When D>θ, the server determines that the task is completed and calculates the number of node task completions C n =C n-1 +1, and D is the final score of this task, which is also an important input parameter for determining the reputation value of the computing node; in this embodiment, the value of θ is 0.7.

[0055] In a specific embodiment, there are the following computing nodes in the computing network:

[0056] Normal node: A node in the computing network that follows established rules to perform tasks and complete transactions normally. An occasional task failure is allowed, but there will not be a second failure in a short period of time.

[0057] Completely malicious nodes: return incorrect calculation data or do not execute tasks, wasting the time of the task initiator.

[0058] Random malicious nodes: Each task is executed randomly, that is, the two strategies of executing the task and not executing the task are randomly selected by the node.

[0059] Switching nodes: When the reputation value is below a certain threshold, the malicious node continues (for a considerable period of time) to behave normally to increase its reputation value. After reaching the threshold, the malicious node will suddenly change its behavior to carry out malicious activities, and before the reputation value falls below the system's tolerable threshold, it will promptly change its behavior to normal behavior and continue to accumulate reputation value.

[0060] Nodes that falsely report computing power: Provide false computing power resource information to the computing power network, resulting in tasks being completed but taking longer than expected, or producing lower-quality computing results.

[0061] Sybli node: A malicious node performs common malicious behaviors. After each malicious behavior causes the reputation value to decrease, it exits the network, reconnects to the network with a new identity and a new initial reputation value, and continues to perform common malicious attacks.

[0062] According to the above definition of nodes, all nodes are divided into the following four categories:

[0063] Normal node class: The reputation value increases steadily, occasionally decreases, but increases rapidly; this type of node includes normal nodes.

[0064] Malicious node type 1: The reputation value steadily decreases at a certain stage until the reputation value drops to the threshold and is kicked out of the network. This type of node includes completely malicious nodes and sybli nodes.

[0065] Malicious node type 2: The reputation value increases steadily at a certain stage, and then starts to decrease after reaching a certain value. Before approaching a certain threshold, the reputation value starts to increase again, and the above process is repeated. This type of node includes switch nodes.

[0066] Malicious node type 3: The change in reputation value is inconsistent with that of normal nodes, which is manifested in that the frequency of reputation value decreases is higher than that of normal nodes. This type of node includes random malicious nodes and nodes with false computing power.

[0067] The specific process of a method for identifying malicious node behavior intentions in a computing network provided by the present invention includes the following steps:

[0068] Step 1: Divide the node set, the node set includes: normal node set NS, observation node set OS and malicious node set MS;

[0069] Among them, the priority of the node set receiving tasks is: normal node set NS> observation node set OS> malicious node set MS;

[0070] Among them, the reputation value of the computing nodes in the normal node set NS after each task is obtained by calculating its baseline reputation value; the reputation value of the computing nodes in the observation node set OS and the computing nodes in the malicious node set MS after each task is obtained by calculating their behavior reputation value;

[0071] Step 2: Figure 4 As shown, any computing node that joins the computing power network is included in the normal node set NS by default. The computing node performs tasks in the normal node set NS. After the task is completed, the task initiator evaluates it and obtains a reputation feedback report. The reputation value is calculated based on the reputation feedback report. After several tasks, the reputation value after each task is collected to construct a reputation data set;

[0072] Among them, when any computing node joins the computing power network, Figure 3 As shown, it is necessary to determine whether the computing node is joining the computing network for the first time. If so, issue a pseudonym, certificate, initial reputation value and other information to the computing node; after the computing node obtains the initial reputation value, the cloud server arranges multiple built-in computing tasks for the computing node to overcome the cold start problem of the reputation value and verify the authenticity of the node's computing resources. After completing multiple built-in computing tasks, the computing node successfully verifies the authenticity of its resources and obtains a reputation value used to evaluate the reliability of its resources; if not, check the historical reputation value of the computing node, and the cloud server arranges a built-in computing task for the computing node to verify the authenticity of the node's computing resources.

[0073] Step 3: Input the reputation data set into the decision tree network model, and the decision tree network model determines the node type of the computing node through calculation. The specific process is as follows:

[0074] Calculate the maximum and minimum difference SE of the computing node parameters, where the maximum and minimum difference SE of the computing node parameters represents the difference between the maximum and minimum reputation values ​​of the computing node in the last n tasks; calculate the suspiciousness SP of the computing node parameters j , the calculation node parameter suspiciousness SP j Indicates the number of times the computing node has failed or failed to meet quality standards in the last n tasks;

[0075] Among them, the suspiciousness of the calculation node parameter SP j The expression is:

[0076]

[0077] Where j represents the number of times the task is executed; C i Indicates the completion status of the i-th task, the task completion value is 1, and the task failure value is 0; D i represents the final score of the task initiator on the i-th task;

[0078] like Figure 4 As shown, the node type of the computing node is determined: when the computing node satisfies SP<6 and SE<20, the computing node is a normal node class; when the computing node satisfies SP>6 and SE>20, the computing node is a malicious node type one; when the computing node satisfies SP<6 and SE>20, the computing node is a malicious node type two; when the computing node satisfies SP>6 and SE<20, the computing node is a malicious node type three.

[0079] Step 4: When the node type of the computing node is a normal node class, the computing node is retained in the normal node set NS; when the node type of the computing node is malicious node type one, the computing node is included in the malicious node set MS; when the node type of the computing node is malicious node type two or malicious node type three, the computing node is included in the observation node set OS.

[0080] Step 5: Figure 5 As shown, when the computing node is located in the observation node set OS, if the behavior reputation value of the computing node in the observation node set OS is lower than the threshold value θ1=0.5, the computing node is transferred from the observation node set OS to the malicious node set MS; if the behavior reputation value of the computing node in the observation node set OS reaches the maximum behavior reputation value (the maximum behavior reputation value is the maximum behavior reputation value corresponding to the observation node set OS) and keeps the task successfully for k1=10 times in a row, the computing node leaves the observation node set OS and returns to the normal node set NS; if the computing node fails to perform tasks in the malicious node set MS for two consecutive times, the behavior reputation value of the computing node will be reduced to below the threshold value θ2=0.5, and the computing node is kicked out of the network; if the behavior reputation value of the computing node in the malicious node set MS reaches the maximum behavior reputation value (the maximum behavior reputation value is the maximum behavior reputation value corresponding to the malicious node set MS) and keeps the task successfully for k2=5 times in a row, the computing node leaves the malicious node set MS and returns to the observation node set OS;

[0081] Among them, the computing nodes in the observation node set OS and the malicious node set MS enable behavior reputation value, and its expression is: Where r represents the number of successful tasks, s represents the number of failed tasks, and P represents the penalty parameter. When computing nodes are transferred to different node sets, the values ​​of r and s are initialized to 0; in the observation node set OS, the penalty parameter P is related to the node information, and the initial value is 1. The initial value of the penalty parameter P in the malicious node set is 2; when the computing power of the node (the sum of the computing power of chips that provide the same type of computing power) is less than 10TFLOPS or 10TOPS, the penalty coefficient P is one times the initial value; when the computing power of the node ranges from 10TFLOPS to 1PFLOPS or the logical computing power is at the same level, the penalty coefficient P is twice the original value; when the computing power of the node is greater than 1PFLOPS or the logical computing power is at the same level, the penalty coefficient P is three times the original value.

[0082] In this embodiment, the computing power of all computing nodes (the sum of the computing power of chips providing the same type of computing power) is less than 10TFLOPS or 10TOPS; after classification by the decision tree model, the nodes will be judged for their malicious intentions based on their two suspicion parameters, and nodes with different intentions will be divided into corresponding node types.

[0083] Normal nodes will always be in the normal node set NS. Even if occasional task failures cause normal nodes to be included in the observation node set OS, the nodes can still be separated from the observation node set OS and return to the normal node set NS through continued normal behavior.

[0084] After a completely malicious node passes the network's built-in computing tasks and obtains an initial reputation value, its continued malicious behavior causes the node's reputation value to drop rapidly. After being transferred to the malicious node set MS, it will be kicked out of the network if it fails two tasks in a row.

[0085] Random malicious nodes may be classified in the normal node set NS and the observation node set OS due to the randomness of their normal execution tasks. Random malicious nodes with a probability of executing tasks below 70% will soon enter the observation node set and be used to process unimportant and low-yield computing tasks. Over time, the probability of random malicious nodes that have not been kicked out of the network executing tasks approaches that of normal nodes or the threat level is lower than that of other malicious nodes.

[0086] For nodes that falsely report computing power, when the gap between the falsely reported computing power and the real computing power is too large, the user's service quality evaluation will be low in all dimensions, and the final evaluation score aggregated will be lower than the threshold, resulting in the task being judged as a failure. Long-term failures will be considered as completely malicious nodes and included in the malicious node set MS. When the gap between the falsely reported computing power and the real computing power is not large, the final evaluation will be slightly higher than the threshold, but the service quality will not reach the level of excellence. If such nodes fail to meet the excellent quality requirements for a long time, they will still be included in the observation node set OS to handle tasks with low importance and benefits.

[0087] For sybli nodes, the entire network will collect their device identification codes and physical addresses when they join the network to prevent duplicate nodes and devices from joining the network.

[0088] Assuming that the switch node has joined the network and collected relevant intelligence about the computing network through trial and error, the node in the normal node set accumulates a reputation value that exceeds the set threshold, and the node begins to change its behavior to attack. After the classification of the decision tree and the threshold judgment of the two parameters, the special sawtooth reputation change graph makes the node included in the observation node set OS. If the switch node in the observation node set chooses to continue attacking when the initial behavior reputation value is 0.5, the node is transferred to the malicious node set MS; if the node's strategy chooses not to attack but to convert the behavior to accumulate reputation value, and converts the behavior to start attacking after exceeding the preset threshold of 0.75, then after only three malicious tasks, the node's behavior reputation value will be reduced to 0.5. At this time, if the node chooses to continue attacking, the node will be transferred to the malicious node set MS. If it does not attack, the node needs to perform 7 or more successful tasks to accumulate reputation value and exceed the threshold. At this time, the task success rate of the switch node remains at 70%, and the attack efficiency is low. Switch nodes with a task success rate below 70% are transferred to the malicious node set MS. For switch nodes in the malicious node set, due to the penalty coefficient in the node set Therefore, it only takes one task failure for the node's behavioral reputation to drop from 0.75 to the threshold of 0.5, and it takes more than 15 tasks to succeed for the reputation value to increase from 0.5 to 0.75. At this time, the attack efficiency of the switch node becomes very low and the threat is controllable.

[0089] The behavioral intentions of all nodes are identified by combining machine learning with reputation management. Nodes with a greater degree of threat from behavioral intentions will be included in the malicious node set MS and kicked out of the network after confirmation. Nodes with a lesser degree of threat from behavioral intentions will be included in the observation node set OS and will be chosen to stay or leave based on the needs of the network. When the network's computing power resources are insufficient, nodes with controllable threats can be used to handle unimportant and low-yield tasks, freeing up normal nodes for important and high-yield tasks.

[0090] To sum up, the malicious node behavior intention identification method described in the embodiment of the present invention uses machine learning and reputation management to identify and classify the behavior intentions of nodes. Under the premise of ensuring that the computing power network improves the average service quality, it can reasonably utilize the computing resources of malicious nodes with smaller behavioral intention threats, while reducing the computing power transaction risks in the computing power network and maintaining the reliability of the computing power network services, the authenticity of resources and the stability of the network.

[0091] Although the disclosure is disclosed as above, the protection scope of the disclosure is not limited thereto. Those skilled in the art can make various changes and modifications without departing from the spirit and scope of the disclosure, and these changes and modifications will fall within the protection scope of the present invention.

Claims

1. A method for identifying malicious node behavior intentions in a computing network, characterized by: The method comprises the following steps: S1. Divide the node sets, the node sets include: normal node set NS, observation node set OS and malicious node set MS; the priority of the node sets receiving tasks is: normal node set NS> observation node set OS> malicious node set MS; wherein, the reputation value of the computing nodes in the normal node set NS after each task is executed is calculated according to the benchmark reputation value formula; the reputation values ​​of the computing nodes in the observation node set OS and the computing nodes in the malicious node set MS after each task are calculated according to the behavior reputation value formula; S2. Any computing node that joins the computing power network is included in the normal node set NS by default. The computing node performs tasks in the normal node set NS. After the task is completed, the task initiator evaluates it and obtains a reputation feedback report. The reputation value is calculated based on the reputation feedback report. After several tasks, the reputation value after each task is collected to construct a reputation data set; S3. Input the reputation data set into a decision tree network model, and the decision tree network model determines the node type of the computing node through calculation. The specific process is as follows: S3.

1. Calculate the maximum and minimum difference SE of the computing node parameters, where the maximum and minimum difference SE of the computing node parameters represents the difference between the maximum and minimum reputation values ​​of the computing node in the last j tasks; calculate the suspiciousness SP of the computing node parameters j , the calculation node parameter suspiciousness SP j Indicates the number of times the computing node has failed or failed to meet quality standards in the last j tasks; S3.2, determine the node type of the computing node: when the computing node satisfies SP<α and SE<β, the computing node is a normal node class; when the computing node satisfies SP>α and SE>β, the computing node is a malicious node type one; when the computing node satisfies SP<α and SE>β, the computing node is a malicious node type two; when the computing node satisfies SP>α and SE<β, the computing node is a malicious node type three; S4. When the node type of the computing node is a normal node class, the computing node is retained in the normal node set NS; when the node type of the computing node is a malicious node type one, the computing node is included in the malicious node set MS; when the node type of the computing node is a malicious node type two or a malicious node type three, the computing node is included in the observation node set OS; S5. When the computing node is located in the observation node set OS, if the behavior reputation value of the computing node in the observation node set OS is lower than the threshold value θ1, the computing node is transferred from the observation node set OS to the malicious node set MS; if the behavior reputation value of the computing node in the observation node set OS reaches the maximum behavior reputation value and maintains the task success for k1 consecutive times, the computing node leaves the observation node set OS and returns to the normal node set NS; if the computing node fails to perform tasks in the malicious node set MS for two consecutive times, the behavior reputation value of the computing node will drop below the threshold value θ2, and the computing node will be kicked out of the network; if the behavior reputation value of the computing node in the malicious node set MS reaches the maximum behavior reputation value and maintains the task success for k2 consecutive times, the computing node leaves the malicious node set MS and returns to the observation node set OS.

2. The method for identifying malicious node behavior intentions in a computing network according to claim 1 is characterized by: The specific process of the computing node performing a task each time includes the following steps: (1) The task initiator publishes the computing task to the cloud server. The cloud server abstracts and models the received computing task and extracts the task requirement information, including the maximum tolerable delay, computing data type, and computing power requirement. (2) The cloud server collects resource information of computing nodes, including computing power type, computing power size, and remaining storage resources; The cloud server then synchronizes the computing node resource information to the computing network brain; (3) Based on the resource information and task requirement information of the computing nodes, the computing network brain uses a scheduling algorithm to derive a scheduling strategy for computing task routing and sends it to the cloud server; (4) The cloud server routes and offloads the computing task to the corresponding computing node according to the forwarding decision; (5) The computing node executes the task and uploads the task results to the cloud server, and returns the task results to the task initiator through the network connection device; (6) The task initiator evaluates the task results and service quality and sends them to the cloud server. The cloud server summarizes and sends a reputation feedback report to the computing network brain. (7) The computing network brain updates the reputation value of the computing node based on the reputation feedback report and sends it to the computing node through the network connection device. The computing node obtains the corresponding task benefit or penalty.

3. The method for identifying malicious node behavior intentions in a computing network according to claim 2 is characterized in that: The base reputation value formula is: R n =qL n +(1-q)S n ; Among them, q represents the adjustment factor of long-term and short-term reputation value, L n It represents the long-term reputation value of the computing node after the nth task, which is expressed as: L n-1 It is expressed as the long-term reputation value of the node after the (n-1)th task, C n Indicates the completion status of the nth task, with the task completion value being 1 and the task failure value being 0; S n It represents the short-term reputation value of the computing node after the nth task, which is expressed as: S n =(1-ρ)S n-1 +ρD n ; S n-1 represents the short-term reputation value of the node after the (n-1)th task, D n It represents the final score of the task initiator for the nth task, which is expressed as: E represents the evaluation of the service quality by the task initiator, E = {E1, E2, ..., E m }, m represents the dimension of the evaluation factor, W represents the weight set of the evaluation factor set by the cloud server for the evaluation factor when abstracting the task requirements, W = {W1, W2, ..., W m }; ρ represents the memory factor.

4. The method for identifying malicious node behavior intentions in a computing network according to claim 3 is characterized by: The formula for the behavior reputation value is: Wherein, r represents the number of successful task executions when the computing node is located in the observation node set OS or the malicious node set MS, s represents the number of failed task executions when the computing node is located in the observation node set OS or the malicious node set MS, and P represents the penalty parameter. When the computing node is located in the observation node set OS, P is equal to 1; when the node is located in the malicious node set MS, 5. The method for identifying malicious node behavior intentions in a computing network according to claim 4 is characterized in that: In step S2, when any computing node joins the computing network, it is necessary to determine whether the computing node joins the computing network for the first time. If so, a pseudonym, certificate and initial reputation value are issued to the computing node; After the computing node obtains an initial reputation value, the cloud server arranges multiple built-in computing tasks for the computing node; if not, the historical reputation value of the computing node is checked, and the cloud server arranges a built-in computing task for the computing node.

6. The method for identifying malicious node behavior intentions in a computing network according to claim 5, characterized in that: In step S3.1, the calculation node parameter suspiciousness SP j The expression is: Where j represents the number of times the task is executed; C i Indicates the completion status of the i-th task, the task completion value is 1, and the task failure value is 0; D i It represents the final score of the task initiator on the i-th task.

Images