A hash power network malicious node behavior intention identification method

Abstract

The present application relates to a kind of computing power network malicious node behavior intention identification method, comprising: the arbitrary computing node of joining computing power network is listed in normal node set NS by default, computing node executes task in normal node set NS, and reputation value after each task is collected to build reputation dataset;Reputation dataset is input into decision tree network model, and the node type of computing node is judged by decision tree network model through calculation, when the node type of computing node is normal node class, computing node remains in normal node set NS;When the node type of computing node is malicious node type one, computing node is listed in malicious node set MS;When the node type of computing node is malicious node type two or malicious node type three, computing node is listed in observation node set OS;The present application aims at accurately identifying those computing nodes that may constitute threat to network, to ensure the security and stability of network.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a malicious node behavior intention identification method for a computing power network. BACKGROUND

[0002] With the rapid development of artificial intelligence technology, various application scenarios and businesses have a sharp increase in demand for computing, storage and communication resources to support deep mining and efficient batch processing of massive data. However, as data and computing power are increasingly deployed in a decentralized manner in the network, that is, these resources are no longer limited to a few central nodes but are widely distributed in various corners, this ubiquitous resource demand mode poses a serious challenge to the traditional centralized cloud computing service architecture. The traditional centralized architecture is not up to the task when faced with highly dispersed and flexible data processing requirements, and it is difficult to efficiently meet the immediacy, scalability and cost-effectiveness requirements of various application scenarios. To meet this challenge, the concept of computing power network has emerged, which aims to flexibly schedule resources and optimize resource allocation to significantly improve the utilization efficiency of network resources.

[0003] The computing power network connects computing resources with different geographical locations through ubiquitous network deployment, flexibly schedules massive ubiquitous computing tasks to computing nodes connected to the network, and realizes on-demand allocation and efficient utilization of network resources. Due to the different sources and heterogeneous resources of computing nodes providing computing power, it is difficult for the computing power network to conduct behavior audits on each node, resulting in some nodes spreading false information for their own benefit, overusing network resources (such as bandwidth, storage space or computing power resources), attempting to tamper with data in the network, consuming network resources by launching denial of service attacks (DoS / DDoS), mining cheating, etc. Such nodes are referred to as malicious nodes. The existence of malicious nodes can directly lead to the loss of privacy security and time cost of computing power demanders, and further lead to a decline in resource credibility in the computing power network, indirectly threatening the reliability and stability of the entire computing power network. Therefore, how to identify malicious nodes in the computing power network has become one of the key problems faced by the green and healthy development of the computing power network.

[0004] Reputation management is considered an effective method for identifying and handling malicious nodes in a network environment by analyzing the historical behavior of nodes in the system to quantify their credibility. Once the reputation score of a node falls below the system's preset threshold, the system will determine that the node is not trustworthy and take appropriate measures to exclude it from the network. However, in a real system, simply relying on a fixed reputation threshold is difficult to accurately capture the true intentions of malicious nodes, especially during the initialization phase of the system. Malicious nodes often use various strategies to probe the operation of the reputation evaluation mechanism, and then develop more flexible strategies to seek undue benefits or disrupt network stability. Therefore, how to identify the behavior intentions of malicious nodes and set a more flexible reputation model is a pressing issue, and then different restrictive measures are taken according to the destructive size of the malicious node. SUMMARY

[0005] The technical problem to be solved by the present application is to provide a malicious node behavior intention identification method for computing power network, which can accurately identify the computing nodes that may pose a threat to the computing power network, thereby ensuring the security and stability of the computing power network.

[0006] The technical solution adopted by the present application is a malicious node behavior intention identification method for computing power network, which comprises the following steps:

[0007] S1, divide the node set, the node set includes: normal node set NS, observation node set OS and malicious node set MS; the priority of the node set receiving tasks is: normal node set NS> observation node set OS> malicious node set MS; wherein the reputation value of the computing node in the normal node set NS after each execution of the task is calculated according to the benchmark reputation value formula; the reputation value of the computing node in the observation node set OS and the computing node in the malicious node set MS after each execution of the task is calculated according to the behavior reputation value formula;

[0008] S2, any computing node joining the computing power network is defaulted to be included in the normal node set NS, the computing node executes the task in the normal node set NS, and after the task is completed, the reputation feedback report is obtained by the task initiator for evaluation, the reputation value is calculated according to the reputation feedback report, and after a plurality of times of task, the reputation value after each task is collected to construct a reputation data set;

[0009] S3, input the reputation data set into the decision tree network model, and judge the node type of the computing node by the decision tree network model through calculation, and the specific process is:

[0010] S3.1, calculate a computing node parameter maximum-minimum difference SE, which represents the difference between the maximum value and the minimum value of the reputation value of the computing node in the last j tasks; calculate a computing node parameter suspicious degree SP j , which represents the number of failures and substandard quality in the last j tasks of the computing node; j

[0011] S3.2, judge the node type of the computing node: when the computing node satisfies SP < a and SE < β, the computing node is of a normal node type; when the computing node satisfies SP > a and SE > β, the computing node is of a malicious node type one; when the computing node satisfies SP β, the computing node is of a malicious node type two; when the computing node satisfies SP > a and SE < β, the computing node is of a malicious node type three;

[0012] S4, when the node type of the computing node is the normal node type, the computing node is retained in the normal node set NS; when the node type of the computing node is the malicious node type one, the computing node is listed in the malicious node set MS; when the node type of the computing node is the malicious node type two or the malicious node type three, the computing node is listed in the observation node set OS;

[0013] S5, when the computing node is in the observation node set OS, if the behavior reputation value of the computing node in the observation node set OS is lower than the threshold value θ1, the computing node is transferred from the observation node set OS to the malicious node set MS; if the behavior reputation value of the computing node in the observation node set OS reaches the maximum value of the behavior reputation value and keeps the task success for k1 times continuously, the computing node is separated from the observation node set OS and returned to the normal node set NS; if the computing node in the malicious node set MS fails to perform the task for two times continuously, the behavior reputation value of the computing node will be reduced to below the threshold value θ2, at which time the computing node is kicked out of the network; if the behavior reputation value of the computing node in the malicious node set MS reaches the maximum value of the behavior reputation value and keeps the task success for k2 times continuously, the computing node is separated from the malicious node set MS and returned to the observation node set OS.

[0014] ​The application has the beneficial effects that the application aims to accurately identify the computing nodes that may pose a threat to the network, thereby ensuring the security and stability of the network. By using the machine learning method and setting the suspicious degree parameter, the nodes with suspicious behavior are effectively screened out and included in the observation node set, and according to the behavior reputation value, the nodes with serious threats are transferred to the malicious node set or even kicked out of the computing power network, and the nodes with suspicious behavior and small threats continue to remain in the observation node set. Compared with the prior art, the reputation management scheme adds the node's own computing power factor and the user's satisfaction factor for the quality of service, thereby judging the malicious intention of the node and effectively eliminating the malicious node. Under the premise of ensuring that the computing power network improves the average quality of service, the malicious nodes with less behavior intention threat are reasonably utilized to reduce the computing power transaction risk in the computing power network and maintain the reliability of the computing power network service and the authenticity of the resources.

[0015] As preferred, the specific process of each execution of the computing node includes the following steps:

[0016] (1) The task initiator issues a computing task to the cloud server, and the cloud server abstractly models the received computing task and extracts task demand information, including maximum tolerance delay, computing data type and computing capacity demand;

[0017] (2) The cloud server collects resource information of the computing node, including computing capacity type, computing power size and remaining storage resource; then the cloud server synchronizes the computing node resource information to the brain of the computing network;

[0018] (3) According to the resource information of the computing node and the task demand information, the brain of the computing network obtains a scheduling strategy of the computing task routing through a scheduling and arrangement algorithm, and sends it to the cloud server;

[0019] (4) The cloud server routes and unloads the computing task to the corresponding computing node according to the forwarding decision;

[0020] (5) The computing node executes the task and uploads the task result to the cloud server, and returns the task result to the task initiator through the network connection device;

[0021] (6) The task initiator evaluates the task result and the quality of service and sends it to the cloud server, and the cloud server summarizes and sends a reputation feedback report to the brain of the computing network;

[0022] (7) The brain of the computing network updates the reputation value of the computing node according to the reputation feedback report and sends it to the computing node through the network connection device, and the computing node obtains the corresponding task benefit or punishment.

[0023] As preferred, the formula of the reference reputation value is:

[0024] R n =qL n +(1-q)S n ;

[0025] Where q represents the adjustment factor for long-term and short-term credit scores, and L n The long-term reputation value of a node is calculated after the nth task, and it is represented as: L n-1 Let C be the long-term reputation value of the node after the (n-1)th task. n This indicates whether the nth task was completed or not, with 1 for completion and 0 for non-completion; S n S represents the short-term reputation value of a node calculated after the nth task. n =(1-ρ)S n-1 +ρD n S n-1 D represents the short-term reputation value of a node after the (n-1)th task. n This represents the task initiator's final score for the nth task, expressed as: E represents the task initiator's evaluation of service quality, E = {E1, E2, ..., E...} m}, where m represents the dimension of the evaluation factor, and W represents the set of weights for the evaluation factors set by the cloud server when abstracting task requirements, W = {W1, W2, ..., W}. m}; ρ represents the memory factor.

[0026] Preferably, the formula for the behavioral reputation value is:

[0027]

[0028] Where r represents the number of times the computing node successfully executes the task when it is located in the observation node set OS or the malicious node set MS, s represents the number of times the computing node fails to execute the task when it is located in the observation node set OS or the malicious node set MS, and P represents a penalty parameter, which is equal to 1 when the computing node is located in the observation node set OS, and equal to 1 when the node is located in the malicious node set MS.

[0029] Preferably, in step S2, when any computing node joins the computing power network, it is necessary to determine whether the computing node is joining the computing power network for the first time. If so, a pseudonym, certificate, and initial reputation value are issued to the computing node. After the computing node obtains the initial reputation value, the cloud server arranges multiple built-in computing tasks for the computing node. If not, the historical reputation value of the computing node is checked, and the cloud server arranges one built-in computing task for the computing node.

[0030] As preferred, in step S3.1, the computing node parameter suspicious degree SP j The expression is:

[0031]

[0032] Wherein, j represents the number of times of executing tasks; C i represents the completion of the i-th task, and the task completion is valued as 1 and the task failure is valued as 0; D i represents the final score of the i-th task given by the task initiator. BRIEF DESCRIPTION OF DRAWINGS

[0033] Figure 1 It is a system model diagram of the computing power network in the application.

[0034] Figure 2 It is a flow chart of the computing node executing tasks in the application.

[0035] Figure 3 It is a flow chart of the reputation data collection and intention recognition link after the computing node joins the computing power network in the application.

[0036] Figure 4 It is a flow chart of the malicious node intention recognition in the computing power network in the embodiment of the application.

[0037] Figure 5 It is a variation diagram of the node set to which the computing node belongs after joining the computing power network in the embodiment of the application. DETAILED DESCRIPTION

[0038] The application will be further described in the following with reference to the accompanying drawings and in conjunction with the specific embodiments, so that those skilled in the art can implement the application according to the description herein, and the protection scope of the application is not limited to the specific embodiments.

[0039] The application provides a malicious node behavior intention recognition method for a computing power network, and a network system for implementing the method is shown in Figure 1 .

[0040] Figure 1 In the application, there are five entities in the whole network system, which are a task initiator, a cloud server, a computing node, a network connection device and a computing power network brain.

[0041] Task initiator: the task initiator refers to an individual or an application that needs to borrow the computing power resources in the network to execute a computing task.

[0042] Cloud server: The cloud server has relatively strong computing resources and storage resources. It abstractly models the tasks submitted by the task initiator, extracts the basic features of the tasks, stores the computing node parameter list, and undertakes the functions of sensing the computing node resource information and computing task routing and offloading.

[0043] Computing node: The computing node refers to a computing device and a computing device cluster that uses its idle available computing resources to complete tasks.

[0044] Network connection device: The network connection device refers to the information transmission channel between the cloud server and the computing node, the algorithm network brain and the computing node; for example, base stations, intelligent routers, etc., which are mainly responsible for data transmission.

[0045] Algorithm network brain: The algorithm network brain is mainly responsible for the arrangement of computing tasks, the distribution and update of the reputation of computing nodes.

[0046] As shown in Figure 2 , in specific embodiments, the process in which the computing node in the algorithm network executes a task is as follows:

[0047] Step 1: The task initiator publishes a computing task to the cloud server; the cloud server abstractly models the received computing task, and extracts the demand information in the task, including the maximum tolerance delay, the computing data type, and the computing capability demand and other indicators;

[0048] Step 2: The cloud server collects the resource information of the computing node, including the computing capability type and the computing power size and the remaining storage resources, and then the cloud server synchronizes the computing node resource information to the algorithm network brain;

[0049] Step 3: The algorithm network brain obtains the scheduling strategy of the computing task routing according to the node resource information and the task demand through a scheduling arrangement algorithm, and sends it to the cloud server;

[0050] Step 4: The cloud server routes and offloads the computing task to the corresponding computing node according to the scheduling decision;

[0051] Step 5: The computing node executes the task and uploads the task result to the cloud server, and returns the task result to the task initiator through the network connection device;

[0052] Step 6: The task initiator evaluates the task result and the quality of service and sends it to the cloud server, and the cloud server sends a reputation feedback report to the algorithm network brain after summarizing.

[0053] Step 7: The algorithm network brain updates the reputation value of the computing node according to the reputation feedback report, and sends it to the computing node through the network connection device, and the computing node obtains the corresponding task benefit or penalty.

[0054] The service quality evaluation E by the task initiator is composed of multiple evaluation factors, which can be expressed as: E = {E1, E2, ..., E...} m}, where m is the dimension of the evaluation factor, which can be latency, computation completion rate, time consumption, etc. When abstracting task requirements, the cloud server sets a weight set W for the evaluation factors, represented as: W = {W1, W2, ..., W}. m The numerous evaluation factors and their weights vary depending on the task type. For example, in autonomous driving and game graphics rendering tasks, the task initiator will prioritize the user experience, thus placing greater weight on factors such as latency. Conversely, in tasks like model training, the task trainer will focus more on the final result, giving greater weight to evaluation factors such as time consumption, computational completion, and model performance. Ultimately, the task initiator's score for this task can be expressed as: When D > θ, the server determines that the task is completed and calculates the number of times the node task has been completed, C. n =C n-1 +1, while D is the final score of this task and an important input parameter for determining the reputation value of the computing node; in this embodiment, θ is 0.7.

[0055] In a specific embodiment, the computing network contains the following types of computing nodes:

[0056] Normal node: A node in the computing power network that executes tasks and completes transactions normally according to the established rules. It is allowed to fail once by chance, but there will not be a second time in a short period of time.

[0057] Completely malicious nodes: return incorrect computational data or fail to execute tasks, wasting the time of the task initiator.

[0058] Random malicious nodes: Each time a task is executed, it is executed randomly, meaning that the node randomly selects between two strategies: executing a task or not executing a task.

[0059] Switch node: When a malicious node's reputation value is below a certain threshold, it will continue to behave normally (which can continue for a considerable period of time) to increase its reputation value. Once the threshold is reached, the malicious node will suddenly change its behavior to engage in malicious activities, and before its reputation value falls below the system's tolerable threshold, it will promptly switch back to normal behavior to continue accumulating reputation value.

[0060] Nodes that falsely report computing power: These nodes provide false information about computing resources to the computing network, causing tasks to be completed but taking longer than expected, or producing lower-quality computation results.

[0061] Sybli node: A malicious node that performs ordinary malicious actions. After each malicious action causes a decrease in reputation, it leaves the network and rejoins the network with a new identity and a new initial reputation value to continue performing ordinary malicious attacks.

[0062] Based on the above definition of nodes, all nodes are divided into the following four categories:

[0063] Normal node type: Reputation value increases steadily, with an occasional decrease, but it increases rapidly; this type of node includes normal nodes.

[0064] Malicious Node Type 1: A node's reputation value steadily decreases until it falls to a threshold, at which point it is kicked out of the network. This type of node includes completely malicious nodes and Sybli nodes.

[0065] Malicious Node Type Two: The reputation value steadily increases at a certain stage, then begins to decline after reaching a certain value, and then starts to increase again before approaching a certain threshold, repeating the above process. This type of node includes switch nodes.

[0066] Type 3 Malicious Nodes: Nodes whose reputation value changes inconsistently with normal nodes, exhibiting a higher frequency of reputation value declines than normal nodes. This type includes randomly generated malicious nodes and nodes that falsely report computing power.

[0067] The specific process of the method for identifying the malicious behavior intent of computing power networks provided by this invention includes the following steps:

[0068] Step 1: Divide the node sets, which include: normal node set NS, observation node set OS, and malicious node set MS;

[0069] The priority of receiving tasks for node sets is as follows: normal node set NS > observation node set OS > malicious node set MS.

[0070] The reputation value of the compute nodes in the normal node set NS after each task is obtained by calculating their baseline reputation value; the reputation values ​​of the compute nodes in the observation node set OS and the compute nodes in the malicious node set MS after each task are calculated by calculating their behavioral reputation value.

[0071] Step 2, as follows Figure 4 As shown, any computing node that joins the computing power network is included in the normal node set NS by default. The computing node performs tasks in the normal node set NS. After the task is completed, the task initiator evaluates and obtains a reputation feedback report. The reputation value is calculated based on the reputation feedback report. After several tasks, the reputation values ​​after each task are collected to construct a reputation dataset.

[0072] When any computing node joins the computing power network, such asFigure 3 As shown, it is necessary to determine whether the computing node is joining the computing power network for the first time. If so, a pseudonym, certificate, and initial reputation value are issued to the computing node. After the computing node obtains the initial reputation value, the cloud server arranges multiple built-in computing tasks for the computing node to overcome the cold start problem of reputation value and verify the authenticity of the node's computing resources. After completing multiple built-in computing tasks, the computing node successfully verifies the authenticity of its resources and obtains a reputation value used to evaluate the reliability of its resources. If not, the historical reputation value of the computing node is checked, and the cloud server arranges a built-in computing task for the computing node to verify the authenticity of the node's computing resources.

[0073] Step 3: Input the aforementioned reputation dataset into the decision tree network model. The decision tree network model then determines the node type of the computation nodes through calculation. The specific process is as follows:

[0074] Calculate the maximum and minimum difference (SE) of the computation node parameters, where SE represents the difference between the maximum and minimum reputation values ​​of the computation node within its most recent n tasks; calculate the suspiciousness (SP) of the computation node parameters. j The computation node parameter suspicion level SP j This represents the number of times a computing node has failed or failed to meet quality standards in the last n tasks.

[0075] Among them, the suspiciousness of the node parameters SP is calculated. j The expression is:

[0076]

[0077] Where j represents the number of times the task is executed; C i This indicates the completion status of the i-th task, with a value of 1 for task completion and a value of 0 for task failure; D i This represents the task initiator's final score for the i-th task;

[0078] like Figure 4 As shown, the node type of the computing node is determined as follows: when the computing node satisfies SP < 6 and SE < 20, the computing node is a normal node; when the computing node satisfies SP > 6 and SE > 20, the computing node is a malicious node type one; when the computing node satisfies SP < 6 and SE > 20, the computing node is a malicious node type two; when the computing node satisfies SP > 6 and SE < 20, the computing node is a malicious node type three.

[0079] Step 4: When the node type of the computing node is a normal node, the computing node is retained in the normal node set NS; when the node type of the computing node is a malicious node type 1, the computing node is included in the malicious node set MS; when the node type of the computing node is a malicious node type 2 or a malicious node type 3, the computing node is included in the observation node set OS.

[0080] Step 5, as follows Figure 5 As shown, when the computing node is located in the observation node set OS, if the computing node's behavior reputation value in the observation node set OS is lower than the threshold θ1 = 0.5, then the computing node is transferred from the observation node set OS to the malicious node set MS; if the computing node's behavior reputation value in the observation node set OS reaches the maximum behavior reputation value (this maximum behavior reputation value is the maximum behavior reputation value corresponding to the observation node set OS) and maintains task success for k1 = 10 consecutive times, then the computing node leaves the observation node set OS and returns to the normal node set NS; if the computing node fails to execute tasks twice consecutively in the malicious node set MS, then the computing node's behavior reputation value will drop below the threshold θ2 = 0.5, at which point the computing node is kicked out of the network; if the computing node's behavior reputation value in the malicious node set MS reaches the maximum behavior reputation value (this maximum behavior reputation value is the maximum behavior reputation value corresponding to the malicious node set MS) and maintains task success for k2 = 5 consecutive times, then the computing node leaves the malicious node set MS and returns to the observation node set OS;

[0081] Among them, the computing node enabled behavior reputation value located in the observation node set OS and the malicious node set MS is expressed as follows: Where r represents the number of successful tasks, s represents the number of failed tasks, and P represents the penalty parameter. When a computing node is transferred between different node sets, the values ​​of r and s are initialized to 0. In the observation node set OS, the penalty parameter P is related to the node information and has an initial value of 1. In the malicious node set, the penalty parameter P has an initial value of 2. When the computing power of a node (the sum of the computing power of chips providing the same type of computing power) is less than 10 TFLOPS or 10 TOPS, the penalty coefficient P is double the initial value. When the computing power of a node is between 10 TFLOPS and 1 PFLOPS or the same level of logical computing capability, the penalty coefficient P is double the original value. When the computing power of a node is greater than 1 PFLOPS or the same level of logical computing capability, the penalty coefficient P is triple the original value.

[0082] In this embodiment, the computing power of all computing nodes (the sum of the computing power of chips providing the same type of computing power) is less than 10 TFLOPS or 10 TOPS; after classification by the decision tree model, the nodes will be judged according to their two suspiciousness parameters to determine their malicious intent, and nodes with different intents will be classified into the corresponding node types.

[0083] Normal nodes will always remain in the normal node set NS. Even if a normal node is occasionally listed in the watch node set OS due to a task failure, the node can still detach from the watch node set OS and return to the normal node set NS through continuous normal behavior.

[0084] A completely malicious node, after completing the network's built-in computational tasks and gaining an initial reputation score, will have its reputation score rapidly decline due to continued malicious behavior. Once transferred to the malicious node set MS, it will be kicked out of the network after two consecutive task failures.

[0085] Due to the randomness of their normal task execution, random malicious nodes may be categorized into the normal node set NS and the observer node set OS. Random malicious nodes with a probability of less than 70% of their normal task execution will quickly move to the observer node set and be used for unimportant and low-reward computational tasks. Over time, the probability of random malicious nodes not kicked out of the network executing tasks will approach that of normal nodes or their threat level will be lower than that of other malicious nodes.

[0086] For nodes that falsely report computing power, when the difference between the falsely reported computing power and the actual computing power is too large, the user's service quality evaluation will be low across all dimensions. The final aggregated evaluation score will be below the threshold, causing the task to be judged as a failure. Long-term failures will result in the node being classified as a completely malicious node and included in the malicious node set MS. When the difference between the falsely reported computing power and the actual computing power is not significant, the final evaluation will be slightly higher than the threshold, but the service quality will not reach an excellent level. If such nodes consistently fail to meet excellent quality requirements, they will still be included in the observation node set OS and assigned to tasks of low importance and low reward.

[0087] For Sybli nodes, the entire network collects their device identifier and physical address when they join the network to prevent nodes and devices from joining the network repeatedly.

[0088] Assuming the switch node has joined the network and gathered intelligence about the computing power network through probing, nodes in the normal node set accumulate reputation values ​​exceeding a set threshold, at which point the node begins to change behavior and launch an attack. After classification by a decision tree and threshold judgment of two parameters, a special sawtooth-shaped reputation change graph causes the node to be added to the observation node set OS. If a switch node in the observation node set chooses to continue attacking when its initial behavior reputation value is 0.5, the node is transferred to the malicious node set MS. If the node chooses not to attack but instead changes its behavior to accumulate reputation values, and then changes its behavior to attack after exceeding the preset threshold of 0.75, its behavior reputation value will be reduced to 0.5 after only three malicious tasks. If the node chooses to continue attacking at this point, it will be transferred to the malicious node set MS. However, if it does not attack, the node needs to complete 7 or more successful tasks to accumulate reputation values ​​and exceed the threshold. At this point, the switch node's task success rate remains at 70%, resulting in low attack efficiency. Switch nodes with a task success rate below 70% are transferred to the malicious node set MS. For switch nodes located in the malicious node set, due to the penalty coefficient of this node set... Therefore, a node's behavioral reputation value will drop from 0.75 to the threshold of 0.5 with just one failed task, while it takes more than 15 successful tasks to increase the reputation value from 0.5 to 0.75. At this point, the attack efficiency of switching nodes becomes very low and the threat is controllable.

[0089] By combining machine learning and reputation management, the behavioral intent of all nodes is identified. Nodes with a high degree of threat are listed in the malicious node set (MS) and removed from the network after verification. Nodes with a low degree of threat are listed in the observation node set (OS), and their retention is determined based on the network's needs. When the network's computing resources are insufficient, nodes with manageable threats can be used to handle unimportant and low-reward tasks, freeing up normal nodes to handle important and high-reward tasks.

[0090] In summary, the malicious node behavior intent identification method described in this embodiment of the invention uses machine learning and reputation management to identify and classify the behavior intent of nodes. While ensuring that the average service quality of the computing power network is improved, it can make reasonable use of the computing resources of malicious nodes with less threatening behavior intent, reduce the risk of computing power transactions in the computing power network, and maintain the reliability of computing power network services, the authenticity of resources, and the stability of the network.

[0091] While the disclosure is as stated above, its scope of protection is not limited thereto. Those skilled in the art can make various changes and modifications without departing from the spirit and scope of this disclosure, and all such changes and modifications will fall within the protection scope of this invention.

Claims

1. A method for identifying the malicious behavior intent of nodes in a computing power network, characterized in that: The method includes the following steps: S1. Divide the node set, which includes: a normal node set NS, an observation node set OS, and a malicious node set MS; the priority of receiving tasks by the node set is: normal node set NS > observation node set OS > malicious node set MS; wherein, the computing nodes in the normal node set NS calculate their baseline reputation value after each task execution; the computing nodes in the observation node set OS and the computing nodes in the malicious node set MS calculate their behavioral reputation value after each task execution; the expression for the baseline reputation value is: R n =qL n +(1-q)S n Where q represents the adjustment factor for long-term and short-term credit scores, and L... n The long-term reputation value of a node is calculated after the nth task, and it is represented as: L n-1 Let C be the long-term reputation value of the node after the (n-1)th task. n This indicates whether the nth task was completed or not, with 1 for completion and 0 for non-completion; S n S represents the short-term reputation value of a node calculated after the nth task. n =(1-ρ)S n-1 +ρD n S n-1 D represents the short-term reputation value of a node after the (n-1)th task. n This represents the task initiator's final score for the nth task, expressed as: E represents the task initiator's evaluation of service quality, E = [E1, E2, ..., E...]. m ], m represents the dimension of the evaluation factor, W represents the weight set of the evaluation factors set by the cloud server for the evaluation factors when abstracting task requirements, W = [W1, W2, ..., W... m ]; ρ represents the memory factor; the expression for the behavioral reputation value is: Where r represents the number of times the computing node successfully executes the task when it is located in the observation node set OS or the malicious node set MS, s represents the number of times the computing node fails to execute the task when it is located in the observation node set OS or the malicious node set MS, and P represents a penalty parameter, which is approximately equal to 1 when the computing node is located in the observation node set OS, and approximately equal to 1 when the node is located in the malicious node set MS. S2. Any computing node that joins the computing power network is included in the normal node set NS by default. The computing node performs tasks and accumulates reputation value in the normal node set NS. After several tasks, the reputation value after each task is collected to construct a reputation dataset. S3. Input the aforementioned reputation dataset into the decision tree network model. The decision tree network model then determines the node type of the computation nodes through calculation. The specific process is as follows: S3.1 Calculate the maximum and minimum difference SE of the computing node parameters, where the maximum and minimum difference SE represents the difference between the maximum and minimum reputation values ​​of the computing node in the most recent n tasks; calculate the suspiciousness SP of the computing node parameters, where the suspiciousness SP represents the number of times the computing node has failed or failed to meet quality standards in the most recent n tasks. S3.2 Determine the node type of the computing node: When the computing node satisfies SP < α and SE < β, the computing node is a normal node; when the computing node satisfies SP > α and SE > β, the computing node is a malicious node type one; when the computing node satisfies SP < α and SE > β, the computing node is a malicious node type two; when the computing node satisfies SP > α and SE < β, the computing node is a malicious node type three. S4. When the node type of the computing node is a normal node, the computing node is retained in the normal node set NS; when the node type of the computing node is a malicious node type one, the computing node is included in the malicious node set MS; when the node type of the computing node is a malicious node type two or a malicious node type three, the computing node is included in the observation node set OS. S5. When the computing node is located in the observation node set OS, if the computing node's behavior reputation value in the observation node set OS is lower than the threshold θ1, then the computing node is transferred from the observation node set OS to the malicious node set MS; if the computing node's behavior reputation value in the observation node set OS reaches the maximum behavior reputation value and maintains task success for k1 consecutive times, then the computing node leaves the observation node set OS and returns to the normal node set NS; if the computing node fails to execute tasks twice consecutively in the malicious node set MS, then the computing node's behavior reputation value will drop below the threshold θ2, at which point the computing node is kicked out of the network; if the computing node's behavior reputation value in the malicious node set MS reaches the maximum behavior reputation value and maintains task success for k2 consecutive times, then the computing node leaves the malicious node set MS and returns to the observation node set OS.

2. The method for identifying malicious node behavior intent in a computing power network according to claim 1, characterized in that: The specific process of each task execution by the computing node includes the following steps: (1) The task initiator publishes a computing task to the cloud server. The cloud server abstracts and models the received computing task and extracts the task requirement information, including the maximum tolerable latency, the type of computing data and the computing capacity requirement. (2) The cloud server collects resource information of computing nodes, including computing power type, computing power size and remaining storage resources; Then the cloud server synchronizes the computing node resource information to the computing network brain; (3) Based on the resource information and task requirement information of the computing nodes, the computing network brain derives the scheduling strategy for the routing of computing tasks through the scheduling and orchestration algorithm, and sends it to the cloud server. (4) The cloud server routes and unloads the computing tasks to the corresponding computing nodes according to the scheduling strategy. (5) The computing node executes the task and uploads the task result to the cloud server, and at the same time returns the task result to the task initiator through the network connection device; (6) The task initiator evaluates the task results and service quality and sends them to the cloud server. The cloud server summarizes the evaluation and sends a reputation feedback report to the computing network brain. (7) The computing network brain updates the reputation value of the computing node based on the reputation feedback report and sends it to the computing node through the network connection device. The computing node then receives the corresponding task benefits or penalties.

3. The method for identifying malicious node behavior intent in a computing power network according to claim 1, characterized in that: In step S2, when any computing node joins the computing power network, it is necessary to determine whether the computing node is joining the computing power network for the first time. If so, a pseudonym, certificate and initial reputation value are issued to the computing node. After a computing node obtains an initial reputation value, the cloud server schedules multiple built-in computing tasks for the computing node; otherwise, the cloud server checks the historical reputation value of the computing node and schedules one built-in computing task for the computing node.

4. The method for identifying malicious node behavior intent in a computing power network according to claim 3, characterized in that: In step S3.1, the expression for the suspiciousness degree SP of the calculated node parameters is: Where n represents the number of times the task is executed; Cn represents the completion status of the nth task, with a value of 1 for task completion and a value of 0 for task failure; Dn represents the final evaluation of the transaction by the task initiator after the nth task.

Images