Distributed malicious node detection model construction method and system based on consensus mechanism

Abstract

The invention discloses a distributed malicious node detection model construction method and system based on a consensus mechanism, and relates to the technical field of Internet of Things security protection, and the method comprises the steps: carrying out the quantification of a trust value through cognitive aggregation; amplifying the trust value difference, generating a cognitive matrix and defining node reputation; and calculating node cognitive similarity and a final trust value, and classifying the nodes. According to the distributed malicious node detection model construction method based on the consensus mechanism provided by the invention, the robustness and the anti-interference capability of a distributed system are improved by adding cognitive tags into circulation data packets, the nodes are regulated and controlled by introducing a reward and punishment mechanism, the false alarm rate and the missing report rate are reduced, credibility quantification is performed through comprehensive indexes, and the reliability of the distributed malicious node detection model is improved. The global cognitive consensus is realized through the flow of the cognitive tags in the network, the overall reliability of the system is improved, and better effects are achieved in the aspects of robustness, transparency and reliability.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things security protection, and specifically to a method for constructing a distributed malicious node detection model based on a consensus mechanism. Background Art

[0002] Under different application requirements, the applications carried by the multifunctional standard source and the digital multimeter will also be different, which makes the originally unidirectional and rigid power grid become more and more open. At present, the applications carried by the intelligent multifunctional standard source and the digital multimeter are provided by different suppliers, but the behavior of suppliers is difficult to constrain. At the same time, insecure application distribution channels will also have a significant impact on the security of the software supply chain. Malicious nodes may cause serious impacts on digital meter terminals and power information transmission by destroying the communication between nodes, tampering with transmission data or sending false information. Detecting and combating malicious nodes is crucial to ensuring the security of the network. However, due to the limited computing power of IoT devices, they cannot support complex anomaly detection algorithms. In addition, this distributed detection mechanism usually relies on each node to monitor the behavior of its neighboring nodes (such as data packet monitoring, behavior pattern analysis, etc.), and judge whether the neighbor is a malicious node based on these observations. The effectiveness of this method depends largely on the reliability and survival status of the nodes used for monitoring. Once these key monitoring nodes fail or are damaged, the effectiveness of the entire detection system will be greatly affected. If malicious nodes try to confuse the public by sending false reports, it may lead to misjudgment.

[0003] The consensus mechanism provides a potential solution to such problems. It allows all participants in the network to share and disseminate the information they have collected from each other, thereby forming a knowledge base within the network. In this way, even if a problem occurs in a specific node, other nodes can still continue to maintain this shared knowledge base, reducing the impact of a single node failure on the overall performance of the system. More importantly, when making decisions under the consensus mechanism, the opinions of the entire network rather than a single node are considered, which means that it is difficult for a few malicious nodes to manipulate global decisions alone, thereby improving the system's anti-interference ability and security. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problem solved by the present invention is: the existing malicious node detection method relies on single node judgment, has the risk of key node failure, has the risk of misjudgment of malicious nodes, and how to achieve the optimization problem of accurate detection and classification of distributed malicious nodes through a consensus mechanism.

[0006] To solve the above technical problems, the present invention provides the following technical solutions: a method for constructing a distributed malicious node detection model based on a consensus mechanism, comprising quantifying the trust value through cognitive aggregation; amplifying the trust value difference, generating a cognitive matrix and defining the node reputation; calculating the node cognitive similarity and the final trust value, and classifying the nodes.

[0007] As a preferred scheme of the method for constructing a distributed malicious node detection model based on a consensus mechanism described in the present invention, wherein: the quantification of the trust value through cognitive aggregation includes clustering the nodes into tampering attack sets, packet loss attack sets, replay attack sets, and trusted node sets based on the trust value of the nodes through the K-means method.

[0008] As a preferred solution of the method for constructing a distributed malicious node detection model based on a consensus mechanism described in the present invention, the quantification of the trust value through cognitive aggregation also includes quantifying the trust value from three dimensions: reliability, volatility, and trustworthiness. The reliability calculation is expressed as:

[0009]

[0010] Among them, r i is the reliability of the i-th node, c is the cognition of node i under the cognitive label, H, V, S are the honesty value, forwarding value and redundancy value of the node respectively, and the volatility calculation is expressed as:

[0011]

[0012] Among them, c n As a new cognitive label, c o is the original cognitive label, f c For the fluctuation of cognitive labels, the trust calculation is expressed as:

[0013]

[0014] Among them, ρ d and ρ i are the maximum values ​​of the trustworthiness when the two nodes are adjacent and when the nodes are not adjacent. Through cognitive aggregation, the trust value is quantified from three dimensions as follows:

[0015]

[0016]

[0017]

[0018] Among them, u is the label after the aggregated cognitive update.

[0019] As a preferred solution of the method for constructing a distributed malicious node detection model based on a consensus mechanism described in the present invention, the amplification of the trust value difference includes amplifying the trust value difference between the trusted node and the malicious node by punishing malicious attack behaviors and rewarding trusted nodes. The form of the punishment is expressed as:

[0020]

[0021] The reward form is:

[0022]

[0023] Among them, θ hi It is a reward and punishment factor.

[0024] As a preferred solution of the method for constructing a distributed malicious node detection model based on a consensus mechanism described in the present invention, the generating of the cognitive matrix and defining the node reputation includes collecting cognitive information and generating a cognitive matrix in the power Internet of Things base station, which is expressed as:

[0025]

[0026] Among them, c n,m is the perception of node n on node m, and the reputation of node n when evaluating node m is defined as:

[0027]

[0028]

[0029] Among them, ω nm and ω km is the cognitive weight.

[0030] As a preferred solution of the method for constructing a distributed malicious node detection model based on a consensus mechanism described in the present invention, the computing node cognitive similarity and the final trust value include computing node cognitive similarity expressed as:

[0031]

[0032]

[0033]

[0034]

[0035] Among them, A(m) is the average cognition of m by the neighboring nodes, D(c k,m ,A(m)) is c k,m and the similarity with A(m), m” is the neighboring node of node m, P mis the number of adjacent nodes of m, and the final trust value of node m is expressed as:

[0036]

[0037]

[0038]

[0039] Among them, T m is the final trust value of node m.

[0040] As a preferred solution of the method for constructing a distributed malicious node detection model based on a consensus mechanism described in the present invention, the node classification includes performing malicious node detection based on the trust value after obtaining the trust value of all nodes, using H, V, and S in the node trust value as inputs of K-Means respectively, and dividing the nodes into a high trust group, a medium trust group, and a low trust group according to each group of inputs.

[0041] Another object of the present invention is to provide a distributed malicious node detection model construction system based on a consensus mechanism, which can calculate the cognitive similarity and final trust value between nodes based on the information of the cognitive matrix through a trust value calculation module, thereby solving the current problem of over-reliance on single-node monitoring.

[0042] As a preferred solution of the distributed malicious node detection model construction system based on the consensus mechanism described in the present invention, it includes: a trust quantification module, a matrix definition module, and a trust value calculation module; the trust quantification module is used to quantify the trust value through cognitive aggregation; the matrix definition module is used to amplify the trust value difference, generate a cognitive matrix and define the node reputation; the trust value calculation module is used to calculate the node cognitive similarity and the final trust value, and classify the nodes.

[0043] A computer device includes a memory and a processor, wherein the memory stores a computer program, and is characterized in that the processor executes the computer program to implement a step of a method for constructing a distributed malicious node detection model based on a consensus mechanism.

[0044] A computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of a method for constructing a distributed malicious node detection model based on a consensus mechanism are implemented.

[0045] Beneficial effects of the present invention: The distributed malicious node detection model construction method based on the consensus mechanism provided by the present invention improves the robustness and anti-interference ability of the distributed system by attaching cognitive tags to the circulating data packets, regulates the nodes by introducing a reward and punishment mechanism, reduces the false alarm rate and the missed alarm rate, quantifies the trust through comprehensive indicators, improves the transparency of the system and the scientific nature of the judgment, realizes global cognitive consensus through the flow of cognitive tags in the network, and improves the overall reliability of the system. The present invention achieves better results in terms of robustness, transparency and reliability. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them:

[0047] Figure 1 An overall flow chart of a method for constructing a distributed malicious node detection model based on a consensus mechanism provided in the first embodiment of the present invention.

[0048] Figure 2 A K-Means-based malicious node clustering classification diagram of the distributed malicious node detection model construction method based on the consensus mechanism provided in the first embodiment of the present invention.

[0049] Figure 3 An overall module diagram of a distributed malicious node detection model construction system based on a consensus mechanism provided in the third embodiment of the present invention. DETAILED DESCRIPTION

[0050] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0051] Example 1

[0052] Reference Figure 1-Figure 2 , is an embodiment of the present invention, and provides a method for constructing a distributed malicious node detection model based on a consensus mechanism, comprising:

[0053] S1: Quantify trust value through cognitive aggregation.

[0054] Furthermore, trust values ​​are quantified through cognitive aggregation, including node-based trust values.

[0055] It should be noted that the nodes are clustered into tampering attack set and packet loss attack set by K-means method.

[0056] Replay attack set, and trusted node set.

[0057] Furthermore, quantifying the trust value through cognitive aggregation also includes quantifying the trust value from three dimensions: reliability, volatility, and trustworthiness.

[0058] It should be noted that the reliability calculation is expressed as:

[0059]

[0060] Among them, r i is the reliability of the i-th node, c is the cognition of node i under the cognitive label, H, V, S are the honesty value, forwarding value and redundancy value of the node respectively, and the volatility calculation is expressed as:

[0061]

[0062] Among them, c n As a new cognitive label, c o is the original cognitive label, f c For the fluctuation of cognitive labels, the trust calculation is expressed as:

[0063]

[0064] Among them, ρ d and ρ i are the maximum values ​​of the trustworthiness when the two nodes are adjacent and when the nodes are not adjacent. Through cognitive aggregation, the trust value is quantified from three dimensions as follows:

[0065]

[0066]

[0067]

[0068] Among them, u is the label after the aggregated cognitive update.

[0069] S2: Amplify the trust value difference, generate the cognitive matrix and define the node reputation.

[0070] Furthermore, amplifying the trust value gap includes punishing malicious attacks and rewarding trusted nodes.

[0071] It should be noted that the difference in trust value between the trusted node and the malicious node is magnified, and the penalty form is expressed as:

[0072]

[0073] The reward form is:

[0074]

[0075] Among them, θ hi It is a reward and punishment factor.

[0076] Furthermore, the cognitive matrix is ​​generated and the node reputation is defined to be included in the power IoT base station.

[0077] It should be noted that cognitive information is collected and a cognitive matrix is ​​generated, which is expressed as:

[0078]

[0079] Among them, c n,m is the perception of node n on node m, and the reputation of node n when evaluating node m is defined as:

[0080]

[0081]

[0082] Among them, ω nm and ω km is the cognitive weight.

[0083] S3: Calculate the node cognitive similarity and final trust value, and classify the nodes.

[0084] Furthermore, calculating the node cognitive similarity and the final trust value includes calculating the node cognitive similarity.

[0085] It should be noted that the computation node cognitive similarity is expressed as:

[0086]

[0087]

[0088]

[0089]

[0090] Among them, A(m) is the average cognition of m by the neighboring nodes, D(c k,m ,A(m)) is c k,m and the similarity with A(m), m” is the neighboring node of node m, P mis the number of adjacent nodes of m, and the final trust value of node m is expressed as:

[0091]

[0092]

[0093]

[0094] Among them, T m is the final trust value of node m.

[0095] Furthermore, the classification of nodes is included after the trust values ​​of all nodes are obtained.

[0096] It should be noted that malicious node detection is performed based on trust values, and H, V, and S in the node trust values ​​are used as inputs of K-Means respectively. According to each group of inputs, the nodes are divided into high trust group, medium trust group, and low trust group.

[0097] Example 2

[0098] An embodiment of the present invention provides a method for constructing a distributed malicious node detection model based on a consensus mechanism. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0099] In the preset test scenario, all IoT devices are randomly distributed in a 100m x 100m square area, and the communication radius of each device is set between 10 and 15m. The construction of the network follows several key principles. First, ensure that each device has at least one data path to the base station (Sink) to ensure the connectivity of the entire network. Second, the source point of the data packet is located on the left boundary of the area, and the base station that receives these data packets is located on the right. Third, the starting point of the data packet and the final receiving base station are clearly specified as trusted nodes. The above two conditions are crucial basic requirements for ensuring the normal operation of the neural network sensor.

[0100] In the above simulation environment, the present invention conducted experiments in combination with different dimensional parameters that may affect the node detection effect to evaluate the malicious node detection performance of the proposed DCONST algorithm. According to the technical route of the present invention, the performance of the model was tested from five dimensions: diversity of network paths, number of nodes, number of circulating data packets, attack type, and proportion of malicious nodes.

[0101] As shown in Table 1, the experimental results show that the change of network scale does not affect the performance of the DCONST algorithm, and when the number of nodes increases to 22, the detection effect of DCONST is obvious. Due to other detection methods, the detection accuracy of DCONST in various modes increases with the increase of the number of circulating data packets, and then it is accompanied by certain fluctuations. For different types of attacks, the detection accuracy of DCONST is greatly improved by introducing a reward and punishment mechanism. It is worth noting that with the increase of the proportion of malicious nodes, the detection effect of DCONST gradually deteriorates. This is because with the increase of the number of malicious nodes, it is more difficult to generate reward evidence in the network to improve the trust value of trusted nodes, thereby increasing the false alarm rate of detection. In actual network nodes, the proportion of malicious nodes is small and does not appear to be high.

[0102] The DCONST model evaluates the trust value of nodes during the daily communication tasks of the network. By embedding cognitive tags behind the data packets circulating in the network, the cognition of each node can be spread to the entire network with the flow of data packets, and then a cognitive consensus is reached in the entire network. When DCONST needs to perform malicious node detection, the base station will collect the cognitive information of each node and calculate the node trust value. Based on the trust value of the node, DCONST uses the K-means method to locate malicious nodes and identify their specific attack behaviors, thereby effectively responding to security threats in distributed networks.

[0103] Table 1 Experimental data table

[0104] Test Dimensions Test indicators Test scenario Experimental Results Network path diversity Detection accuracy (%) Number of paths: 3, 5, 7 [95,96,95] Number of nodes Number of nodes [10,20,30,40,50] [90,93,95,96,94] Number of circulating packets Number of packets [100,300,500,700,900] [85,88,92,95,93] Attack Types Classification accuracy (%) ['tampering', 'packet loss', 'replay'] [90,92,94] Malicious node ratio False alarm rate (%) [0.1,0.2,0.3,0.4,0.5] [5,7,10,15,20]

[0105] Example 3

[0106] Reference Figure 3 , as an embodiment of the present invention, provides a distributed malicious node detection model construction system based on a consensus mechanism, including: a trust quantification module, a matrix definition module, and a trust value calculation module.

[0107] The trust quantification module is used to quantify the trust value through cognitive aggregation; the matrix definition module is used to amplify the trust value difference, generate the cognitive matrix and define the node reputation; the trust value calculation module is used to calculate the node cognitive similarity and the final trust value, and classify the nodes.

[0108] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0109] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0110] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0111] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc. It should be noted that the above embodiments are only used to illustrate the technical solution of the present invention and are not limited. Although the present invention is described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention, which should be included in the scope of the claims of the present invention.

[0112] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for constructing a distributed malicious node detection model based on a consensus mechanism, characterized in that: include: Quantify trust value through cognitive aggregation; Amplify the trust value difference, generate the cognitive matrix and define the node reputation; Calculate the node cognitive similarity and final trust value, and classify the nodes.

2. The method for constructing a distributed malicious node detection model based on a consensus mechanism as claimed in claim 1, characterized in that: The quantification of trust value through cognitive aggregation includes clustering nodes into tampering attack sets, packet loss attack sets, replay attack sets, and trusted node sets based on the trust value of the nodes through the K-means method.

3. The method for constructing a distributed malicious node detection model based on a consensus mechanism as claimed in claim 2, characterized in that: The quantification of the trust value through cognitive aggregation also includes quantifying the trust value from three dimensions: reliability, volatility, and trustworthiness. The reliability calculation is expressed as: Among them, r i is the reliability of the i-th node, c is the cognition of node i under the cognitive label, H, V, S are the honesty value, forwarding value and redundancy value of the node respectively, and the volatility calculation is expressed as: Among them, c n As a new cognitive label, c o is the original cognitive label, f c For the fluctuation of cognitive labels, the trust calculation is expressed as: Among them, ρ d and ρ i are the maximum values ​​of the trustworthiness when the two nodes are adjacent and when the nodes are not adjacent. Through cognitive aggregation, the trust value is quantified from three dimensions as follows: Among them, u is the label after the aggregated cognitive update.

4. The method for constructing a distributed malicious node detection model based on a consensus mechanism as claimed in claim 3, characterized in that: The amplification of the trust value difference includes amplifying the trust value difference between the trusted node and the malicious node by punishing malicious attack behaviors and rewarding trusted nodes. The form of the punishment is expressed as: The reward form is: Among them, θ hi It is a reward and punishment factor.

5. The method for constructing a distributed malicious node detection model based on a consensus mechanism as claimed in claim 4, characterized in that: The generation of the cognitive matrix and definition of node reputation includes collecting cognitive information and generating a cognitive matrix in the power Internet of Things base station, which is expressed as: Among them, c n,m is the perception of node n on node m, and the reputation of node n when evaluating node m is defined as: Among them, ω nm and ω km is the cognitive weight.

6. The method for constructing a distributed malicious node detection model based on a consensus mechanism as claimed in claim 5, characterized in that: The computing node cognitive similarity and the final trust value include computing node cognitive similarity expressed as: D(c k,m ,A(m))=|c k,m ·H-A(m)·H|+|c k,m ·V-A(m)·V|+|c k,m ·S-A(m)·S| Among them, A(m) is the average cognition of m by the neighboring nodes, D(c k,m ,A(m)) is c k,m and the similarity with A(m), m” is the neighboring node of node m, P m is the number of adjacent nodes of m, and the final trust value of node m is expressed as: Among them, T m is the final trust value of node m.

7. The method for constructing a distributed malicious node detection model based on a consensus mechanism as claimed in claim 6, characterized in that: The node classification includes detecting malicious nodes based on the trust values ​​after obtaining the trust values ​​of all nodes, using H, V, and S in the node trust values ​​as inputs of K-Means respectively, and dividing the nodes into high trust group, medium trust group, and low trust group according to each group of inputs.

8. A system using the method for constructing a distributed malicious node detection model based on a consensus mechanism as claimed in any one of claims 1 to 7, characterized in that: It includes trust quantification module, matrix definition module and trust value calculation module; The trust quantification module is used to quantify the trust value through cognitive aggregation; The matrix definition module is used to amplify the trust value difference, generate the cognitive matrix and define the node reputation; The trust value calculation module is used to calculate the node cognitive similarity and the final trust value, and classify the nodes.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method for building a distributed malicious node detection model based on a consensus mechanism as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for building a distributed malicious node detection model based on a consensus mechanism as described in any one of claims 1 to 7 are implemented.

Images