Centralized trust evaluation method and device based on cloud theory and storage medium

Abstract

The invention discloses a centralized trust evaluation method and device based on a cloud theory and a storage medium, belongs to the technical field of trust models of underwater wireless sensor networks, and particularly relates to a trust evaluation method of an underwater wireless sensor network. The problems that according to an existing trust model for a clustering type network topology structure, the fuzziness and uncertainty characteristics of trust are neglected, and the trust model depends on a threshold value and a standard trust cloud which are set manually are solved. The method comprises the following steps: a sink node calculates and updates a packet sending cloud model, a data cloud model and an energy cloud model of nodes of a whole network by using a reverse cloud algorithm; calculating a mean square error between the input sample and the output sample as a reconstruction error; and inputting the reconstruction error into an SVM model to carry out node dichotomy so as to realize malicious node identification. The centralized trust evaluation method and device based on the cloud theory and the storage medium are suitable for trust evaluation of nodes in a clustering network topology structure.

Description

Technical Field

[0001] The present invention relates to the technical field of trust models of underwater wireless sensor networks, and in particular to a trust evaluation method of underwater wireless sensor networks. Background Art

[0002] As an important part of the underwater information network, underwater wireless sensor networks (UWSNs) are of great significance for expanding the monitoring range of underwater information networks and improving the three-dimensional information network of sea, land, air and space. They have been widely used in pollution monitoring, oil and gas exploration, navigation control, tsunami warning, military and security fields.

[0003] UWSNs are distributed wireless communication networks formed by deploying a large number of low-cost, micro-sized communication nodes carrying various acoustic, magnetic, and marine biochemical sensors in a designated sea area. These nodes then self-organize using underwater acoustic wireless communication to perform tasks such as environmental monitoring and data collection. The collected data is forwarded hop by hop to an underwater aggregation node or surface base station, and then sent to users via radio frequency or wired communication.

[0004] Security is a critical issue in the field of UWSNs. UWSNs raise security requirements including node authentication, data confidentiality, and data integrity. Many researchers use cryptography to ensure these security requirements.

[0005] However, sensor nodes are disposable and inexpensive, so most are not tamper-resistant. Furthermore, sensor nodes are often deployed in unmanned or even hostile areas. Premeditated attackers can physically intrude on or relocate sensor nodes, compromising them and enabling them to integrate into the network and launch malicious attacks such as tampering, Sybil, and selfish attacks. Because compromised nodes are physically compromised and their memory is parsed and overwritten, they contain the cryptographic information necessary for legitimate nodes. Therefore, cryptographic technology cannot provide adequate protection for networks with compromised nodes.

[0006] The presence of compromised nodes within the network introduces new security risks. A node may pass traditional cryptographic hard security checks (authorization and access) but still report false measurements to gain an advantage over other nodes. This security risk is called a "soft security threat."

[0007] Trust management mechanisms are considered an effective complement to traditional cryptographic mechanisms. They consist of a series of trust-based security technologies used to protect networks from attacks by compromised nodes (i.e., addressing soft security threats). Since Marsh introduced trust research into the computer field, numerous trust models have been proposed in areas such as distributed networks, ubiquitous computing, peer-to-peer computing, and self-organizing networks to improve system security, reliability, and fairness.

[0008] There are three main topologies of UWSNs: centralized, distributed, and clustered. The existing trust model for clustered network topologies has the following problems:

[0009] (1) Traditional trust models use precise values ​​to represent trust but ignore the fuzziness and uncertainty of trust, which affects the effectiveness of trust evaluation.

[0010] (2) The method of identifying malicious nodes in the traditional trust model relies on artificially set thresholds and standard trust clouds. Excessive subjectivity will limit the model's detection rate of malicious nodes.

[0011] (3) Due to the lack of measured data and simulation datasets in relevant scenarios, it is difficult to apply machine learning methods in trust models.

[0012] Furthermore, in a clustered network topology, underwater nodes are dynamically clustered. Each cluster contains a cluster head node and multiple member nodes. The member nodes send data packets to the cluster head node, which then processes the data and forwards it to the surface aggregation node. Given the limited energy consumption of UWSN nodes, cluster-based routing protocols can balance node energy consumption and extend network life by designing cluster head selection methods. These protocols are common in clustered UWSNs.

[0013] However, existing cluster-based routing protocols primarily consider factors such as the distance from the surface sink, remaining energy, and node density in the cluster head selection process, while neglecting security issues. When malicious nodes in the network act as cluster members, they launch selfish attacks that reduce their own energy consumption, disrupting the energy balance between nodes and leading to unfair cluster head elections. Tampering attacks can also alter sensor data, compromising data authenticity. Sybil attacks can also forge identities, increasing the likelihood of malicious nodes becoming cluster heads. Furthermore, the clustered network topology of UWSNs means that once a cluster head is compromised, the communication security of the entire network cannot be guaranteed. Once a malicious node becomes a cluster head, its malicious attacks pose a greater threat to the network.

[0014] In summary, there is an urgent need for a trust assessment method (or trust model) that can describe trust ambiguity and uncertainty and avoid the limitations of artificially set parameters on model trust assessment, as well as a security mechanism to ensure the security of the cluster head election process in cluster-based routing protocols. Summary of the Invention

[0015] The present invention proposes a centralized trust evaluation method based on cloud theory, which solves the problems of existing trust models for clustered network topology structures, which ignore the fuzziness and uncertainty characteristics of trust and rely on artificially set thresholds and standard trust clouds.

[0016] The centralized trust evaluation method based on cloud theory described in the present invention is applied to an underwater wireless sensor network with a clustered network topology, and comprises the following steps:

[0017] Trust evidence collection step: Cluster member nodes collect packet trust evidence, data trust evidence, and energy trust evidence, and send these three types of trust evidence to the cluster head node;

[0018] Trust calculation steps: The cluster head node calculates the packet trust value, data trust value, and energy trust value of the cluster member nodes based on the three types of trust evidence collected by the cluster member nodes, and sends these three types of trust values ​​to the sink node;

[0019] Trust update step: The aggregation node uses the reverse cloud algorithm to calculate and update the packet cloud model, data cloud model, and energy cloud model of all network nodes based on the trust value of all network nodes;

[0020] Malicious node steps: The aggregation node combines the three types of cloud models of the evaluated node into a 1*9 tensor as the output sample and inputs it into the VAE model. The output of the VAE model is obtained as the output sample; the mean square error between the input sample and the output sample is calculated as the reconstruction error; the reconstruction error is input into the SVM model for node binary classification to realize malicious node identification.

[0021] Furthermore, a preferred embodiment is provided in which the cluster head node calculates the packet sending trust value of the member nodes in the cluster based on the packet sending trust evidence collected by the member nodes in the cluster:

[0022]

[0023] Among them, T packet is the trust value of the contract; PN is the trust evidence of the contract; PN average The average number of packets sent by the member nodes in the cluster within a given time period, which is counted by the cluster head node.

[0024] Furthermore, a preferred embodiment is provided in which the cluster head node calculates the data trust value of the member nodes in the cluster based on the data trust evidence collected by the member nodes in the cluster:

[0025] The data trust evidence of each member node in the cluster is converted into a cloud vector using the reverse cloud algorithm; the cloud vector includes three parameters: expectation ex, entropy en, and super entropy he;

[0026] Get the estimated values ​​of the three parameters. The estimated values ​​of the three parameters are:

[0027]

[0028] Among them, the mean and variance S 2 Expressed as:

[0029]

[0030] Among them, x q Represents the data trust evidence of member node q in the cluster, q=1,2,...,M-1;

[0031] The cluster head node uses the cloud similarity algorithm to quantify the similarity between the cloud vectors of each cluster member node and any other cluster member node;

[0032] The cosine value of the angle between two cloud vectors is used to represent the similarity between cloud vectors. The similarity between two cloud vectors is:

[0033]

[0034] in, and Represents two cloud vectors C i and C j A vector composed of digital features, i and j represent the cloud vector C i and C j Use the reverse cloud algorithm to convert the corresponding cluster member nodes before; where C i =(ex i ,en i ,he i ), C j =(ex j ,en j ,he j );

[0035] The relative trust RT of the data of cluster member node i and cluster member node j in this period ij Expressed as:

[0036]

[0037] The cluster head node calculates the data trust value of each member node in the cluster:

[0038] The data trust value T for the member node i in the cluster data is the average value of the relative trust of all other cluster member nodes to cluster member node i except cluster member node i:

[0039]

[0040] Where M is the total number of member nodes in the cluster; k is any other member node in the cluster except the member node i in the cluster, k = 1, 2, ... M, k ≠ i; T data ∈[0,1].

[0041] Furthermore, a preferred embodiment is provided in which the cluster head node calculates the energy trust value of the member nodes in the cluster based on the energy trust evidence collected by the member nodes in the cluster:

[0042] Correction of energy trust evidence:

[0043]

[0044] Among them, E original is the energy consumption of the member nodes in the cluster within a given time period, which serves as energy trust evidence; consume is the corrected energy consumption, which serves as the corrected energy trust evidence; d is the straight-line distance between the cluster member node and the cluster head node; f is the center frequency used for acoustic communication; A(d,f) is the attenuation function;

[0045] Based on the corrected energy consumption E consume , use the normal distribution probability density function to calculate the energy trust value T energy :

[0046]

[0047] Among them, f(x) is the corrected energy consumption E consume The probability density function of the normal distribution; x is a random variable that obeys the normal distribution; E average is the mean of the normal distribution, which is the mean of the corrected energy consumption of all member nodes in the cluster calculated by the cluster head node; σ is the standard deviation of the normal distribution; e evaluated =E consume .

[0048] Furthermore, a preferred embodiment is provided, wherein the VAE model is obtained by training an initial VAE model using a VAE dataset;

[0049] The VAE dataset is cloud model data generated by nodes when attack node samples exist and is collected using network simulation technology.

[0050] The present invention also proposes a centralized trust evaluation device based on cloud theory, which is applied to an underwater wireless sensor network with a clustered network topology. The device includes the following modules:

[0051] Trust evidence collection module: Cluster member nodes collect packet trust evidence, data trust evidence, and energy trust evidence, and send these three types of trust evidence to the cluster head node;

[0052] Trust calculation module: The cluster head node calculates the packet trust value, data trust value, and energy trust value of the cluster member nodes based on the three types of trust evidence collected by the cluster member nodes, and sends these three types of trust values ​​to the sink node;

[0053] Trust update module: The aggregation node uses the reverse cloud algorithm to calculate and update the packet cloud model, data cloud model, and energy cloud model of all network nodes based on the trust value of all network nodes;

[0054] Malicious node module: The aggregation node combines the three types of cloud models of the evaluated node into a 1*9 tensor as the output sample and inputs it into the VAE model. The output of the VAE model is obtained as the output sample; the mean square error between the input sample and the output sample is calculated as the reconstruction error; the reconstruction error is input into the SVM model for node binary classification to realize malicious node identification.

[0055] The present invention also proposes a computer device, comprising: a processor and a memory, wherein the memory is used to store executable instructions of the processor, and the processor is configured to execute any one of the above-mentioned centralized trust assessment methods based on cloud theory by executing the executable instructions.

[0056] The present invention also proposes a computer storage medium, in which a computer program is stored. When the computer program is run, any one of the above-mentioned centralized trust evaluation methods based on cloud theory is executed.

[0057] The present invention also proposes a computer program product, comprising a computer program / instruction, which, when executed by a processor, implements the steps of any one of the above-mentioned centralized trust assessment methods based on cloud theory.

[0058] The present invention also proposes a cluster head election method for improving the LEACH algorithm, the method comprising the following steps:

[0059] Each node uses any of the above-mentioned centralized trust evaluation methods based on cloud theory to obtain its own updated mean square error (mse);

[0060] Each node uses the improved cluster head election threshold function T based on the number of times it has served as a cluster head node, the a priori determined cluster head node ratio and mse. imp (n) Calculate the cluster head election threshold;

[0061] Each node generates a random number by itself; the random number is generated by a random variable in [0,1]; the random number obeys a uniform distribution;

[0062] Each node compares the random number it generates with the cluster head election threshold:

[0063] If it is less than the cluster head election threshold, the node becomes the cluster head node of the current large cycle;

[0064] Otherwise, the node does not become the cluster head node;

[0065] Improved cluster head election threshold function T imp (n) as follows:

[0066]

[0067] F(mse)=1.02^(24^(10*mse));

[0068] Where mse∈[0,+∞); P is the a priori determined proportion of cluster head nodes in the network; r is the current round; G is the set of nodes that have not become cluster head nodes in the last 1 / P rounds.

[0069] The present invention has the following beneficial effects:

[0070] 1. The centralized trust assessment method based on cloud theory described in this invention designs a multi-dimensional trust evidence and trust value algorithm by considering the characteristics of selfish attacks, tampering attacks, and Sybil attacks; and qualitatively evaluates node credibility by taking advantage of the cloud model to describe trust ambiguity and uncertainty.

[0071] 2. The centralized trust assessment method based on cloud theory described in the present invention collects data and trains machine learning method models based on network simulation technology (NS-3 software), avoiding the limitations of artificially set parameters on model trust assessment.

[0072] 3. The centralized trust assessment method based on cloud theory described in the present invention ultimately maintains an identification rate of malicious nodes above 99.3% and a false detection rate below 0.24%, and can effectively and accurately identify malicious nodes.

[0073] 4. The cluster head election method of the improved LEACH algorithm described in the present invention and the routing soft security mechanism based on the trust model effectively reduce the proportion of malicious nodes in the cluster head nodes in the improved LEACH protocol. The proportion is finally basically stabilized at below 1.4%, thereby improving the security of the cluster head election process.

[0074] The centralized trust evaluation method, device and storage medium based on cloud theory described in the present invention are suitable for trust evaluation of nodes in a clustered network topology. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0076] Figure 1 This is a flow chart of a centralized trust evaluation method based on cloud theory in one embodiment of the present invention;

[0077] Figure 2 Flowchart of a cluster head election method for improving the LEACH algorithm in one embodiment of the present invention;

[0078] Figure 3 A structural diagram of a VAE model in one embodiment of the present invention;

[0079] Figure 4 In one embodiment of the present invention, various attack node cloud model vector diagrams are shown; wherein, Figure 4 (a) is the vector diagram of the selfish attack node cloud model; Figure 4 (b) is the vector diagram of the tampering attack node cloud model; Figure 4 (c) is the vector diagram of the Sybil attack node cloud model;

[0080] Figure 5 This is a graph showing the grid optimization results of SVM model parameters in one embodiment of the present invention;

[0081] Figure 6 FIG4 is a graph of the F(mse) function in one embodiment of the present invention. It can be seen that when mse∈[0,0.15], F(mse) increases with the increase of mse, and the increase gradually increases. In fact, when mse∈[0,+∞), F(mse) increases monotonically, and F(mse)∈[1,+∞);

[0082] Figure 7 A graph showing how the detection rate and false positive rate of a trust assessment method change with simulation time in one embodiment of the present invention;

[0083] Figure 8 This is a graph showing how the mean square error (MSE) of the node cloud model changes with simulation time in one embodiment of the present invention;

[0084] Figure 9 A graph showing the change in the proportion of malicious nodes in the cluster head nodes over simulation time in one embodiment of the present invention;

[0085] Figure 10 A diagram showing a UWSNs network topology in one embodiment of the present invention;

[0086] Figure 11 In one embodiment of the present invention, the underwater routing protocol classification diagram

[0087] Figure 12 FIG. 1 is a general framework diagram of a centralized reputation system in one embodiment of the present invention; wherein: Figure 12 (a) shows the interactions that have taken place between entities. After each interaction, both parties provide evaluations of each other's performance, which are uploaded to the reputation center. The reputation center collects all the evaluations and continuously updates the reputation score of each entity based on the received evaluations. Figure 12 (b) shows that agents A and B are currently considering an upcoming interaction with each other. The updated reputation score will be made available to all agents and can be used by the agents to decide whether to interact with a specific agent. DETAILED DESCRIPTION

[0088] In order to make the technical solutions and advantages of the present invention more clearly described, the specific embodiments of the present invention will be further described in detail and completely in conjunction with the accompanying drawings. The various embodiments described below are only part of the preferred embodiments of the present invention, rather than all implementation plans; the various embodiments described below are intended to explain the present invention and cannot be understood as limiting the present invention; the reasonable combination of the technical features defined in the various embodiments of the present invention, as well as all other implementation plans obtained by ordinary technicians in this field based on the embodiments of the present invention without making creative work, all fall within the scope of protection of the present invention.

[0089] In order to better implement the parameters, some design concepts are explained as follows:

[0090] About the topology of UWSNs:

[0091] It should be noted that there are three main topologies for communication between UWSNs nodes: centralized, distributed, and clustered. Among them, the coverage of the centralized network topology is generally small, so from the perspective of expanding the network's monitorable range, the distributed network topology and clustered network topology are commonly used.

[0092] In the UWSNs network with a clustered network topology, the identities of underwater nodes are divided into cluster member (CM) nodes and cluster head (CH) nodes. Data is aggregated from cluster member nodes to cluster head nodes, and then sent by cluster head nodes to surface aggregation nodes (also called sink nodes).

[0093] Clustered networks have good scalability and are not limited in network size. They are suitable for UWSNs with large deployment ranges, sparse nodes, and high scalability requirements.

[0094] However, compared to cluster member nodes, cluster head nodes, which perform energy-intensive tasks like data processing and forwarding, typically consume energy more quickly. Furthermore, due to the special role of cluster head nodes, malicious nodes may unfairly compete to become cluster head nodes and carry out more effective attacks, exposing this type of network to a severe single point of failure risk.

[0095] In this embodiment, the trust evaluation method (or trust model) is applied to a clustered network topology.

[0096] In the clustered network topology:

[0097] The underwater nodes are homogeneous and evenly distributed in the water cube, with a sink node located at the center of the water surface;

[0098] All nodes are immobile and each has a unique node ID in the entire network to identify itself;

[0099] The number of data packets generated per second by underwater nodes follows a Poisson distribution as a random variable;

[0100] The member nodes in the cluster act as source nodes and send packets to the cluster head node;

[0101] The cluster head node collects the data packets in the cluster, performs information processing, and sends the data packets to the sink node on the water surface;

[0102] The data packet is considered delivered successfully after it reaches the aggregation node.

[0103] About UWSNs routing protocols:

[0104] It should be noted that routing protocol design is a key research topic in UWSNs. The role of a routing protocol is to find a path from a source node to a destination node and correctly forward data packets along that path. The main goals of routing protocol design in UWSNs are to establish efficient energy paths, maximize network lifespan, improve routing fault tolerance, and establish a reliable data forwarding mechanism.

[0105] According to the characteristics of underwater routing protocols, the protocols can be divided into three categories: energy-based routing protocols, data-based routing protocols, and geographic information-based routing protocols.

[0106] UWSN nodes are battery-powered, and batteries are difficult to recharge. Therefore, node energy is limited. Energy-based routing protocols can improve network energy efficiency, which is crucial for extending network lifespan. Energy-based routing protocols select the most appropriate path from the source node to the destination node to forward data packets based on the remaining energy of the sensor nodes. Energy-based routing protocols can be further divided into energy-aware routing protocols and cluster-based routing protocols. Cluster-based routing protocols divide the entire network into dynamic clusters, each containing a cluster head node and multiple cluster member nodes. Cluster member nodes transmit data to the cluster head node, which performs data processing and transmits the processed data to the surface sink node. Because cluster head nodes consume a lot of energy, cluster-based underwater routing protocols balance energy consumption among nodes in the network by designing a cluster head selection method to extend network lifespan.

[0107] It's important to note that cluster routing protocols in traditional wireless sensor networks divide the network into clusters, which can balance energy consumption and extend the network's lifecycle. However, in traditional clustering algorithms, cluster heads are preselected and remain fixed throughout the system's operation. This can cause the selected cluster head nodes to quickly become incapable of functioning due to energy depletion, resulting in the inability of all nodes in those clusters to function properly. To address this issue, researchers in this field proposed the LEACH protocol.

[0108] LEACH is a self-organizing, adaptive clustering protocol that uses randomization to evenly distribute the energy load of sensors in a network. In LEACH, sensor nodes organize themselves into local clusters, with one node acting as the cluster head and the other nodes becoming cluster members. The position of the cluster head rotates randomly among the sensor nodes to avoid rapidly depleting the energy of individual sensor nodes.

[0109] The LEACH protocol is divided into four phases: Advertisement Phase, Cluster Set-Up Phase, Schedule Creation Phase, and Data Transmission Phase. The protocol contents of each phase are as follows:

[0110] In the advertising phase, each node decides whether to become the cluster head of the current round based on the number of times it has served as a cluster head and the a priori determined ratio of cluster head nodes.

[0111]

[0112] Where P is the a priori determined proportion of cluster head nodes in the network, r is the current round, and G is the set of nodes that have not yet become cluster heads in the last 1 / P rounds. A simple calculation shows that the cluster head election probability formula T(n) is designed to maintain the ratio of the number of cluster head nodes elected in each round to the total number of nodes in the network, and to prevent nodes that have recently become cluster heads from being re-elected as cluster heads in the short term.

[0113] Each node that elects itself as the cluster head will consume the same transmission energy to broadcast advertising information to other non-cluster head nodes. The non-cluster head nodes remain in the listening state and decide the cluster head to which they belong in this round based on the received signal strength. In order to enter the cluster, the non-cluster head node will select the cluster head corresponding to the packet with the largest signal strength it hears and join the cluster.

[0114] In the clustering phase, after each non-cluster head node decides which cluster it belongs to, it must notify the cluster head node that it will become a member node of the cluster.

[0115] In the scheduling phase, the cluster head node creates a TDMA schedule based on the cluster entry information of non-cluster head nodes and the number of nodes in the cluster, and arranges the data transmission time for each member node in the cluster.

[0116] In the data transmission phase, the nodes in the cluster send data to the cluster head node using as little energy as possible according to needs and arrangements. After collecting the data sent by the nodes in the cluster, the cluster head node first organizes and fuses the data packets, and then sends the fused data packets to the sink node.

[0117] The existing LEACH algorithm does not consider the security issues when malicious nodes exist in the network, and how to properly elect the cluster head (i.e., cluster head) is an important issue that needs to be solved when studying such cluster routing protocols.

[0118] In this implementation, the cluster-based routing protocol LEACH is selected for use in the network scenario.

[0119] The simulation uses a common propagation model, with node distance as a variable. Adaptive control of signal transmission power is implemented while maintaining the signal-to-noise ratio at the receiving node. Parameters used in calculating signal transmission power include inter-node distance, signal frequency, receiver noise bandwidth, and noise intensity. This allows the calculation of the minimum available power while ensuring the signal-to-noise ratio at the receiver is above a certain threshold.

[0120] For two nodes that are far apart, due to the severe attenuation of underwater acoustic signals, the source node will use a larger transmission power to ensure that the acoustic signal received by the destination node has a higher signal-to-noise ratio. Conversely, for two nodes that are close to each other, the source node will choose to use a smaller transmission power.

[0121] Regarding the security issues of UWSNs, namely common malicious attacks:

[0122] It should be noted that security is a key issue in the field of UWSNs. UWSNs have many security requirements, including data confidentiality, data integrity, data freshness, and network availability. Malicious attacks launched by nodes within the network can undermine these security requirements.

[0123] Common malicious attacks can be divided into two categories: active attacks and passive attacks, based on the interaction between malicious nodes and attacked nodes. Passive attacks refer to the attempt by the affected device to detect activities and collect data transmitted on the network without interfering with network functions. Active attacks aim to inject, change, destroy, or delete data carried on the network. They may capture network data and attempt to change or destroy data packets to interfere with network communications and operations. Both internal and external attackers can launch active attacks. If the attack is carried out through a node that is not part of the network, it is an external attack. If the attack comes from a node within the network, it is classified as an internal attack.

[0124] While passive attacks pose significant risks to networks, they are difficult to identify based on trust models because they don't affect network functionality. Therefore, this implementation does not consider passive attacks. Furthermore, based on previous research, internal attacks are more difficult to track than external attacks and can pose a greater risk. Therefore, the malicious attacks considered in this implementation are all internal attacks.

[0125] It should be noted that in a clustered network topology, three common malicious attacks are tampering attacks, Sybil attacks, and selfish attacks. Their principles and impacts are as follows:

[0126] Tampering attack: A node launching a tampering attack maliciously tampers with the data in its own sensors or in the data packets to be forwarded, and then re-injects it into the network, aiming to destroy the integrity and correctness (authenticity) of the data.

[0127] Sybil Attack: A Sybil attack is a type of network-layer malicious attack in which a Sybil node pretends to be in multiple locations at the same time and has multiple identities (i.e., forged identities), thereby misleading routing protocols, increasing the likelihood of it becoming a hotspot node and further launching other attacks.

[0128] Selfish attack: A selfish attacking node will reduce the frequency of sending data packets in order to extend its own lifespan. In cluster-based routing protocols, this will destroy the energy balance between nodes and may lead to unfair cluster head elections.

[0129] In view of the damage caused by tampering attacks, Sybil attacks, and selfish attacks to the network and routing protocols, this embodiment studies the design of a trust model (trust assessment method) to target these malicious attacks; based on the trust model, a routing soft security mechanism can be designed.

[0130] Regarding trust models (or trust assessment methods), trust systems, and reputation systems:

[0131] It's important to note that a trust model is an abstract model that describes trust relationships between individuals, based on trust indicators or metrics. A trust system, on the other hand, is a software tool or system that implements and supports the trust model, primarily aiming to create a trusted environment. A trust system is a crucial component of soft security mechanisms, and the trust model is its core.

[0132] It's important to note that traditional mechanisms such as authentication and access control based on cryptographic techniques are considered hard security mechanisms, while trust and reputation systems are considered soft security mechanisms. On the one hand, encryption and authentication mechanisms provide identity trust, a measure of identity accuracy. However, hard security mechanisms lack robustness and cannot protect the network from internal attacks after a password leak. On the other hand, users are also interested in the reliability of the authenticator or the quality of the goods and services they provide. This type of trust is called provision trust, and only trust and reputation systems (i.e., soft security mechanisms) are useful tools for achieving provision trust. Therefore, when it comes to combating internal network attacks, trust models offer advantages that cannot be replaced by traditional cryptographic techniques.

[0133] It should be noted that the trust system and the reputation system are different but closely related.

[0134] In the context of UWSNs, the key differences between trust systems and reputation systems are described as follows: Node A's trust system generates a score reflecting its subjective perception of Node B's trustworthiness, while Node B's reputation system generates a reputation score visible to all nodes in the network. Second, trust systems explicitly consider trust paths and network transitivity, which typically manifests in UWSNs as recommended trust, while reputation systems typically do not consider transitivity or only consider it implicitly. Finally, the input to trust systems is subjective expressions of trust in other nodes, while the input to reputation systems is evaluations of objective events. Trust systems may contain elements of reputation systems, and vice versa, making it not always clear how to categorize a given system. Due to the mutual inclusion and unclear categorization between trust and reputation systems, it is feasible to study and distinguish between centralized and distributed trust systems in UWSNs based on previous classifications of reputation system architectures.

[0135] The network architecture determines how ratings and reputation scores are transmitted between entities in the reputation system. There are two main architectures for reputation models: centralized reputation systems and distributed reputation systems.

[0136] In a centralized reputation system, when determining the reputation of a particular entity, information about that entity's performance is gathered from reviews by other entities in the system who have direct experience with that entity. These reviews are then centralized at a reputation center, which uses this information to assign a reputation score to each entity in the system and makes all scores public. Entities in the system can use these scores to make judgments and decisions before interacting with other entities.

[0137] The two fundamental aspects of a centralized reputation system are:

[0138] a. A centralized communication protocol that allows entities to submit their evaluations of other entities to the reputation center and obtain the reputation scores of other entities from the reputation center.

[0139] b. The reputation center is responsible for reputation calculation and calculates a reputation score for each entity in the system based on the received evaluation information.

[0140] Distributed reputation systems: In some environments, distributed reputation systems are more appropriate than centralized systems. In a distributed system, there is no reputation center designed to collect information and centralize calculations. Instead, the storage and calculation of entities are all distributed locally, and relevant evaluations and information can be recommended to other entities for their evaluation of specific entities.

[0141] The two fundamental aspects of a distributed reputation system are:

[0142] a. Distributed communication protocols that allow agents to obtain evaluations from other agents in the system.

[0143] b. Each subject calculates the reputation score of the target subject based on the received evaluations and possible other information.

[0144] In this embodiment, the trust evaluation method (or trust model) is similar to a centralized reputation system, and thus can be referred to as a centralized trust evaluation method (or centralized trust model).

[0145] The centralized trust model is suitable for clustered networks. In the centralized trust model, cluster member nodes, cluster head nodes, and surface aggregation nodes divide and conquer related tasks. Trust-related information is sent to the surface aggregation node for processing, and the trust evaluation results are visible to the entire network. Because surface aggregation nodes typically have stronger computing power and larger storage space, and their batteries are easily replaced or recharged, most of the trust calculation work and storage requirements in the model are implemented at the surface aggregation node, which reduces the computing and storage resources occupied by underwater nodes due to the trust evaluation work. Because relatively complete trust information across the entire network can be continuously obtained, the centralized trust model provides more accurate assessments of node trustworthiness. In addition, cluster-based routing protocols can also alleviate the situation where nodes consume excessive energy resources when transmitting trust-related information.

[0146] It should be noted that there has been extensive research on trust models for road-based wireless sensor networks (TWSNs). However, the environmental characteristics of TWSNs and UWSNs differ, making existing TWSN trust models difficult to directly apply to UWSNs. Nodes in TWSNs are densely deployed on a two-dimensional plane, whereas nodes in UWSNs are located in a three-dimensional underwater environment with considerable depth. Unlike land-based sensor nodes, which communicate using radio frequency signals, underwater nodes typically communicate using acoustic signals. The transmission rate of underwater acoustic signals is five orders of magnitude lower than that of radio signals, resulting in significant temporal and spatial uncertainty in underwater acoustic communications. The complex underwater noise environment increases bit error rates and packet loss rates. Wind, waves, and ocean currents can cause drastic changes in node positions, increasing the probability of packet loss due to collisions, making underwater links extremely vulnerable. Furthermore, the severe Doppler and multipath effects in underwater acoustic channels lead to high transmission losses.

[0147] About cloud model and reverse cloud algorithm:

[0148] It should be noted that the cloud model is a model used to describe concepts in nature. Its three parameters reflect the uncertainty in natural language and enable conversion between qualitative and quantitative concepts. The three parameters of cloud theory are expectation (ex), entropy (en), and hyperentropy (he). ex is the expectation of an attribute, reflecting the central trust value. en is the entropy of the attribute, reflecting the trust ambiguity of ex. He is the hyperentropy of the attribute, reflecting the uncertainty of en. The forward cloud algorithm can transform the overall characteristics of a qualitative concept into a quantitative numerical representation, achieving the conversion from conceptual space to numerical space. The reverse cloud algorithm can achieve the conversion from quantitative values ​​to qualitative concepts, converting a set of quantitative data into qualitative concepts represented by numerical features.

[0149] For any trust attribute x, x∈X, where X is the trust evaluation domain, denoted as the exact value, if There always exists a mapping μ that satisfies

[0150] μ:X→[0,1],x→μ(x)∈[0,1];

[0151] Then, the distribution of x in domain X is called the trust cloud. μ(x) is called the membership function, and its formula is as follows.

[0152]

[0153] The node selects the N most recent data collected by its own sensors as cloud droplets and uses the reverse cloud algorithm to locally calculate the cloud model related to its own sensor data;

[0154] When building a cloud model, it is necessary to calculate the estimated values ​​of the three digital eigenvalues ​​(i.e., the three parameters of cloud theory) ex, en, and he that characterize the cloud based on the inverse cloud algorithm to achieve a qualitative analysis of the node's credibility.

[0155] Assume that the qth data among the N data collected by the node’s own sensor is x q ,The steps of the reverse cloud algorithm are as follows:

[0156] Step 1: Calculate x q The mean and variance S 2 :

[0157]

[0158] Step 2: Calculate an estimate of ex

[0159]

[0160] Step 3: Calculate an estimate of en

[0161]

[0162] Step 4: Calculate an estimate of he

[0163]

[0164] In one embodiment, a centralized trust evaluation method based on cloud theory is provided. The method is applied to an underwater wireless sensor network with a clustered network topology. The method includes the following steps:

[0165] Trust evidence collection step: Cluster member nodes collect packet trust evidence, data trust evidence, and energy trust evidence, and send these three types of trust evidence to the cluster head node;

[0166] Trust calculation steps: The cluster head node calculates the packet trust value, data trust value, and energy trust value of the cluster member nodes based on the three types of trust evidence collected by the cluster member nodes, and sends these three types of trust values ​​to the sink node;

[0167] Trust update step: The aggregation node uses the reverse cloud algorithm to calculate and update the packet cloud model, data cloud model, and energy cloud model of all network nodes based on the trust value of all network nodes;

[0168] Malicious node steps: The aggregation node combines the three types of cloud models of the evaluated node into a 1*9 tensor as the output sample and inputs it into the VAE model. The output of the VAE model is obtained as the output sample; the mean square error between the input sample and the output sample is calculated as the reconstruction error; the reconstruction error is input into the SVM model for node binary classification to realize malicious node identification.

[0169] In this embodiment, the trust assessment method (or trust model) is repeatedly executed periodically. To implement a centralized trust assessment method for network nodes, cluster member nodes, cluster head nodes, and surface aggregation nodes (also known as surface aggregation nodes because they are located on the water surface) are divided into groups to perform tasks in the trust assessment method.

[0170] Specifically:

[0171] In response to the attack characteristics of selfish attacks, tampering attacks and Sybil attacks, the member nodes in the cluster collect their own trust evidence related to the number of node packets, sensor data and energy consumption (i.e., packet trust evidence, data trust evidence and energy trust evidence) to reflect the abnormality of their own packet frequency, sensor data and energy consumption, and report the above information to the cluster head node.

[0172] Based on the three types of trust evidence of the member nodes in the cluster, the cluster head node calculates the packet trust value, data trust value, and energy trust value of the member nodes in the cluster, and reports these three types of trust value information to the surface aggregation node.

[0173] After the aggregation node obtains the trust value of all nodes in the entire network, it uses the reverse cloud algorithm to calculate and update the packet cloud model, data cloud model, and energy cloud model of all nodes in the entire network.

[0174] Then, the aggregation node combines the three types of cloud models of the evaluated nodes into a 1*9 (i.e. 1 times 9) tensor as the input sample and inputs it into the VAE model (Variational Autoencoder). The mean squared error (MSE) between the input sample and the output sample is calculated as the reconstruction error, and the reconstruction error is input into the SVM model for node binary classification to realize malicious node identification.

[0175] Finally, the aggregation node notifies all nodes in the network of the malicious node identification results and other related information in the form of broadcast.

[0176] Malicious node identification results and other related information can be used to guide routing decisions, achieving logical isolation of malicious nodes and further physical isolation of the network.

[0177] In addition, in one embodiment, the cluster head node calculates the packet sending trust value of the member nodes in the cluster based on the packet sending trust evidence collected by the member nodes in the cluster:

[0178]

[0179] Among them, T packet is the trust value of the contract; PN is the trust evidence of the contract; PN average The average number of packets sent by the member nodes in the cluster within a given time period, which is counted by the cluster head node.

[0180] It should be noted that compared to radio frequency communication in land-based wireless sensor networks, underwater acoustic communication in UWSNs consumes more energy. Therefore, most of the node's energy is used for communication, especially for sending data packets. To protect their own energy consumption, malicious nodes may use a covert attack strategy called selfish attacks. Nodes launching selfish attacks will refuse to comply with the protocol arrangements and refuse to generate and send data packets to avoid the energy consumption of data packet transmission, which will damage data integrity.

[0181] In this implementation, based on the characteristics of a node launching a selfish attack, the number of packets generated and sent by the node over a period of time, PN, is selected as the packet sending trust evidence. Cluster member nodes record the number of packets they generate and send to the cluster head node over a period of time as the packet sending trust evidence and send this packet sending trust evidence along with the packets to the cluster head node.

[0182] In this embodiment, the packet sending trust values ​​of the member nodes and the cluster head node in the cluster will be sent by the cluster head node along with the packet to the surface aggregation node.

[0183] In this embodiment, the packet sending trust value is used to quantify the normality of the number of data packets generated and sent by the node.

[0184] In addition, in one embodiment, the cluster head node calculates the data trust value of the member nodes in the cluster based on the data trust evidence collected by the member nodes in the cluster:

[0185] The data trust evidence of each member node in the cluster is converted into a cloud vector using the reverse cloud algorithm; the cloud vector includes three parameters: expectation ex, entropy en, and super entropy he;

[0186] Get the estimated values ​​of the three parameters. The estimated values ​​of the three parameters are:

[0187]

[0188] Among them, the mean and variance S 2 Expressed as:

[0189]

[0190] Among them, x q Represents the data trust evidence of member node q in the cluster, q=1,2,...,M-1;

[0191] The cluster head node uses the cloud similarity algorithm to quantify the similarity between the cloud vectors of each cluster member node and any other cluster member node;

[0192] The cosine value of the angle between two cloud vectors is used to represent the similarity between cloud vectors. The similarity between two cloud vectors is:

[0193]

[0194] in, and Represents two cloud vectors C i and C j A vector composed of digital features, i and j represent the cloud vector C i and C jUse the reverse cloud algorithm to convert the corresponding cluster member nodes before; where C i =(ex i ,en i ,he i ), C j =(ex j ,en j ,he j );

[0195] The relative trust RT of the data of cluster member node i and cluster member node j in this period ij Expressed as:

[0196]

[0197] The cluster head node calculates the data trust value of each member node in the cluster:

[0198] The data trust value T for the member node i in the cluster data is the average value of the relative trust of all other cluster member nodes to cluster member node i except cluster member node i:

[0199]

[0200] Where M is the total number of member nodes in the cluster; k is any other member node in the cluster except the member node i in the cluster, k = 1, 2, ... M, k ≠ i; T data ∈[0,1].

[0201] In this embodiment, in view of the characteristic that a node will tamper with the data collected by its own sensor when launching a tampering attack, data trust evidence related to the sensor data is collected to calculate the data trust value.

[0202] For simplicity, it is assumed that the sensing data is digital information. On this basis, the group trust algorithm based on the cloud model is used to calculate the data trust value T data ∈[0,1].

[0203] The node selects the latest N data collected by its own sensor as data trust evidence {u1,u2,...,u N};

[0204] The data trust evidence is taken as a cloud droplet, and the cloud vector of the data trust evidence related to its own sensor data is calculated locally using the reverse cloud algorithm. That is, the data trust evidence of each member node in the cluster is converted into a cloud vector using the reverse cloud algorithm.

[0205] The member nodes in the cluster send the calculated cloud vector along with the packet to the cluster head node.

[0206] The cluster head node uses the cloud similarity algorithm to quantify the similarity between the cloud vectors of each cluster member node and any other cluster member node. Then, based on the cloud similarity, the relative trust is used to describe the relative credibility of the data of the two nodes in the same period (i.e., relative trust). The data trust value of each cluster member node is then obtained based on the average value of the relative trust.

[0207] Finally, the data trust values ​​of the cluster member nodes and the cluster head node will be sent to the surface aggregation node along with the packet by the cluster head node.

[0208] In addition, in one embodiment, the cluster head node calculates the energy trust value of the member nodes in the cluster based on the energy trust evidence collected by the member nodes in the cluster:

[0209] Correction of energy trust evidence:

[0210]

[0211] Among them, E original is the energy consumption of the member nodes in the cluster within a given time period, which serves as energy trust evidence; consume is the corrected energy consumption, which serves as the corrected energy trust evidence; d is the straight-line distance between the cluster member node and the cluster head node; f is the center frequency used for acoustic communication (i.e., underwater acoustic communication); A(d,f) is the attenuation function;

[0212] Based on the corrected energy consumption E consume , use the normal distribution probability density function to calculate the energy trust value T energy :

[0213]

[0214] Among them, f(x) is the corrected energy consumption E consume The probability density function of the normal distribution; x is a random variable that obeys the normal distribution; E average is the mean of the normal distribution, which is the mean of the corrected energy consumption of all member nodes in the cluster calculated by the cluster head node; σ is the standard deviation of the normal distribution; e evaluated =E consume .

[0215] It should be noted that this embodiment studies issues related to underwater communication. In underwater communication, radio propagation distance is limited, so acoustic communication is used.

[0216] This implementation analyzes the multiple identities characteristic of Sybil attacks and finds that, to conceal their false identities among legitimate nodes, nodes launching Sybil attacks mimic normal node behavior, such as cooperating with clustering protocols and generating and sending data packets at similar frequencies. This inevitably results in excessive energy consumption. Therefore, even if all other node characteristics are normal, potential Sybil nodes can be identified by abnormal energy consumption.

[0217] In this embodiment, the energy consumption E of the member nodes in the cluster within a given time period is original As evidence of energy trust.

[0218] In this implementation, since the cluster head node undertakes high-energy-consuming tasks such as receiving data packets from cluster member nodes, information processing, and sending packets to the surface aggregation node, the calculation and evaluation of the energy trust value only includes the cluster member nodes, but not the cluster head node in this round.

[0219] In this implementation, when counting energy trust evidence, although the number of packets sent per second by member nodes in the cluster follows a Poisson distribution with the same parameters as a random variable, unlike land-based wireless sensor networks, underwater acoustic signals in UWSNs are severely attenuated, and the energy consumption of communication between nodes at different distances varies greatly, making it difficult to directly identify abnormal energy consumption.

[0220] To address this issue, we use distance as a parameter to modify the energy trust evidence. By reducing the impact of distance on the energy consumption of underwater node communication, we can obtain more accurate trust evaluation results:

[0221] By analyzing the underwater acoustic signal attenuation function formula, the energy trust evidence is modified as follows:

[0222]

[0223] Among them, E original is the energy consumption of the member nodes in the cluster within a given time period, i.e., the energy trust evidence; E consume is the corrected energy consumption, which serves as the corrected energy trust evidence; d (in meters) is the straight-line distance between the cluster member node and the cluster head node; f (in Hz) is the center frequency used for acoustic communication; A(d,f) is the attenuation function.

[0224] The member nodes in the cluster periodically record their own energy consumption and send the revised energy trust evidence along with the packet to the cluster head node.

[0225] In this embodiment, the cluster head node calculates an energy trust value based on the corrected energy trust evidence. The energy trust value is used to quantify the normality of the node's energy consumption within a given time period.

[0226] In this embodiment, the energy trust values ​​of the member nodes in the cluster will be sent to the surface aggregation node along with the packet by the cluster head node.

[0227] In this embodiment, the standard deviation σ of the normal distribution can be set according to specific scenarios.

[0228] In addition, in one embodiment, the aggregation node uses a reverse cloud algorithm to calculate and update the packet cloud model, data cloud model, and energy cloud model of the nodes in the entire network based on the trust value of the nodes in the entire network, including:

[0229] Assume that the trust value of any node is {T packet1 ,T packet2 ,......,T packetn}, where n is the number of trust value data of any node saved at the sink node; the trust value of any node is the cloud drop, and the reverse cloud algorithm is used to calculate the cloud model of the packet: (Ex packet ,En packet ,He packet );

[0230] Based on the data trust value, the data cloud model (Ex data ,En data ,He data );

[0231] Based on the energy trust value, the energy cloud model (Ex energy ,En energy ,He energy );

[0232] The three types of cloud models, namely the contracting cloud model, the data cloud model and the energy cloud model, are periodically calculated and updated as the three types of trust values, namely the contracting trust value, the data trust value and the energy trust value, accumulate.

[0233] In this embodiment, the cloud model refers to a cloud model related to node trust values, i.e., a trust cloud. After the surface aggregation node completes the collection of trust values ​​of all nodes in the network, it will organize and save these trust values ​​locally to calculate and update the trust cloud (cloud model) related to the trust values.

[0234] In this embodiment, Ex packet , is the expectation of the outsourcing cloud model; packet is the entropy of the outsourcing cloud model; He packet is the super entropy of the packet cloud model.

[0235] In this embodiment, Ex data , is the expectation of the data cloud model; data , is the entropy of the data cloud model; He data is the super entropy of the data cloud model.

[0236] In this embodiment, Ex energy is the expectation of the energy cloud model; En energy , is the entropy of the energy cloud model; He energy is the super entropy of the energy cloud model.

[0237] In this embodiment, the three types of trust clouds (cloud models) constructed can qualitatively represent the trustworthiness of the evaluated nodes in terms of packet sending, data, and energy.

[0238] In addition, in one embodiment, the VAE model is obtained by training an initial VAE model using a VAE dataset;

[0239] The VAE dataset is cloud model data generated by nodes when attack node samples exist and is collected using network simulation technology.

[0240] In this embodiment, the network simulation technology refers to simulation based on NS-3 software to collect cloud model data generated by nodes when attack node samples exist.

[0241] It should be noted that NS-3 is an open source project written in C++ and primarily runs on GNU / Linux platforms, such as CentOS, Ubuntu, and Fedora. While Windows users can run NS-3 using Cygwin or Visual Studio, some features may not be available, such as interaction with the physical network. The main functions and features of NS-3 include:

[0242] Network simulation: NS-3 is mainly used to simulate computer networks. It can simulate network structures of various types and sizes in the physical world on a single computer.

[0243] Discrete event driven: NS-3 uses discrete event simulation technology to abstract a continuous process in the physical world into a series of discrete events in the virtual world, and can simulate various network protocols in the physical world very realistically.

[0244] Script support: NS-3's simulation scripts can support two programming languages: C++ and Python. Users can call various application programming interfaces (APIs) for network simulation provided by NS-3 in simulation scripts to build their own virtual network structures.

[0245] NS-3 also has the following auxiliary functions:

[0246] Trace generation: allows users to directly analyze the data generated by NS-3 through third-party software (such as Wireshark, tcpdump).

[0247] Mobile module: can automatically assign starting positions and moving trajectories to nodes.

[0248] Interaction with the physical network: The virtual network built by NS-3 can be highly integrated with the physical network environment. Virtual nodes can use the physical network to send and receive data, and physical nodes can also use the virtual channels built by NS-3 to send and receive data packets.

[0249] NS-2 is undoubtedly a viable alternative to NS-3. NS-2 is also a mainstream software in the network simulation field, but it is the predecessor of NS-3, with some modules written in C++ and others in OTcl. While NS-2 has been discontinued compared to NS-3, it may still offer advantages in specific areas, such as simulation of probabilistic broadcast schemes in Reina D.G. networks and routing protocol simulation for swarm intelligence routing protocols in wireless sensor networks (FANETs).

[0250] In this embodiment, some simulation parameter settings based on NS-3 software are shown in the following table:

[0251] Parameter name Parameter settings Deployment scope 5000m*5000m*5000m Number of sending nodes 100 Packet size 400Bytes Overview of Malicious Nodes 15 Number of selfish attack nodes 5 Number of tampering attack nodes 5 Number of Sybil attack nodes 5 Mobile Model fixed Simulation time 3000s Attack start time 1000s Data collection time 2000s

[0252] In this embodiment, the simulation process based on NS-3 software is as follows:

[0253] The member nodes in the cluster collect and report their trust evidence to the cluster head node, and the cluster head node calculates the trust value and reports the trust value to the surface aggregation node;

[0254] In the presence of malicious nodes launching attacks, the random seed was changed and the simulation was run multiple times to collect 2100 pieces of three types of trust cloud data of normal nodes for modeling the normal node cloud model;

[0255] At the same time, 300 pieces of three types of trust cloud data of malicious nodes were collected to test the model training effect.

[0256] In this implementation, the VAE model (Variational Autoencoder) essentially extracts latent features from data and constructs a neural network model that generates targets from these latent features. Its design architecture consists of two structures: an encoder and a decoder. The encoder converts input data into a smaller, more compact encoded representation in the latent space, while the decoder converts this encoding back to the original input data.

[0257] In this implementation, because the VAE model can fit the prior distribution of latent variables in existing samples and then sample them to generate new samples, the VAE's excellent generation and reconstruction capabilities can be used to extract the characteristics of normal node cloud models and implement modeling of normal node cloud models. Then, taking advantage of the characteristic that the corresponding cloud model of malicious nodes will change after launching an attack, malicious nodes can be detected by identifying the large fluctuations in abnormal cloud models when passing through the VAE model.

[0258] In this implementation, the network structure of the VAE model is:

[0259] The VAE model includes an encoder and a decoder;

[0260] The encoder consists of:

[0261] Input layer: input size is 9;

[0262] Self-attention layer: input size is 9, output size is 9;

[0263] Fully connected layer 1: input size is 9, output size is 128;

[0264] Mean layer: input size is 128, output size is 2;

[0265] Variance layer: input size is 128, output size is 2;

[0266] Obtain latent variables based on the variance layer and mean layer;

[0267] The decoder consists of:

[0268] Fully connected layer 2: input size is 2, output size is 128; hidden variable input fully connected layer 2;

[0269] Output layer: input size is 128, output size is 9.

[0270] In order to enable the encoder to adaptively focus on the importance of different parts of the input when extracting features, thereby improving the encoder's expressiveness and feature extraction capabilities, an attention mechanism is introduced into the VAE model: a self-attention layer with an input size of 9 and an output size of 9 is added to the VAE model structure.

[0271] In this embodiment, if Figure 4 As mentioned above, test the training effect of the VAE model:

[0272] The 1*3 vector (Ex, En, He) consisting of the expectation, entropy and super entropy of the cloud model is named the eigenvector of the cloud model.

[0273] First, we show the changes of three types of cloud models of normal nodes and malicious nodes in the VAE dataset as vectors in three-dimensional space before and after passing through the VAE model.

[0274] Among them, the three-dimensional coordinates are the expectation, entropy and super entropy of the cloud model. In the three-dimensional graph, arrows of different colors are used to represent the eigenvectors corresponding to the cloud model. From left to right, the three graphs represent the situations when launching selective forwarding attacks, tampering attacks, and witch attack nodes respectively.

[0275] Among them, the light red arrow represents the feature vector of the cloud model after the malicious node launches an attack, the dark red represents the feature vector of the output cloud model after the malicious node launches an attack and the cloud model is input into the VAE model, the light green represents the feature vector of the cloud model of the normal node, and the dark green represents the feature vector of the output cloud model after the normal node cloud model is input into the VAE model.

[0276] like Figure 4 As shown, Figure 4 (a) Figure 4 (b) Figure 4 (c) Vector diagrams of the node cloud model for selfish attack, tampering attack, and Sybil attack, respectively.

[0277] In the figure, the light red arrows all deviate significantly from the light green arrows, indicating that the attacking node's behavior has caused its own cloud model to become abnormal, significantly different from the cloud model of a normal node. Furthermore, the dark red and dark green arrows differ, indicating that when the input data is abnormal, the error generated by the VAE model fluctuates compared to the normal error.

[0278] The following uses the mean square error (MSE) of the generated vector and the input vector as an indicator, and inputs the training set, test set, and malicious node data set from the normal node data set to test the training effect. The results are as follows:

[0279]

[0280]

[0281] It can be seen that the MSE obtained by inputting the malicious node dataset is about 15 times that of the normal node dataset, and the difference is obvious. This shows that the VAE model can effectively extract the data features of the normal node cloud model in the network, and reconstruct and generate it on this basis. In addition, when the malicious node cloud model data passes through the VAE model, the MSE result has obvious fluctuations.

[0282] In addition, in one embodiment, the SVM model is obtained by training an initial SVM model using an SVM dataset;

[0283] The SVM dataset was collected after the initial VAE model training was completed using network simulation technology (i.e., simulation based on NS-3 software). The simulation parameters were the same as above.

[0284] In this embodiment, the SVM data set includes three types of cloud vectors (i.e., cloud models) of normal nodes and malicious nodes, and the MSE is calculated by the VAE model at 2000s.

[0285] In this embodiment, the SVM data set is labeled, label 1 represents a normal node, and label -1 represents a malicious node.

[0286] In this embodiment, during the simulation based on NS-3 software, the random seed is changed and the simulation is run multiple times in the presence of malicious nodes launching attacks. A total of 3240 data items are collected, of which 2000 are used as training sets and 1240 are used as test sets. In the SVM data set, the number of malicious node data items accounts for 15% of the total number of items.

[0287] In this embodiment, the accuracy of the SVM model (i.e., support vector machine) for small sample and nonlinear classification is higher than that of other models built based on artificial intelligence technology.

[0288] Due to the sparse deployment of underwater network nodes, the trust evidence collected by the nodes is relatively small. Compared with other supervised learning algorithms, SVM can effectively solve learning problems with relatively small samples. Therefore, the SVM method is used to achieve node classification.

[0289] It should be noted that the SVM model requires a large amount of training resources. In traditional trust assessment methods, it is difficult to apply the SVM model due to the lack of data sets in relevant scenarios. This embodiment solves this technical problem by adopting network simulation technology (i.e., simulation based on NS-3 software).

[0290] In this embodiment, before the initial SVM model training, it is necessary to first determine the type and parameters of the SVM model.

[0291] Select C-SVM as the type of SVM model;

[0292] Since the number of sample features is small, the radial basis kernel function is used;

[0293] The grid traversal method is used to find the optimal parameters c and γ with the minimum error, and then the optimal parameters are selected to train the initial SVM model.

[0294] In this embodiment, in order to determine the optimal parameters, the parameters c and γ of C-SVC are first optimized based on the grid traversal principle; the grid optimization results of the parameters c and γ of C-SVM are as follows: Figure 5As shown in Figure 2, since the model achieved 100% classification accuracy in the training set when c = 8.0 and γ = 0.5, they were selected as the optimal parameters.

[0295] In this embodiment, the hyperparameters set when training the initial SVM model are shown in the following table:

[0296] Attribute Name Property Value SVM Type C-SVM Kernel function type RBF core Set the order of the kernel function 3 gamma parameter in the kernel function 0.5 coef0 parameter in the kernel function 0 Penalty coefficient C 8 cache memory size 40MB Tolerable Deviation in Termination Principle 0.001 Whether to use heuristics yes Weighted penalty coefficient C for each type of sample 1

[0297] The initial SVM model training is completed, and the parameters of the obtained SVM model are shown in the following table:

[0298]

[0299] In addition, in one embodiment, the aggregation node combines the three types of cloud models of the evaluated node into a 1*9 tensor as the output sample and inputs it into the VAE model. The output of the VAE model is obtained as the output sample; the mean square error between the input sample and the output sample is calculated as the reconstruction error, which is:

[0300] Let the input sample be X = (X1, X2, X3, L X9);

[0301] The reconstruction result output by the VAE model, that is, the output sample is

[0302] Then the reconstruction error MSE is:

[0303]

[0304] In addition, in one embodiment, the reconstruction error is input into the SVM model to perform node binary classification to achieve malicious node identification, which is:

[0305] The reconstruction error is input into the SVM model for node binary classification:

[0306] If the classification result is -1, it means that the reconstruction error of the cloud model of the evaluated node exceeds the given threshold, the cloud model is abnormal, and the evaluated node is identified as a malicious node;

[0307] On the contrary, if the classification result is 1, the evaluated node is identified as a normal node.

[0308] In this implementation, during the malicious node identification process, the VAE model generates certain errors when decoding and restoring the data after passing through the encoder. If the original input data contains anomalies, the resulting error will fluctuate significantly compared to the typical error. The errors generated by different nodes are classified based on the SVM model, distinguishing between normal and malicious nodes and completing the trust assessment of the evaluated node.

[0309] In one embodiment, a centralized trust evaluation device based on cloud theory is provided. The device is applied to an underwater wireless sensor network with a clustered network topology. The device includes the following modules:

[0310] Trust evidence collection module: Cluster member nodes collect packet trust evidence, data trust evidence, and energy trust evidence, and send these three types of trust evidence to the cluster head node;

[0311] Trust calculation module: The cluster head node calculates the packet trust value, data trust value, and energy trust value of the cluster member nodes based on the three types of trust evidence collected by the cluster member nodes, and sends these three types of trust values ​​to the sink node;

[0312] Trust update module: The aggregation node uses the reverse cloud algorithm to calculate and update the packet cloud model, data cloud model, and energy cloud model of all network nodes based on the trust value of all network nodes;

[0313] Malicious node module: The aggregation node combines the three types of cloud models of the evaluated node into a 1*9 tensor as the output sample and inputs it into the VAE model. The output of the VAE model is obtained as the output sample; the mean square error between the input sample and the output sample is calculated as the reconstruction error; the reconstruction error is input into the SVM model for node binary classification to realize malicious node identification.

[0314] In one embodiment, a cluster head election method for an improved LEACH algorithm is provided, the method comprising the following steps:

[0315] Each node uses any of the above-mentioned centralized trust evaluation methods based on cloud theory to obtain its own updated mean square error (mse);

[0316] Each node uses the improved cluster head election threshold function T based on the number of times it has served as a cluster head node, the a priori determined cluster head node ratio and mse. imp (n) Calculate the cluster head election threshold;

[0317] Each node generates a random number by itself; the random number is generated by a random variable in [0,1]; the random number obeys a uniform distribution;

[0318] Each node compares the random number it generates with the cluster head election threshold:

[0319] If it is less than the cluster head election threshold, the node becomes the cluster head node of the current large cycle;

[0320] Otherwise, the node does not become the cluster head node;

[0321] Improved cluster head election threshold function T imp (n) as follows:

[0322]

[0323] F(mse)=1.02^(24^(10*mse));

[0324] Where mse∈[0,+∞); P is the a priori determined proportion of cluster head nodes in the network; r is the current round; G is the set of nodes that have not become cluster head nodes in the last 1 / P rounds.

[0325] In this embodiment, each node adopts any one of the above-mentioned centralized trust evaluation methods based on cloud theory to obtain its own updated mean square error mse:

[0326] In any of the above-mentioned centralized trust evaluation methods based on cloud theory, each node is regarded as an evaluated node; the aggregation node combines the three types of cloud models of the evaluated node (i.e., each node) into a 1*9 tensor as an output sample and inputs it into the VAE model, and the output of the VAE model is obtained as the output sample; the mean square error between the input sample and the output sample is calculated as the updated mean square error mse of each node itself.

[0327] It should be noted that the traditional LEACH algorithm does not consider the security issues associated with the presence of malicious nodes in the network. Furthermore, how to appropriately elect cluster heads is a key issue that needs to be addressed when studying such clustered routing protocols. Therefore, this embodiment designs a routing soft security mechanism based on a trust model, resulting in a cluster head election method that improves the LEACH algorithm.

[0328] In this embodiment, the F(mse) function curve is as follows: Figure 6 As shown:

[0329] It can be seen that when mse∈[0,0.15], F(mse) increases with the increase of mse, and the increase gradually increases; in fact, when mse∈[0,+∞), F(mse) increases monotonically, and F(mse)∈[1,+∞). In the improved LEACH algorithm, the larger the mse, the larger the F(mse), and T imp (n) is smaller, and when T imp As (n) decreases, the probability of a node becoming a cluster head node also decreases. Therefore, improving the design of the cluster head election threshold function in the LEACH protocol can reduce the probability of nodes with higher mse being elected as cluster heads, while having less impact on the cluster head election process for nodes with lower mse.

[0330] In one embodiment, an improved LEACH routing protocol method is provided, the method comprising a clustering step and a data transmission step;

[0331] Clustering steps: Nodes periodically re-elect cluster head nodes to build clusters. This period is called the large period and is represented by T1. The cluster head nodes are elected using the cluster head election method of the improved LEACH algorithm mentioned above.

[0332] Data transmission steps: The cluster head node periodically integrates the data packets received from the cluster member nodes and forwards them to the sink node. This period is called the small period and is represented by T2.

[0333] In this embodiment, in the data transmission step, the number of packets sent per second by the cluster member nodes follows Poisson distribution as a random variable. Whenever data is generated, the cluster member nodes immediately try to send a data packet to the cluster head node.

[0334] In this embodiment, in the data transmission step, the member nodes in the cluster also send their own packet sending trust evidence, energy trust evidence, and energy trust evidence along with the data packet to the cluster head node.

[0335] In this embodiment, in the data transmission step, the cluster head node first stores and integrates the data packets received from the member nodes in the cluster; then, with T2 as a period, it periodically sends the integrated data packets to the surface aggregation node.

[0336] In this embodiment, in the data transmission step, the cluster head node calculates the trust value of the member nodes in the cluster based on the collected trust evidence with a period of T2, and sends the trust value calculation result along with the integrated data packet to the surface aggregation node.

[0337] In addition, in one embodiment, a simulation experiment is provided to verify the performance of the centralized trust evaluation method based on cloud theory and the cluster head election method of the improved LEACH algorithm.

[0338] Simulation environment settings:

[0339] The simulation is performed based on NS-3 network simulation software and Aqua-Sim-NG underwater acoustic communication simulation module.

[0340] The simulation includes simulation experiments related to the trust evaluation method and simulation experiments related to the improved LEACH algorithm. The former mainly considers the ability of the trust evaluation method to accurately identify malicious nodes, while the latter mainly considers improving the security of the cluster head election process in the routing protocol.

[0341] Simulation parameter settings:

[0342] Underwater nodes were randomly deployed in a 5000m x 5000m x 5000m water cube, with the surface aggregation node located at the center of the water. The simulation assumed no malicious attacks during the initial network deployment. The malicious attack began midway and continued until the end of the simulation. The node's signal transmission power was adaptively adjusted based on distance, selecting the minimum power while ensuring the signal-to-noise ratio at the receiver. To facilitate the collection of energy trust evidence, a lower limit on the transmission power was also imposed in the simulation.

[0343] Furthermore, the media access control (MAC) protocol used in the simulation is a modified version of the broadcast MAC protocol used by researchers in this field. In a broadcast MAC protocol, a node senses the channel before sending a data packet. If the channel is idle, it sends the packet. Otherwise, it performs a fallback operation, randomly determines the fallback interval, and tries again until the packet is successfully sent or the number of attempts reaches an upper limit, at which point the packet is discarded. The MAC protocol used in the simulation has been modified from the broadcast MAC protocol. To facilitate the collection of trust evidence, an ACK confirmation mechanism is added. In this mechanism, when a node receives a data packet sent to it, it immediately returns an ACK frame to notify the previous hop node that it has successfully received the data packet.

[0344] In the simulation, the detection rate and false positive rate are mainly used as indicators to test the effectiveness of the designed trust model (i.e., the centralized trust evaluation method based on cloud theory). When testing the security of the improved routing protocol (i.e., the improved LEACH algorithm), the main focus is on the proportion of malicious nodes in the current cluster head node after each clustering stage.

[0345] The detailed simulation parameters are shown in the following table:

[0346]

[0347]

[0348] Trust model (trust assessment method) simulation experiment:

[0349] In order to study the effectiveness of trust evaluation methods in identifying malicious nodes, Figure 7 The variation of detection rate and false detection rate of trust assessment method with simulation time is shown.

[0350] like Figure 7As shown, to avoid cloud model inaccuracies caused by too few cloud droplets, the simulation sets a condition for calculating the cloud model. When the number of cloud droplets is too small, the cloud model is not calculated and trust evaluation is not performed. Therefore, the data from 0s to 400s is meaningless. Between 500s and 600s, the malicious node does not launch an attack. The detection rate and false positive rate of the trust evaluation method initially increase and then gradually decrease. This is because the trust evaluation method has fewer cloud droplets in the early stages of the network, and the cloud model calculated with each calculation varies significantly, resulting in a high false positive rate and a corresponding increase in the detection rate. Between 700s and 1000s, the detection rate and false positive rate gradually decrease. This is because as the number of cloud droplets increases, the calculated cloud model can more accurately describe the node's trustworthiness, reducing the false positive rate. After 1000s, the malicious node begins to launch an attack. The malicious node detection rate first increases slowly over time, then rises rapidly. The simulation data shows that the detection rate eventually stabilizes at a high level above 99.3%. This trend is due to the time it takes for a malicious node to launch an attack and be identified by the trust assessment method. During this process, the malicious node's trust evidence first becomes abnormal, causing its trust value to decrease. As low trust values ​​accumulate as cloud droplets, the cloud model gradually becomes abnormal. After a period of time, the abnormal cloud model causes the calculated MSE to fluctuate sufficiently when passing through the VAE. Only after detecting this fluctuation will the SVM identify the corresponding node as malicious. After 1000 seconds, the false positive rate gradually decreases over time and remains stable at a low level below 0.24%. This is because as the number of cloud droplets increases, the cloud model calculation results for normal nodes gradually stabilize, reducing the likelihood that the trust model will detect normal nodes as malicious.

[0351] In trust assessment methods, mean squared error (MSE) serves as an important metric that can quantitatively assess the degree to which a node's cloud model deviates from the normal cloud model. A higher MSE indicates a greater deviation from the normal cloud model, indicating an abnormal cloud model. Conversely, a lower MSE indicates a closer approximation to the normal cloud model. Next, we examine how the MSE of the attack node and normal node cloud models change over simulation time.

[0352] like Figure 8 As shown, the MSE of the cloud model for normal nodes remains relatively low, around 0.02. However, the MSE of the cloud model for attacking nodes gradually increases after the attack is launched at 1000 seconds, reaching approximately 0.15 at 1900 seconds, significantly different from the MSE of the cloud model for normal nodes. This is because after the malicious node launches the attack, its attack behavior is reflected in the trust evidence, resulting in a decrease in the trust value and an anomaly in the cloud model. When the anomaly cloud model passes through the VAE, the MSE fluctuates. However, since the behavior of normal nodes does not change significantly, the trust evidence, trust value, and cloud model are all normal. Therefore, the MSE of the cloud model for normal nodes does not change much when passing through the VAE.

[0353] The MSE values ​​for different attack types shown in the figure do not strictly increase monotonically over simulation time. The fluctuations can be explained by randomness in the simulation. The node's packet transmission frequency, as a random variable, follows a Poisson distribution. Therefore, the number of packets sent by a node over a period of time is not constant, which results in varying energy consumption levels for nodes over different time periods. Furthermore, malicious data tampering by nodes is also influenced by random numbers. These factors can cause fluctuations in the trust value, which in turn affects the cloud model's update results and the MSE calculation results.

[0354] Improved LEACH protocol simulation experiment:

[0355] In order to study the security of the cluster head election link in the improved LEACH protocol, the ratio of malicious nodes to the number of cluster head nodes in each round of the LEACH protocol and the improved LEACH protocol (algorithm) is tested. A high ratio means that more malicious nodes are selected as cluster heads, and vice versa, it means that the proportion of malicious nodes selected as cluster heads is smaller.

[0356] Figure 9 The figure shows how the proportion of malicious nodes in cluster heads changes over simulation time. The malicious node begins its attack at 1000 seconds. The red dotted line represents the performance of the original LEACH protocol. Because the original LEACH protocol does not consider security issues in its cluster head election process, it is likely to elect a malicious node as a cluster head when a malicious node exists in the network. After 1000 seconds, the proportion of malicious nodes in cluster heads fluctuates around 15%, consistent with the 15% malicious node ratio in the simulation. The blue triangle line represents the performance of the improved LEACH protocol (i.e., the improved LEACH routing protocol). Because the improved LEACH protocol incorporates a soft security mechanism based on a trust model, the model's node trustworthiness assessment influences the cluster head election process (i.e., the improved LEACH algorithm's cluster head election method), reducing the likelihood of a malicious node being elected as a cluster head. After 1000 seconds, the proportion of malicious nodes initially increases, then gradually decreases, ultimately stabilizing below 1.4%. The performance of the improved LEACH protocol can be explained by the operational characteristics of the trust model. The identification of malicious nodes by the centralized trust model based on cloud theory (i.e., the centralized trust assessment method based on cloud theory) is a process. After the attack begins, as trust evidence accumulates, the cloud model anomalies of the malicious node become increasingly severe, and the reconstruction error gradually increases. This results in a decreasing threshold for the cluster head election threshold function of the malicious node, significantly reducing the likelihood of the malicious node becoming a cluster head. Compared to the original LEACH protocol, the improved LEACH protocol is less likely to elect a malicious node as a cluster head during the cluster head election process. This demonstrates the ability of the trust model-based routing soft security mechanism to improve the security of the cluster head election process in clustered routing protocols.

[0357] The figure shows that the proportion of malicious nodes in the cluster heads of both protocols fluctuates over simulation time. This is because both the original LEACH and improved LEACH protocols use a probability-based cluster head election method. Given a limited number of simulations, fluctuations in the statistical results within each round are expected. The fluctuation between 3500 and 4000 seconds in the improved LEACH protocol can also be explained by the characteristics of the cluster head election process. Although the improved LEACH protocol effectively reduces the probability of malicious nodes becoming cluster heads, this is not absolute. The cluster head election threshold function for nodes that have never been elected as cluster heads will tend to have a higher threshold in the next cluster head election, increasing their probability of being elected as cluster heads. Therefore, malicious nodes that have never been elected as cluster heads still have a small chance of becoming cluster heads. However, compared to the original LEACH protocol, the overall probability of malicious nodes becoming cluster heads is significantly reduced.

[0358] The above further describes the technical solution provided by the present invention in detail through several specific embodiments in order to highlight the advantages and benefits of the technical solution provided by the present invention. However, the several specific embodiments described above are not intended to limit the present invention. Any reasonable changes and improvements to the present invention, reasonable combinations of implementation methods and equivalent replacements based on the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A centralized trust evaluation method based on cloud theory, which is applied to an underwater wireless sensor network with a clustered network topology, characterized in that: The method comprises the following steps: Trust evidence collection step: The member nodes in the cluster collect the packet trust evidence, data trust evidence and energy trust evidence, and send these three types of trust evidence to the cluster head node; Trust calculation steps: The cluster head node calculates the packet trust value, data trust value and energy trust value of the member nodes in the cluster based on the three types of trust evidence collected by the member nodes in the cluster, and sends these three types of trust values ​​to the sink node; Trust update step: The aggregation node uses the reverse cloud algorithm to calculate and update the packet cloud model, data cloud model, and energy cloud model of all network nodes based on the trust value of all network nodes; Malicious node steps: The aggregation node combines the three types of cloud models of the evaluated nodes into a 1*9 tensor as the output sample and inputs it into the VAE model. The output of the VAE model is obtained as the output sample; the mean square error between the input sample and the output sample is calculated as the reconstruction error; the reconstruction error is input into the SVM model for node binary classification to realize malicious node identification.

2. The centralized trust evaluation method based on cloud theory according to claim 1 is characterized in that: The cluster head node calculates the trust value of the member nodes in the cluster based on the trust evidence of the member nodes in the cluster: T packet ∈[0,1]； Among them, T packet is the trust value of the contract; PN is the trust evidence of the contract; PN average The average number of packets sent by the member nodes in the cluster within a given time period, which is counted by the cluster head node.

3. The centralized trust evaluation method based on cloud theory according to claim 1 is characterized in that: The cluster head node calculates the data trust value of the member nodes in the cluster based on the data trust evidence collected by the member nodes in the cluster: The data trust evidence of each member node in the cluster is converted into a cloud vector using the reverse cloud algorithm; the cloud vector includes three parameters: expectation ex, entropy en, and super entropy he; Get the estimated values ​​of the three parameters. The estimated values ​​of the three parameters are: Among them, the mean and variance S 2 It is expressed as: Among them, x q Represents the data trust evidence of member node q in the cluster, q=1,2,...,M-1; The cluster head node uses the cloud similarity algorithm to quantify the similarity between the cloud vectors of each cluster member node and any other cluster member node; The cosine value of the angle between two cloud vectors is used to represent the similarity between cloud vectors. The similarity between two cloud vectors is: in, and Represents two cloud vectors C i and C j A vector composed of digital features, i and j represent the cloud vector C i and C j Use the reverse cloud algorithm to convert the corresponding cluster member nodes before; where C i =(ex i ,en i ,he i ), C j =(ex j ,en j ,he j ); The relative trust RT of the data of cluster member node i and cluster member node j in this period ij It is expressed as: The cluster head node calculates the data trust value of each member node in the cluster: The data trust value T of member node i in the cluster data is the average value of the relative trust of all other cluster member nodes to cluster member node i except cluster member node i: Where M is the total number of member nodes in the cluster; k is any other member node in the cluster except the member node i in the cluster, k = 1, 2, ... M, k ≠ i; T data ∈[0,1].

4. The centralized trust evaluation method based on cloud theory according to claim 1 is characterized in that: The cluster head node calculates the energy trust value of the member nodes in the cluster based on the energy trust evidence collected by the member nodes in the cluster: Correction to energy trust evidence: Among them, E original is the energy consumption of the member nodes in the cluster within a given time period, which serves as energy trust evidence; consume is the corrected energy consumption, which is used as the corrected energy trust evidence; d is the straight-line distance between the member node and the cluster head node in the cluster; f is the center frequency used for acoustic communication; A(d,f) is the attenuation function; Based on the corrected energy consumption E consume , use the normal distribution probability density function to calculate the energy trust value T energy : T energy ∈[0,1]； Among them, f(x) is the corrected energy consumption E consume The probability density function of the normal distribution; x is a random variable that obeys the normal distribution; E average is the mean of the normal distribution, which is the mean of the corrected energy consumption of all member nodes in the cluster calculated by the cluster head node; σ is the standard deviation of the normal distribution; e evaluated =E consume .

5. The centralized trust evaluation method based on cloud theory according to claim 1 is characterized in that: The VAE model is obtained by training the initial VAE model using the VAE dataset; The VAE dataset is cloud model data generated by nodes when attack node samples exist and is collected using network simulation technology.

6. A centralized trust evaluation device based on cloud theory, which is applied to an underwater wireless sensor network with a clustered network topology, characterized in that: The device comprises the following modules: Trust evidence collection module: cluster member nodes collect packet trust evidence, data trust evidence and energy trust evidence, and send these three types of trust evidence to the cluster head node; Trust calculation module: The cluster head node calculates the packet trust value, data trust value and energy trust value of the member nodes in the cluster based on the three types of trust evidence collected by the member nodes in the cluster, and sends these three types of trust values ​​to the sink node; Trust update module: The aggregation node uses the reverse cloud algorithm to calculate and update the packet cloud model, data cloud model, and energy cloud model of all network nodes based on the trust value of all network nodes; Malicious node module: The aggregation node combines the three types of cloud models of the evaluated nodes into a 1*9 tensor as the output sample and inputs it into the VAE model. The output of the VAE model is obtained as the output sample; the mean square error between the input sample and the output sample is calculated as the reconstruction error; the reconstruction error is input into the SVM model for node binary classification to realize malicious node identification.

7. A computer device comprising: A processor and a memory, characterized in that the memory is used to store executable instructions of the processor, and the processor is configured to execute the cloud theory-based centralized trust assessment method described in any one of claims 1-5 by executing the executable instructions.

8. A computer storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is run, the centralized trust evaluation method based on cloud theory as described in any one of claims 1 to 5 is executed.

9. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the centralized trust assessment method based on cloud theory as described in any one of claims 1 to 5 are implemented.

10. Improved cluster head election method of LEACH algorithm, characterized in that: The method comprises the following steps: Each node adopts the centralized trust evaluation method based on cloud theory as described in any one of claims 1 to 5 to obtain its own updated mean square error mse; Each node uses the improved cluster head election threshold function T based on the number of times it has served as a cluster head node, the a priori determined cluster head node ratio and mse. imp (n) Calculate the cluster head election threshold; Each node generates a random number by itself; the random number is generated by a random variable in [0,1]; the random number obeys a uniform distribution; Each node compares the random number it generates with the cluster head election threshold: If it is less than the cluster head election threshold, the node becomes the cluster head node of the current large cycle; Otherwise, the node does not become the cluster head node; Improved cluster head election threshold function T imp (n) are as follows: F(mse)=1.02^(24^(10*mse)); Where mse∈[0,+∞); P is the a priori determined proportion of cluster head nodes in the network; r is the current round; G is the set of nodes that have not become cluster head nodes in the last 1 / P rounds.

Images