Information-centric network cache pollution attack defense system, method, and storage medium based on grey Markov model.

Abstract

This invention discloses a cache pollution attack defense system, method, and storage medium for information-centric networks based on a grey Markov model, belonging to the field of network security technology. This invention utilizes the results of cache pollution detection for efficient defense, preventing suspicious content from occupying cache space. It uses a grey Markov model to predict the popularity of suspicious content and continuously monitors it using the predicted popularity value, the uniformity of content request distribution across different paths, and the number of hops returned by data packets, returning normal content to the cache. This invention can use a blacklist for timely defense against attack content, and then filter the content in the blacklist, removing normal content, thereby improving upon the problems of existing methods being slow and prone to mistakenly attacking normal content, thus achieving timely and efficient defense.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to an information-centric network cache pollution attack defense system, method, and storage medium based on a grey Markov model. Background Technology

[0002] Cache poisoning attacks, as a targeted network attack method, are designed to consume the built-in cache space of an Information-Centralized Network (ICN), thereby reducing its content distribution efficiency. In the ICN architecture, caching plays a crucial role in accelerating content delivery and reducing server load. However, this attack strategy poses a serious challenge to the operation of the ICN. Attackers maliciously consume the network's limited cache resources by injecting a large amount of low-popularity content into the network, causing normal, popular content to be replaced. This results in frequent user access misses, severely degraded network performance, and a significant reduction in content distribution efficiency.

[0003] To achieve timely and efficient defense against cache poisoning attacks in ICNs, this invention proposes a cache poisoning attack defense method based on a grey Markov model. This method uses the predicted popularity of cache poisoning attack content, the dispersion coefficient of requests on different paths, and the hop count of response packets to filter malicious content, thereby achieving timely and efficient defense.

[0004] The behavioral characteristics of normal content and attack content differ, and these differences can be used to filter attack content, thereby achieving timely and efficient defense against cache pollution attacks. DDCPC [Yao L, Fan Z, Deng J, et al. Detection and defense of cache pollution attacks using clustering in named data networks [J]. IEEE Transactions on Dependable and Secure Computing, 2018, 17(6): 1310-1321.] collects the popularity of router content and the average time interval of requests, and uses these two parameters to use a clustering algorithm to distinguish content into popular and non-popular classes. If the increment of the popular class is greater than a threshold in multiple time slices, a cache pollution attack is detected. For attack content, only the corresponding interest packets are forwarded without caching its interest packets, thus effectively defending against cache pollution attacks. FLAGP [Yao L, Zeng Y, Wang X, et al. Detection and defense of cache pollution based on popularity prediction in named data networking [J]. IEEE Transactions on Dependable and Secure Computing, 2020, 18(6): 2848-2860.] This scheme uses parameters such as the request frequency of each content. By analyzing data within consecutive time slices, this scheme can predict the predicted popularity of a certain content within future time slices. If the difference between the actual popularity of the content and the predicted value exceeds a preset threshold, it is listed as suspicious content. Once a certain content is evaluated as suspicious in multiple time slices, it is determined that it has suffered a cache pollution attack. For detected attack content, this scheme will actively control the growth of its popularity, thereby limiting its impact on the cache. This invention is based on a grey Markov model, using the popularity prediction value, the dispersion coefficient on different paths, and the number of hops in the response data packet to filter malicious content, thereby achieving defense against cache pollution attacks. Summary of the Invention

[0005] The purpose of this invention is to provide an information center network cache pollution attack defense system, method, and storage medium based on a grey Markov model.

[0006] The objective of this invention is achieved through the following technical solution:

[0007] A method for defending against cache pollution attacks in information-centric networks based on a grey Markov model, comprising the following steps:

[0008] Step 1: Processing of blacklisted content; When users in the information center network exchange information through interest packets and data packets, each router in the network performs defense optimization according to the detection method specified by the network administrator, forming a blacklist to prevent content from being cached; In addition, each router suspends updating the popularity of suspicious content based on its own blacklist for the current time slice and randomly discards requests for suspicious content.

[0009] Step 2: Obtaining parameters; Modify the table structure, interest packet field, and data packet field in the router of the information center network to record the content popularity, the path taken by the interest packet, and the number of hops returned by the data packet, respectively.

[0010] Step 3: Filtering the blacklist content; using the parameters obtained in Step 2, filter the content in the blacklist after Step 1, and remove the misjudged content from the blacklist in a timely manner.

[0011] Further, step 1 specifically includes:

[0012] Step 1.1: Pause the update of the popularity of suspicious content; when a data packet in the network passes through the router, if the content matches the router's blacklist, pause the update of its content popularity to prevent the router cache from being deceived by the attack content, thereby avoiding the attack content from obtaining improper priority;

[0013] Step 1.2: Process content requests and responses; When a request for blacklisted content passes through the router, the router discards the request with probability p. This ensures that normal user requests can be responded to, while limiting cache poisoning attacks to the local router level and preventing them from spreading upstream; it only forwards but does not cache responses to blacklisted content to prevent attack content from occupying limited cache space.

[0014] Furthermore, the router, in its practice of randomly discarding suspicious interest packets with probability p and not caching attack content, uses the current time of program execution as a random seed, and then generates a random number in the range [0,1]. If the random number falls within the range [0,p], the interest packet is discarded; if the random number falls within the range [p,1], the interest packet is forwarded.

[0015] Furthermore, step 2 specifically includes:

[0016] Step 2.1: Record content popularity. After receiving interest packets, the router records the number of requests for each piece of content to calculate its popularity. The popularity of content in the built-in cache is used as a filtering criterion, and the popularity of suspicious content is used to predict its subsequent popularity. Suspicious content popularity prediction uses a grey Markov model to calculate the popularity of suspicious content. Make predictions. Where GMM is a grey Markov model, p k-j (c i ) represents the content within the j-th time segment in the past. i Popularity;

[0017] Step 2.2: Modify the fields in the request interest packet to record the path traversed by the interest packet; when the router receives the interest packet, it maintains a hash table recording the correspondence between the path and the number of requests; when it is necessary to filter normal content based on the dispersion coefficient, calculate the content c. i Request the mean (c) across different paths i ) and standard deviation SD(c i ):

[0018]

[0019] Where, path cnt Indicates request content c i The number of paths, Num k (c i ) represents the content c from path k. i The number of requests; and then the coefficient of variation of content requests on different paths:

[0020]

[0021] Where t is a constant greater than 0;

[0022] Step 2.3: When the data packet corresponding to the interest packet request is sent back through the router, the router modifies the fields in the data packet to record the number of hops from the data hit point.

[0023] Furthermore, step 3 specifically includes:

[0024] Step 3.1: Continuously monitor three parameters: the popularity of content in the router's built-in cache, the path of interest packets, and the number of hops per packet;

[0025] Step 3.2: The content popularity, interest packet path, and data packet hop count of the content in the built-in cache are used as dynamic thresholds to filter the content in the blacklist and remove normal content from the blacklist in a timely manner, so as to realize the dynamic update of the blacklist content.

[0026] Step 3.3: At the start of the next time slice, receive the results of the cache pollution detection method specified by the network administrator and process the newly added cached content in the CS (Content Store) cache table in the current time slice. If there is no cache pollution attack in the current time slice, do not process this content; if there is a cache pollution attack in the previous time slice, add the newly added cached content in the CS in the current time slice to a temporary blacklist for continuous monitoring.

[0027] A network cache pollution attack defense system for information centers based on a grey Markov model includes a blacklist management device, a packet processing device, and a content monitoring and filtering device.

[0028] The blacklist management device updates the content insertion time and adds new content to the blacklist according to the content update time and whether an attack is detected within the time slice.

[0029] The packet processing device is responsible for processing interest packets and data packets arriving at the router according to the temporary blacklist, including pausing the update of the popularity of suspicious content, randomly discarding some requests for suspicious content according to a predetermined probability, and prohibiting the caching of suspicious content;

[0030] The content monitoring and filtering device is responsible for continuously monitoring the content in the temporary blacklist. First, it uses a grey Markov model to predict the popularity of the content. Then, it uses the predicted popularity value, the dispersion coefficient of the content request on different paths, and the number of hops of the response data packet to remove the normally popular content from the temporary blacklist and put it back into the cache, thereby reducing the impact on normal users.

[0031] A computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implements the steps of a method for defending against cache pollution attacks in information-centric networks based on a grey Markov model.

[0032] A computer program product includes a computer program / instructions that, when executed by a processor, implement steps of a method for defending against cache pollution attacks in information-centric networks based on a grey Markov model.

[0033] The beneficial effects of this invention are as follows:

[0034] This invention can use a blacklist to defend against attacks in a timely manner, and then filter the content in the blacklist to remove normal content. This improves the problem of existing methods being slow to defend and prone to accidentally attacking normal content, thereby achieving timely and efficient defense. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of the system of the present invention;

[0036] Figure 2 This is a flowchart of the insertion time update process in this invention;

[0037] Figure 3 This is a flowchart of the blacklist update process in this invention;

[0038] Figure 4 This represents the normal content cache hit rate for XC topology.

[0039] Figure 5 This represents the normal content cache hit rate for the DFN topology.

[0040] Figure 6 The average number of jumps for normal content under the XC topology is θ = 0.7;

[0041] Figure 7 The average number of jumps for normal content under DFN is θ = 0.7;

[0042] Figure 8 This represents the average number of jumps under different attack intensities in the XC topology.

[0043] Figure 9 This represents the average number of hops under different attack intensities in the DFN topology. Detailed Implementation

[0044] The present invention will now be further described with reference to the accompanying drawings.

[0045] This invention discloses a method for defending against cache pollution attacks in information-centric networks based on a grey Markov model. The specific steps are as follows:

[0046] Step 1: Processing of blacklisted content; When users in the information center network exchange information through interest packets and data packets, each router in the network performs defense optimization according to the detection method specified by the network administrator, forming a blacklist to prevent content from being cached; In addition, each router suspends updating the popularity of suspicious content based on its own blacklist for the current time slice and randomly discards requests for suspicious content.

[0047] Step 2: Obtaining parameters; Modify the table structure, interest packet field, and data packet field in the router of the information center network to record the content popularity, the path taken by the interest packet, and the number of hops returned by the data packet, respectively.

[0048] Step 3: Filtering the blacklist content; using the parameters obtained in Step 2, filter the content in the blacklist after Step 1, and remove the misjudged content from the blacklist in a timely manner.

[0049] Figure 1 This is a schematic diagram of the system of the present invention, specifically:

[0050] This invention proposes a cache pollution defense method based on a grey Markov model, aiming to achieve efficient and accurate defense, avoiding the unintended harm to normal content due to misjudgment or changes in popularity, thereby minimizing the impact on normal users while achieving good defense results. The defense framework mainly consists of three modules: a blacklist management module, a packet processing module, and a blacklist content monitoring and filtering module.

[0051] The blacklist management module is responsible for managing the blacklist. It needs to maintain the time when content is inserted into the cache and remove suspicious content from the cache and add it to the blacklist when a cache pollution attack occurs. To implement this module, an attribute "insertion timestamp" needs to be added to the content cache (CS) to record the time when content enters the cache. The timestamp uses the Unix timestamp format.

[0052] The modified CS is shown in Table 1.

[0053] Table 1. Modified CS

[0054]

[0055] The packet processing module is responsible for processing interest packets and data packets arriving at the router according to the temporary blacklist, including pausing the update of the popularity of suspicious content, randomly discarding some requests for suspicious content according to a predetermined probability, and prohibiting the caching of suspicious content.

[0056] Upon receiving an interest packet, this module first extracts the content name information and queries a temporary blacklist to determine if the content name exists. If the content name is in the blacklist, the module will pause updating the popularity statistics for that content. This is because content in the temporary blacklist is suspected cache-pollution content, and its request volume does not accurately reflect user demand. Pausing updates to its popularity prevents these contents from receiving inappropriate priority in subsequent decisions. In addition to pausing popularity updates, this module will also randomly discard some requests for blacklisted content with a certain probability p. To protect the cache, there are generally two approaches to handling suspicious content using blacklists. One is to only forward interest packets containing poisoning attack content without caching its content. This approach has some effect on protecting the cache, but forwarding interest packets will spread the cache poisoning attack to upstream routers, and a large number of requests and responses will put a huge strain on bandwidth. The other approach is to directly discard interest packets requesting suspicious content. This will result in normal users' requests for that content not receiving a response. Normal users request non-popular content less frequently, but they will occasionally make such requests. This module employs a method of randomly discarding suspicious interest packets with probability p and not caching attack content. This ensures that attack content will not enter the cache, while limiting the attack scope to below the local router level, avoiding impact on upstream routers and reducing the impact on normal users. The algorithm for discarding interest packets with probability p is implemented as shown in Algorithm 2. It uses the current time of program execution as a random seed, then generates a random number in the range [0,1]. If the random number falls within the range [0,p], the interest packet is discarded; if the random number falls within the range [p,1], the interest packet is forwarded.

[0057]

[0058] When the router receives the returned data packet, this module will check whether the content corresponding to this interest packet is in the blacklist. If the content is in the blacklist, the data packet will be abandoned and cached directly to ensure that the cache contains popular content requested by normal users.

[0059] In the packet processing module, the query and processing of temporary blacklists need to be performed online. Therefore, it is required to implement efficient query algorithms and data structures to ensure minimal impact on router forwarding performance. In this invention, the temporary blacklist is implemented using a prefix tree. A prefix tree, also known as a dictionary tree or trie tree, is a tree structure used for fast string retrieval. It maximizes space utilization by sharing common prefixes. The path from the root node to a non-leaf node represents the prefix of a string, and the path from the root node to a leaf node represents a complete string. The hierarchical naming mechanism in ICN results in a large amount of content having the same prefix, making it very suitable for storage using prefix trees. The time complexity of insertion, search, and deletion operations in a prefix tree is O(m), where m is the length of the content name. This means that the efficiency of the operation is independent of the amount of data stored in the tree and only depends on the length of the string being operated on. In terms of space complexity, in the worst case, all strings have no common prefixes, resulting in a space complexity of O(n*m). However, in practice, content produced by the same producer and different chunks of the same content in ICN share prefixes, so the worst-case scenario is almost non-existent.

[0060] The blacklist content monitoring and filtering module is responsible for continuously monitoring the content in the temporary blacklist. First, it uses a grey Markov model to predict the popularity. Then, it uses the predicted popularity value, the dispersion coefficient of content requests on different paths, and the number of hops in the response data packet to remove normal popular content from the temporary blacklist and put it back into the cache, thereby reducing the impact on normal users.

[0061] When filtering for normal popular content, content with high popularity and low dispersion coefficient is placed back into the cache as normal popular content, content with low popularity and low dispersion coefficient is removed from the blacklist as non-popular content, content with low popularity and high dispersion coefficient but low packet hop count is removed from the blacklist as normal content, and other content remains in the blacklist as attack content. The popularity, dispersion coefficient, and hop count of content are determined using dynamic thresholds, with the threshold being the median of the corresponding parameters in the CS (Content Controller). Compared to static thresholds, using the median of popularity in the CS can adapt to scenarios with different traffic volumes. Since the popularity, dispersion coefficient, and hop count of each piece of content in the CS are not ordered, an efficient algorithm is needed to obtain the median of the dispersion coefficient of the content in the CS. This invention uses a fast selection algorithm, which can find the median in O(n) time with a space complexity of only O(1), as shown in Algorithm 2. The overall filtering process is shown in Algorithm 3.

[0062] By determining the above three parameters, truly popular content is removed from the temporary blacklist and returned to the cache, thus avoiding the impact on normal users when defending against cache pollution.

[0063]

[0064]

[0065]

[0066] Content popularity is a crucial factor in this solution's selection of popular content; therefore, a content popularity-based cache replacement strategy (CCP) is adopted.

[53] This cache replacement strategy periodically calculates the popularity of content and makes cache replacement decisions based on dynamic popularity, prioritizing the caching of content with high popularity. To implement CCP, a Content Popularity Table (CPT) is added in addition to CS, PIT, and FIB. This table records content popularity. Within a time slice, when the router receives an interest packet, it checks if the corresponding content name exists in the CPT and updates the popularity of the corresponding content. Popularity statistics are based on data within a time slice; therefore, the popularity table is cleared at the end of a time slice and restarted at the beginning of the next time slice. The content insertion and cache update process is as follows: Figure 4 As shown. When a data packet arrives, the content popularity is first queried in CPT, and then a decision is made based on CCP to determine whether to cache the content. If the content should be cached according to CCP, the insertion time of the content is updated to the current time.

[0067] Figure 2 The following is a flowchart of the insertion time update process in this invention:

[0068] Content popularity is a crucial factor in this solution's selection of popular content; therefore, this invention employs a content popularity-based cache replacement strategy (CCP). This strategy periodically calculates content popularity and makes cache replacement decisions based on dynamic popularity, prioritizing the caching of highly popular content. To implement CCP, a Content Popularity Table (CPT) is added in addition to CS, PIT, and FIB. This table records content popularity. Within a time slice, when the router receives an interest packet, it checks if a corresponding content name exists in the CPT and updates the popularity of that content. Popularity statistics are based on data within a time slice; therefore, the popularity table is cleared at the end of a time slice and restarted at the beginning of the next time slice. The content insertion and cache update process is as follows: Figure 2 As shown. When a data packet arrives, the content popularity is first queried in CPT, and then a decision is made based on CCP to determine whether to cache the content. If the content should be cached according to CCP, the insertion time of the content is updated to the current time.

[0069] Figure 3 This is a flowchart of the blacklist update process in this invention, specifically:

[0070] When the blacklist management module receives a signal indicating a cache poisoning attack, it will immediately activate its defense strategy. Attackers increase the popularity of attack content by sending a large number of interest packets, thereby occupying cache space. Therefore, content that enters the cache during a cache poisoning attack will be considered suspicious and added to a temporary blacklist to prevent it from entering the cache. Subsequent filtering mechanisms will then remove normally popular content.

[0071] The experimental scenarios of the present invention are described in detail below, and the implementation results are analyzed in light of the advantages of the present invention.

[0072] This invention runs on the ndnSIM simulation platform. To complement the defense method proposed in this invention, the cache replacement strategy uses a content popularity-based cache replacement algorithm (CCP). When the cache space is full, the content with the lowest popularity is replaced from the cache. This section conducts comparative experiments on XC and DFN topologies, with each experiment lasting 600 seconds. For the first 300 seconds, only normal users request content; from the 300th second, attackers begin their attacks. The cache hit rate of normal content and the hop count of response packets for normal content are used as performance evaluation metrics. Table 2 shows the specific parameters of the simulation configuration.

[0073] Table 2. Parameters of the ndnSIM simulation experiment

[0074]

[0075]

[0076] The purpose of cache pollution attacks is to occupy the cache with non-popular content, which ultimately leads to a decrease in the cache hit rate of normal user requests and an increase in the average number of hops in the response. This paper compares the cache pollution defense scheme based on the grey Markov model proposed in this invention with clustering-based and popularity prediction-based defense schemes, selecting the normal content cache hit rate and the average number of hops in the response data packet as the most representative indicators of the effectiveness of cache pollution attacks.

[0077] (1) Normal content cache hit rate

[0078] Cache hit rate reflects the probability that a user request can be satisfied by the cache. A lower cache hit rate indicates that more cached content is being compromised by attacks. One of the goals of cache pollution attack defense schemes is to improve the cache hit rate. The cache hit rate is calculated as follows:

[0079]

[0080] Among them, Hit r(t) represents the number of times the cache was hit by a normal request for interest package r within time t, and R represents the total number of normal requests for interest packages within time t.

[0081] Figure 4 and Figure 5 This paper compares the cache hit rate of normal content under different attack intensities in XC and DFN topologies. Four attack intensities (0.1, 0.3, 0.5, and 0.7) were selected in both topologies, covering both low-rate and high-rate attacks. The graphs show that as the attack intensity increases, the cache hit rate of normal content decreases for the same attack method. This is because the more non-popular content the attacker requests, the more cache space it consumes, ultimately causing normal user content requests to miss the cache. Cache pollution defense methods can mitigate the impact of attacks, but the impact is difficult to completely eliminate. Under different attack intensities in XC and DFN, the cache pollution defense method based on GMM proposed in this invention achieves a higher cache hit rate compared to DDCPC and FLAGP. This is because DDCPC uses a blacklist for defense, and all content included in the blacklist cannot be cached. In this scheme, content that changes from unpopular to popular during the time slice of a cache pollution attack is added to the blacklist. This scheme also lacks subsequent monitoring of content in the blacklist, which can lead to false positives for normal content. FLAGP uses a method of controlling the growth of the popularity of suspicious content for defense. This method reduces the popularity of suspicious content, but it also lacks continuous monitoring of suspicious content. This solution achieves efficient defense based on early detection, does not cache suspicious content, and randomly drops some requests based on probability. After implementing the defense, it continuously monitors the content in the temporary blacklist, reducing the impact of false positives or content changing from unpopular to popular on the cache hit rate of normal content.

[0082] (2) Number of hops in the response packet

[0083] The hop count of the response packet is also an important indicator of the effectiveness of cache pollution attack defense methods. It reflects the distance between the cache of the requested content and the user. A higher hop count indicates that the cache location of the requested content is farther from the user, requiring a longer time for the user to receive the response, and the network cache is not being used effectively. The hop count of the response packet is calculated as follows:

[0084]

[0085] Among them, hop r (t) represents the number of hops that normal content r takes from the cache hit to the consumer, and R represents the total number of requests within time t.

[0086] Figure 6 and Figure 7The graph shows the hop count of normal content packets on both the XC and DFN topologies, with an attack strength θ of 0.7. The graph captures hop count data from 200s to 400s; before 300s, only normal user requests were made, and the attack began at 300s. As can be seen, the hop count of normal content responses increased rapidly after the attack began. The defense method proposed in this invention was activated 310s in advance, adding suspicious content to a temporary blacklist to prevent attack content from entering the cache. DDCPC and FLAGP require time slice accumulation, with FLAGP requiring the superposition and judgment of multiple detection results before defense can be implemented, thus requiring a longer time to implement defense measures, resulting in a defense lag.

[0087] Figure 8 and Figure 9 The figures show a comparison of average hop counts under different attack intensities in both XC and DFN topologies. As can be seen from the figures, the defense method proposed in this invention achieves a lower hop count. This is because, during continuous detection of suspicious content after the defense is implemented, this method utilizes popularity prediction values, the dispersion coefficient of content requests on different paths, and the hop count of response packets to remove normally popular content from the blacklist and put it back into the cache to meet the needs of normal users. In contrast, DDCPC and FLAGP use a one-size-fits-all blacklist approach, lacking continuous monitoring of content.

[0088] This invention compares the cache pollution attack defense effects of GMM, DDCPC, and FLAGP through simulation experiments. Experimental results show that the proposed defense method has better performance under different attack intensities and topologies. DDCPC uses a broadcast blacklist for cache pollution defense, but lacks continuous monitoring of blacklisted content. Furthermore, its blacklist generation method means that when both attack content and normally popular content with increasing popularity exist simultaneously in the same time slice, the normally popular content will also be blacklisted and cannot be cached, affecting the caching of normal content. FLAGP also uses a blacklist for defense, but it requires content to be deemed suspicious within multiple time slices before being blacklisted, resulting in a lag in defense. In addition, this scheme uses a method of controlling the popularity of suspicious content for defense, lacking long-term monitoring of suspicious content. The cache pollution defense method based on GMM proposed in this invention implements defense measures immediately upon receiving the detection result, preventing the router from caching polluted content. It also suspends the popularity update of suspicious content to prevent the router from being "deceived" by the false increase in the popularity of attack content, randomly discards requests for suspicious content, and limits the cache pollution attack to the local router level. In the subsequent time slice, this solution continuously monitors suspicious content using reliable content popularity predictions, the dispersion coefficient of content requests on different paths, and the number of hops in response packets. It then puts truly popular content back into the cache, reducing the impact on normal content and achieving a higher cache hit rate and a smaller number of response packet hops.

[0089] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for defending against cache pollution attacks in information-centric networks based on a grey Markov model, characterized by: The specific steps are as follows: Step 1: Processing of blacklisted content; When users in the information center network exchange information through interest packets and data packets, each router in the network performs defense optimization according to the detection method specified by the network administrator, forming a blacklist to prevent content from being cached; In addition, each router suspends updating the popularity of suspicious content based on its own blacklist for the current time slice and randomly discards requests for suspicious content. Step 2: Obtaining parameters; Modify the table structure, interest packet field, and data packet field in the router of the information center network to record the content popularity, the path taken by the interest packet, and the number of hops returned by the data packet, respectively. Step 2.1: Record content popularity. After receiving interest packets, the router records the number of requests for each piece of content to calculate its popularity. The popularity of content in the built-in cache is used as a filtering criterion, and the popularity of suspicious content is used to predict its subsequent popularity. Suspicious content popularity prediction uses a grey Markov model to calculate the popularity of suspicious content. Make predictions. GMM is a gray Markov model. Content within the j-th time frame in the past Popularity; Step 2.2: Modify the fields in the request interest packet to record the path traversed by the interest packet; when the router receives the interest packet, it maintains a hash table recording the correspondence between the path and the number of requests; when it is necessary to filter normal content based on the dispersion coefficient, calculate the content... Request the average value across different paths and standard deviation : ; in, Indicates the request content The number of paths, Indicates source path content The number of requests; Then calculate the dispersion coefficient of content requests on different paths: ; in, A constant greater than 0; Step 2.3: When the data packet corresponding to the interest packet request is sent back through the router, the router modifies the fields in the data packet to record the number of hops from the data hit point; Step 3: Filtering the blacklist content; using the parameters obtained in Step 2, filter the content in the blacklist after Step 1, and remove the misjudged content from the blacklist in a timely manner.

2. The information-centric network cache pollution attack defense method based on the grey Markov model according to claim 1, characterized in that: Step 1 specifically involves: Step 1.1: Pause the update of the popularity of suspicious content; when a data packet in the network passes through the router, if the content matches the router's blacklist, pause the update of its content popularity to prevent the router cache from being deceived by the attack content, thereby avoiding the attack content from obtaining improper priority; Step 1.2: Process content requests and responses; When a request for blacklisted content passes through the router, the router discards the request for blacklisted content with probability p. This ensures that normal user requests can be responded to, while limiting cache poisoning attacks to the local router level and preventing them from spreading upstream. Forward but do not cache responses to blacklisted content to prevent attack content from occupying limited cache space.

3. The information-centric network cache pollution attack defense method based on the grey Markov model according to claim 2, characterized in that: The router, which randomly discards suspicious interest packets with probability p and does not cache attack content, uses the current time of program execution as a random seed and then generates a random number in the range [0,1]. If the random number falls within the range [0,p], the interest packet is discarded; if the random number falls within the range [p,1], the interest packet is forwarded.

4. The information-centric network cache pollution attack defense method based on the grey Markov model according to claim 1, characterized in that: Step 3 specifically involves: Step 3.1: Continuously monitor three parameters: the popularity of content in the router's built-in cache, the path of interest packets, and the number of hops per packet; Step 3.2: The content popularity, interest packet path, and data packet hop count of the content in the built-in cache are used as dynamic thresholds to filter the content in the blacklist and remove normal content from the blacklist in a timely manner, so as to realize the dynamic update of the blacklist content. Step 3.3: At the start of the next time slice, receive the results of the cache pollution detection method specified by the network administrator and process the newly added cached content in the CS cache table in the current time slice. If there is no cache pollution attack in the current time slice, do not process this content; if there is a cache pollution attack in the current time slice, add the newly added cached content in the CS in the current time slice to a temporary blacklist for continuous monitoring.

5. The system for defending against cache pollution attacks in information-centric networks based on grey Markov models according to any one of claims 1-4, characterized in that: This includes a blacklist management device, a packet processing device, and a content monitoring and filtering device; The blacklist management device updates the content insertion time and adds new content to the blacklist according to the content update time and whether an attack is detected within the time slice. The packet processing device is responsible for processing interest packets and data packets arriving at the router according to the temporary blacklist, including pausing the update of the popularity of suspicious content, randomly discarding some requests for suspicious content according to a predetermined probability, and prohibiting the caching of suspicious content; The content monitoring and filtering device is responsible for continuously monitoring the content in the temporary blacklist. First, it uses a grey Markov model to predict the popularity of the content. Then, it uses the predicted popularity value, the dispersion coefficient of the content request on different paths, and the number of hops of the response data packet to remove the normally popular content from the temporary blacklist and put it back into the cache, thereby reducing the impact on normal users.

6. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that: When the computer program / instructions are executed by the processor, they implement the steps of the method described in any one of claims 1-4.

7. A computer program product comprising a computer program / instructions that, when executed by a processor, implement the steps of the method according to any one of claims 1-4.

Images