Network security sensing system for edge intelligent Internet of Things

Abstract

The invention discloses a network security sensing system for an edge intelligent Internet of Things, and belongs to the technical field of Internet of Things security, the network security sensing system comprises a trusted group construction module and a route maintenance module, the route maintenance module comprises a community dynamic self-check unit and a route decision unit; the trusted routing construction module is used for carrying out trust grade division on each node of the network topology structure through a fuzzy theory and constructing a trusted group according to a grade division result; the community dynamic self-checking unit is used for updating a credible group according to the interaction condition of each node and a set credible group rule, including updating the credibility of the nodes and identifying and processing malicious nodes; the routing decision unit is used for carrying out routing selection after the nodes initiate routing discovery; and in the process of using the route, if the node has a fault or is separated from the trusted group, performing route recovery. According to the method, the characteristics and application requirements of the Internet of Things edge equipment nodes can be fully considered, and the routing security of a trusted group is ensured.

Description

Technical Field

[0001] The present invention belongs to the field of Internet of Things security technology, and specifically relates to a network security perception system for edge intelligent Internet of Things. Background Art

[0002] In edge computing networks, the interactions and organization between IoT nodes can be compared to biological communities in nature, where they organize and collaborate according to specific rules. Within this "community" structure, nodes can cooperate, coordinate, and compete to achieve specific functional goals. Unlike natural biological communities, the "community" structure in edge computing networks is more flexible and controllable, allowing it to be constructed and optimized based on different application scenarios and needs. Furthermore, due to the intelligence and autonomy of IoT nodes, the "community" structure in edge computing networks can respond to environmental changes more efficiently and intelligently, achieving adaptive and self-organizing characteristics.

[0003] The open nature of edge computing and the unique characteristics of IoT edge nodes make security issues more complex and prominent. In particular, issues such as malicious node attacks require adequate attention and resolution. To address these security issues, researchers in the field of edge computing have proposed numerous solutions. These include using encryption to protect communications and data between edge nodes, leveraging blockchain technology for decentralized trust management, and employing machine learning to identify and prevent malicious attacks. Furthermore, some researchers have proposed trust-based solutions, which establish trust assessment mechanisms to determine the trust level between nodes. These solutions typically rely on historical interaction data and feedback between nodes to build a trust network. However, due to the limited computing and storage capabilities and high heterogeneity of edge devices, traditional trust models may be difficult to adapt to the application scenarios of IoT edge device nodes. Furthermore, traditional trust assessment methods often only consider a small number of dimensions and fail to fully reflect the multidimensional characteristics of nodes, thus affecting the accuracy of trust modeling. Summary of the Invention

[0004] In response to the deficiencies in the prior art, the present invention provides a network security perception system for edge intelligent IoT, which can fully consider the characteristics and application requirements of IoT edge device nodes and ensure the routing security of trusted groups.

[0005] The present invention provides the following technical solutions:

[0006] A network security perception system for edge intelligent Internet of Things, wherein the edge intelligent Internet of Things configures a network topology structure, including: a trusted group construction module and a routing maintenance module, wherein the routing maintenance module includes a community dynamic self-checking unit and a routing decision unit;

[0007] Trusted routing construction module: Use fuzzy theory to classify the trust levels of each node in the network topology and build trusted groups based on the classification results;

[0008] Community dynamic self-check unit: Updates the trusted group based on the interaction between each node and the set trusted group rules, including: updating the trustworthiness of nodes and identifying and handling malicious nodes;

[0009] Routing decision unit: After the node initiates route discovery, it performs route selection; in addition, during the routing process, if a node fails or leaves the trusted group, it performs route recovery.

[0010] Optionally, the trust level classification of each node in the network topology structure by using fuzzy theory and the construction of a trusted group according to the level classification results are specifically as follows:

[0011] Define levels of trust, including no trust, low trust, preliminary trust, moderate trust, and high trust;

[0012] Based on the initial trust level set for each node, each node is divided into trust levels through fuzzy theory, and then the untrusted nodes are eliminated to preliminarily build a trusted group.

[0013] Optionally, the trust level classification of each node is performed using fuzzy theory, specifically as follows:

[0014] For the initial trust value x of node i, the membership of the initial trust value x to each trust level is obtained through the set membership function;

[0015] According to the following formula, the probability distribution value of node i belonging to each trust level is calculated, and node i is divided into the trust level corresponding to its maximum probability distribution value;

[0016]

[0017] Among them, m i (M j ) is the node i belongs to the trust level M j The probability distribution value, γ i is the degree to which the initial trust value of node i is supported by other trust levels; n is the total number of trust levels.

[0018] Optionally, the formula for obtaining the membership degree of the initial trust value x to each trust level is:

[0019]

[0020]

[0021] Among them, M1(x), M2(x), M3(x), M4(x) and M5(x) are the membership of the initial trust value x to the levels of distrust, low trust, preliminary trust, medium trust and high trust, respectively.

[0022] Optionally, updating the trustworthiness of the node is specifically:

[0023] According to the set update cycle, obtain the source node and recommended node of the current node, evaluate the direct trust and recommended trust of the current node, and update the comprehensive trust of the current node;

[0024] The calculation formula of the direct trust degree is:

[0025]

[0026] in, is the direct trust value of source node j to current node i at time t, τ k (i, j) is the score of the result of the k-th interaction between the source node j and the current node i, which usually ranges from 0 to 1, with 1 indicating complete satisfaction; K is the total number of interactions, ω k is the weight coefficient corresponding to the kth interaction;

[0027] The calculation formula of the recommendation confidence is:

[0028]

[0029] in, is the recommendation trust of all recommendation nodes to the current node i at time t, is the recommendation trust value of the qth recommendation node to the current node i at time t, w q is the weight of the recommendation trust value corresponding to the qth recommendation node;

[0030] The comprehensive trust degree T of the current node i i for:

[0031]

[0032] Among them, ω1 and ω2 are the weights of direct trust and recommendation trust, respectively.

[0033] Optionally, before obtaining the recommendation trust of all recommendation nodes for the current node i, a similarity analysis is performed on the recommendation trust values ​​of each recommendation node using a similarity algorithm. When the similarity of the recommendation nodes is less than a set threshold, the recommendation trust value of the current recommendation node is penalized.

[0034] Optionally, the penalty on the recommendation trust value of the current recommendation node is specifically:

[0035]

[0036] in, is the recommendation trust value after punishment; β is the punishment coefficient, which is related to Corresponding to the level.

[0037] Optionally, the identification and processing of malicious nodes is specifically as follows: obtaining the updated comprehensive trust of the node in real time; if the comprehensive trust of the node is at a trust level of distrust, the current node is a malicious node, and the malicious node is removed from the trusted group and added to a blacklist; when a node enters the blacklist, all communications and routing related to the node are suspended, and after the group public key is updated, it is broadcast to all nodes in the trusted group.

[0038] Optionally, the updating of the trusted group also includes isolating nodes with low trust levels and suspending all communications and routing of low trust nodes; when the node is isolated, the stability of the isolated node signal is continuously monitored and its trust is continuously updated. If the trust of the isolated node increases, or the stability of its signal meets the set time requirement, the isolated node is released from isolation, and the trust level of the isolated node that meets the stability requirements is updated to the preliminary trust level.

[0039] Optionally, the route restoration specifically includes:

[0040] When a node fails or leaves the trusted group, it continuously sends heartbeat packets to the optimal routing link affected by the node. If the edge server receives the heartbeat packet, the optimal routing link returns to normal.

[0041] If the edge server does not receive the heartbeat packet communicated through the optimal routing link, it will send a heartbeat packet to the alternative route stored in the routing selection process. If the link of the alternative route is in normal reception, the optimal alternative route will be selected for use. When the optimal routing link returns to normal, the optimal routing link will be switched as the used route.

[0042] If the edge server does not receive the heartbeat packet communicated through the optimal routing link within the set time, it will re-select the route.

[0043] Compared with the prior art, the present invention has the following beneficial effects:

[0044] The present application includes a trusted group construction module and a routing maintenance module. The routing maintenance module includes a community dynamic self-inspection unit and a routing decision unit. The present application completes the construction of the trusted group by dividing the trust levels and formulating community rules. In addition, in order to ensure the dynamic reliability of the trusted group in the edge network, the nodes in the community are updated with regular trust, and the comprehensive trust of the nodes is adjusted in time through the recommendation feedback mechanism, and malicious nodes are eliminated and isolated. In the routing decision, considering the impact of the entry and exit of nodes in the trusted group on the route they are located, a routing recovery mechanism is proposed to ensure the normal communication of edge network nodes. The present application can better manage and update nodes and corresponding routes, and respond to node trust changes more accurately and quickly. It has good performance in routing decision and recovery. Especially when the proportion of malicious nodes is large, the network security perception system of the present application is more accurate and robust, thereby fully considering the characteristics and application requirements of the IoT edge device nodes to ensure the routing security of the trusted group. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is an overall schematic diagram of the network security perception system for edge intelligent Internet of Things of the present invention;

[0046] Figure 2 It is a schematic diagram of the trust membership function of the present invention;

[0047] Figure 3 It is a flowchart of node trust calculation of the present invention;

[0048] Figure 4 Schematic diagram of group public key application of the present invention;

[0049] Figure 5 It is a node trust update flow chart of the present invention;

[0050] Figure 6 It is a schematic diagram of node management of the present invention;

[0051] Figure 7 It is a schematic diagram of route discovery of the present invention;

[0052] Figure 8 This is a routing diagram of Example 1 provided in the present invention;

[0053] Figure 9 This is a routing diagram of Example 2 provided by the present invention;

[0054] Figure 10 It is a schematic diagram of routing recovery of the present invention. DETAILED DESCRIPTION

[0055] The present invention will be further described below with reference to the accompanying drawings. The following examples are only used to more clearly illustrate the technical solutions of the present invention and are not intended to limit the scope of protection of the present invention. It should be noted that the term "comprising" and any variations thereof in the specification and claims of the present invention and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0056] like Figure 1 As shown, a network security perception system for edge intelligent Internet of Things is configured. The edge intelligent Internet of Things is configured with a network topology structure. The network topology structure includes several network devices (routers, gateways, access points, base stations). The network devices are the nodes of the network topology structure; the network security perception system includes: a trusted group construction module and a routing maintenance module. The routing maintenance module includes a community dynamic self-inspection unit and a routing decision unit.

[0057] 1. Trusted Routing Building Blocks

[0058] The trust level of each node in the network topology is divided by fuzzy theory, and a trustworthy group is constructed based on the result of the level division. The construction of the trustworthy group specifically includes the following steps:

[0059] S1: Define trust levels, including no trust, low trust, preliminary trust, moderate trust, and high trust.

[0060] S2: Based on the initial trust level set for each node, each node is divided into trust levels through fuzzy theory, and untrusted nodes are eliminated to preliminarily build a trusted group.

[0061] By substituting the node trust into the membership function of each trust level set, the membership value of the node to each trust level set can be obtained. Finally, the trust level to which the node belongs is determined according to the maximum membership principle. The trust level division is shown in Table 1.

[0062] Table 1 Trust level classification

[0063] V Trust Level scope <![CDATA[v1]]> Distrust [0,0.2] <![CDATA[v2]]> Low Trust [0.2,0.5] <![CDATA[v3]]> Initial trust [0.5,0.7] <![CDATA[v4]]> Medium Trust [0.7,0.9] <![CDATA[v5]]> High Trust [0.9,1]

[0064] Step S2 specifically includes:

[0065] S21: For the initial trust value x of the node i, obtain the membership of the initial trust value x to each trust level through the set membership function.

[0066] like Figure 2As shown, the curve of the completely untrusted level v1 is highest at 0 and gradually decreases, and is replaced by curve v2 at 0.2. Similarly, at 0.4, 0.6, and 0.8, v3, v4, and v5 replace the previous curve in turn. The formula for obtaining the membership degree of the initial trust value x to each trust level is:

[0067]

[0068]

[0069] Among them, M1(x), M2(x), M3(x), M4(x) and M5(x) are the membership of the initial trust value x to the levels of distrust, low trust, preliminary trust, medium trust and high trust, respectively.

[0070] S22: Calculate the probability distribution value of node i belonging to each trust level according to the following formula;

[0071]

[0072] Among them, m i (M j ) is the node i belongs to the trust level M j The probability distribution value, γ i is the degree to which the initial trust value of node i is supported by other trust levels; n is the total number of trust levels;

[0073] S23: Classify node i into the trust level corresponding to its maximum probability allocation value.

[0074] In the trust hierarchy, high-trust nodes are the most trusted nodes in the network. They typically exhibit very stable and reliable behavior and contribute significantly to the network. These nodes should be prioritized for routing decisions and data transmission. Medium-trust nodes typically exhibit relatively stable and reliable behavior, have no recent history of misconduct, and contribute significantly to the network. These nodes can also be prioritized for routing decisions and data transmission. Initially trusted nodes are typically newly joined trusted groups and have not exhibited malicious behavior. Their trust will gradually increase over time through good performance. Low-trust nodes exhibit some degree of instability or malicious behavior, but have not completely lost their trustworthiness. These nodes can be isolated for routing decisions and data transmission. Untrusted nodes typically exhibit repeated malicious behavior or contribute minimally to the network, making them untrustworthy and should be blocked or removed from the network as soon as possible.

[0075] 2. Community Dynamic Self-Inspection Unit

[0076] Based on the interaction between each node and the set trusted group rules, the trusted group is updated, including: updating the trustworthiness of the nodes and identifying and handling malicious nodes.

[0077] The rules of a trusted group are that individuals in the group should follow the rules set by the community and should not disrupt the normal order of the community for their own interests. If a node violates the rules, it may be punished by the group, such as having its trust value reduced or being excluded from the trusted group. This also helps maintain the stability and healthy development of the group.

[0078] As an alternative, the trusted group rule is:

[0079] Security authentication and authorization: Nodes in the group need to undergo security authentication and authorization, and only authorized nodes can participate in group activities.

[0080] Respect for group interests: Nodes should not act in their own interests, but should prioritize the interests of the entire group. For example, nodes should not attack other group members or interfere with group operations.

[0081] Data privacy protection: Nodes in the group need to protect the data privacy of themselves and other nodes and must not disclose data to unauthorized nodes or third parties.

[0082] Credibility management: Nodes in a group need to participate in group activities based on their own credibility. Nodes with low credibility need to be restricted or excluded from the group.

[0083] Code of Conduct: Nodes should be honest and trustworthy, and should not provide false information or infringe on the rights of other nodes. If a node has any problems or encounters any challenges, it should seek help from group members in a timely manner.

[0084] Reasonable use of resources: Nodes should follow rules for reasonable use of resources, including energy conservation and reducing network bandwidth consumption. Nodes should not over-consume or abuse resources to avoid affecting the operation of the entire group.

[0085] Actively participate in collaboration: Nodes should actively collaborate with other nodes to complete tasks and solve problems. Nodes should not isolate themselves or take independent actions that would affect the efficiency and collaboration of the entire group.

[0086] Collaborative feedback: Nodes should actively cooperate with edge servers to provide collaborative feedback and promptly report any bad behavior of suspicious nodes to ensure the normal operation of the group.

[0087] Penalty mechanism: Nodes that violate the rules will be punished, including restricting their authority, reducing their trust level, and removing them from the group to ensure the security and stability of the group.

[0088] Update the group, including: updating the trust of nodes, identifying and handling malicious nodes.

[0089] I: Update the trust of the node

[0090] like Figure 3 and Figure 5 As shown, specifically: according to the set update cycle, the source node and recommended node of the current node are obtained, the direct trust and recommended trust of the current node are evaluated, and the comprehensive trust of the current node is updated.

[0091] The methods for obtaining source nodes and recommended nodes can refer to existing technologies. The update cycle can be set according to the specific application scenario and network scale. The update cycle should ensure timely updates of trust while avoiding overly frequent updates. Generally, a reasonable update cycle is between a few minutes and a few hours. Specifically, a scheduled task can be created to regularly trigger trust updates. For example, a cron expression can be used to define the execution time of a scheduled task to automatically perform updates at regular intervals.

[0092] The calculation formula for direct trust is:

[0093]

[0094] in, is the direct trust value of source node j to current node i at time t, τ k (i, j) is the score of the result of the interaction between source node j and current node i in the kth time, which usually ranges from 0 to 1, with 1 indicating complete satisfaction. It is determined by the difference between the amount of data transmitted by the source node received by the target node and the set value, as well as other factors related to the quality of data transmission. For details, please refer to the influencing factors of the existing technology; K is the total number of interactions, ω k is the weight coefficient corresponding to the kth interaction.

[0095] The calculation formula for recommendation trust is:

[0096]

[0097] in, is the recommendation trust of all recommendation nodes to the current node i at time t, is the recommendation trust value of the qth recommendation node to the current node i at time t, w q is the weight of the recommendation trust value corresponding to the qth recommendation node;

[0098] The comprehensive trust of the current node i is T i for:

[0099]

[0100] Among them, ω1 and ω2 are the weights of direct trust and recommendation trust, respectively.

[0101] Furthermore, in this embodiment, before obtaining the recommendation trust of all recommendation nodes for the current node i, a similarity algorithm is used to perform a similarity analysis on the recommendation trust value of each recommendation node. When the similarity of the recommendation node is less than the set threshold, the recommendation trust value of the current recommendation node is punished. The similarity algorithm can refer to the existing technology, and of course the K-means clustering algorithm can also be used to screen out suspicious malicious recommendation behaviors.

[0102] Punish the recommendation trust value of the current recommendation node, specifically:

[0103]

[0104] in, is the recommendation trust value after punishment; β is the punishment coefficient, which is related to The penalty coefficient corresponding to the level is optional, as shown in Table 2:

[0105] Table 2 Penalty coefficients

[0106]

[0107]

[0108] II: Identifying and handling malicious nodes

[0109] like Figure 6 As shown in the figure, specifically: the updated comprehensive trust of the node is obtained in real time. If the comprehensive trust of the node is at the untrusted trust level, the current node is a malicious node, and the malicious node is removed from the trusted group and added to the blacklist. When a node enters the blacklist, all communications and routing related to the malicious node are suspended, and the group public key is updated and broadcast to all nodes in the trusted group.

[0110] Malicious nodes in edge networks can disrupt normal operations through denial of service attacks, spoofing, data tampering, malicious recommendations, and other malicious behaviors, significantly impacting network security and performance. After remote or on-site repairs by engineering personnel, these malicious nodes are re-established as trusted groups and assigned a preliminary trust level.

[0111] It is worth noting that this application uses asymmetric encryption to ensure the overall security of the community. In the construction of a trusted group, the edge server will issue a group public key and a group signature key to all members, so that each node can use the public key to encrypt the data and generate a data signature when transmitting data to other nodes or servers. The forwarding node or edge server will use the group public key to verify the signature of the data. If the data signature verification fails, the data can be rejected. Since all nodes only have public keys and no corresponding private keys, even if a malicious node obtains the encrypted data, it cannot decrypt the information in it. Only the edge server has the private key and can decrypt the encrypted data. This encryption method can ensure the confidentiality and integrity of the data and prevent the data from being stolen and tampered with by hackers.

[0112] like Figure 4 As shown in Figure 1, when a member leaves a group, the edge server needs to update the group public key and group signature key accordingly to maintain the security and integrity of the group. When a new member joins, the edge server distributes the group signature key to that member. This key can only be used by group members and can only be used to generate group signatures. This ensures that only trusted members can generate signatures for the group, and that others cannot impersonate members. When an old member leaves, the edge server generates a new group public key and broadcasts it to all group members. This allows group members to use the same group public key to verify signatures generated by any other group member using the group signature key.

[0113] In some other embodiments, such as Figure 6 As shown, updating the trusted group also includes isolating nodes with low trust levels and suspending all communications and routing of low trust nodes. When a node is isolated, the stability of the isolated node signal is continuously monitored and its trust is continuously updated. If the trust of the isolated node increases, or the stability of its signal meets the set time requirement, the isolated node is released from isolation, and the trust level of the isolated node that meets the stability requirement is updated to the preliminary trust level.

[0114] A low trust level does not necessarily mean a node is malicious. A node's trust level can drop for legitimate reasons, such as signal interference. When a node sends data, data packet transmission may fail due to signal weakening, multipath effects, and other factors. Over time, this can cause the node's trust level to drop to low. Furthermore, a node's trust level may drop temporarily, such as a low battery, causing unstable data transmission or even shutting down. After a period of time, when the battery is fully restored, the node can resume normal operation. Therefore, it is important to ensure that the removal of malicious nodes does not accidentally harm innocent nodes, thereby impacting network operation. To address this, an isolation zone can be established within the trusted group to isolate such nodes. Nodes in this isolation zone can only transmit their own data as edge devices, limiting their recommended behavior as neighbor nodes and their transmission behavior as routing intermediate nodes.

[0115] For example, within a trusted group, if the nearby signal environment is poor, this node is unsuitable as an intermediate node for data transmission. Even if the node does not actively engage in malicious behavior, the eventual result will be data transmission failure, impacting the normal operation of the edge network. If the signal near a node is relatively stable, signal interference is only an isolated incident and its trustworthiness will not change significantly. Therefore, nodes with good behavior but unstable signals are placed in a quarantine zone. In this quarantine zone, the edge server will conduct regular checks on them. When the signal is stable for a long period of time, the node is re-added to the trusted group and a preliminary trust level is assigned.

[0116] Low node power is a common problem in edge networks. When a node's battery level drops below a certain threshold, it may malfunction or experience anomalies during operation. After a period of time, when the battery level is restored, the node can resume normal operation. A healthy node, if its trustworthiness is reduced solely due to low battery, will not engage in malicious behavior such as false recommendations or scams. Therefore, nodes with good behavior but low battery levels are placed in a quarantine zone. Within this quarantine zone, the edge server regularly checks the node. Once the battery level is restored, the node is reinstated into the trusted group and assigned a preliminary trust level.

[0117] 3. Routing Decision Unit

[0118] After the node initiates route discovery, route selection is performed; in addition, during the routing process, if a node fails or leaves the trusted group, route recovery is performed.

[0119] 1. Route discovery:

[0120] Route discovery means that when a node needs to transmit information to another node in the network, if there is no route to the target node, it must first send a multicast request message. The request is forwarded by neighboring nodes to find a route to the target node. This means that nodes only perform routing actions when they need to discover or verify routing paths to other nodes. This greatly improves the efficiency of the routing process.

[0121] When the source node needs to upload data, but it does not obtain the correct routing entry to the edge server, the routing discovery mechanism will be triggered to find the corresponding route by broadcasting the routing request message to the neighboring nodes. The request message contains the address information, serial number, lifetime and other information of the source node and destination node. When the routing request is forwarded to the next node, this node will determine whether it has a route to the destination node based on its own routing table and the information of the neighboring nodes. If not, it will forward the routing request message until it reaches the destination node or a node replies with a routing response message. The routing discovery working diagram is as follows Figure 7 shown.

[0122] The route discovery process is as follows:

[0123] Step 1: The source node (initiator) broadcasts a Request message to all its neighbors.

[0124] Step 2: Each time a neighbor receives a Request, it checks its routing table to see if it contains a route entry for the destination.

[0125] Step 3: If not, the neighbor node broadcasts the routing request to the neighbor node again and continues to execute step 1.

[0126] Step 4: If any node that receives the Request (routing request) has a sufficiently stable route to satisfy the request, the node sends the request message to the edge server in unicast form along this route.

[0127] Step 5: During the lifetime of the routing request, the edge server will receive multiple requests from the source node. Then, after calculating the trust of the routing paths and making routing decisions, the multiple routing paths will be sorted. The first one will be used directly, and the rest will be used as candidate routes. Finally, the result will be returned to the source node through the response according to the first sequence route.

[0128] Step 6: After receiving the Response (route reply), the source node returns a Response (confirmation reply) based on the route, completing the route discovery. If the edge server does not receive the Response (confirmation reply) within the specified time, it will continue to send the Response (route reply).

[0129] 2. Routing priority calculation:

[0130] In edge computing networks, due to the dynamic and uncertain nature of network topology, routing often requires multiple hops through intermediate nodes, posing challenges to routing reliability and security. Therefore, when selecting routes, it's important to consider the trust level of each route, restricting routing to nodes with trust levels above a certain threshold and prioritizing routes with high trust levels to ensure reliable routing. Furthermore, the number of hops is a crucial factor in evaluating route quality. As the number of hops increases, network transmission latency and energy consumption also increase, reducing network performance and efficiency. Therefore, to achieve optimal routing, it's necessary to comprehensively consider factors such as trust value and hop count to achieve the best possible route selection.

[0131] By classifying node trust levels, we can represent the trust between nodes using five levels. In the path trust calculation, high-trust nodes are the most trusted nodes in the network and generally exhibit very stable and reliable behavior. We assign them a priority of p = 0.9. Medium-trust nodes generally exhibit relatively stable and reliable behavior and have not recently exhibited bad behavior. We assign them a priority of p = 0.8. Although preliminary-trust nodes do not have malicious behavior, they have just joined the trusted group and it is uncertain whether they are disguised, so we assign them a priority of p = 0.7. Low-trust nodes exhibit some degree of instability or malicious behavior, but have not completely lost trust. Therefore, they are assigned a priority of p = 0.5, significantly reducing their path selection priority.

[0132] Assume that there are a routing paths between source node i and edge server, where the i-th path has K nodes, then there exists a path set R = {r1, r2, ..., r a}, the priority P corresponding to the i-th path i It can be represented by the product of the priorities of the nodes along the path. This not only measures the level of trust but also reflects the impact of hop count on priority. The calculation method for route priority is as follows.

[0133] P i =∏p mn {m→n(m,n∈K)}

[0134] Among them, p mnIndicates the priority between nodes m and n in the i-th path. Figure 8 As shown in Example 1, there are four routing paths between source node 1 and edge server 7: r1 (1→2→5→7), r2 (1→2→4→7), r3 (1→3→4→7), and r4 (1→3→6→7). Source node 1 has high and low trust levels for neighbor nodes 2 and 3, respectively, with corresponding priorities of 0.9 and 0.5; node 2 has medium and high trust levels for neighbor nodes 4 and 5, respectively, with corresponding priorities of 0.8 and 0.9; node 3 has preliminary trust levels for neighbor nodes 4 and 6, respectively, with corresponding priorities of 0.7 and 0.9. According to the formula, the priorities of the four paths are: P1 = 0.81, P2 = 0.72, P3 = 0.35, and P4 = 0.45, i.e., P1 > P2 > P4 > P3.

[0135] 3. Routing selection:

[0136] When a source node initiates route discovery, the edge server receives multiple requests from the source node. The edge server determines the priority of each route using a route priority calculation scheme. However, not all available routes can be used. To ensure reliable data transmission, we need to eliminate unstable or insecure routes. The route decision scheme is how the edge server selects the best route among multiple available routes.

[0137] Define routing decision rules:

[0138] Rule 1: Set a routing priority threshold. When the routing priority is lower than 0.25, it indicates that there are multiple low-trust nodes in the route or the routing link is too long. The lower the routing priority, the lower the security and stability of the route, and the greater the risk to the edge computing network, so it is not considered.

[0139] Rule 2: When selecting a route, select the route with the highest priority as the route to send the source node data.

[0140] Rule 3: Among all routing paths, if there is a routing path with the same and highest priority, then the routing hop count is used as the routing selection basis. The path with fewer hops is more suitable as a data forwarding path, with lower energy consumption and latency, and lower risk of data leakage.

[0141] Rule 4: Among all routing paths, if there is a routing path with the same and maximum path priority and the same number of routing hops, then the number of nodes with the corresponding trust level is used as the judgment basis. The more nodes with high trust levels, the more reliable the route. Conversely, the more nodes with low trust levels, the less reliable the route.

[0142] Rule 5: After determining the direct route, consider the remaining routes as alternative routes.

[0143] like Figure 9 As shown in Example 2, there are six routing paths between source node 1 and edge server 9: r1 (1→2→5→7→9), r2 (1→2→4→5→7→9), r3 (1→2→4→6→8→9), r4 (1→3→4→5→7→9), r5 (1→3→4→6→8→9), and r6 (1→3→6→8→9). Among them, route r1 has the highest priority and will be used as the direct route. Of the other routes, only r2 and r3 meet the routing decision rules and can be used as backup routes. Since r4, r5, and r6 have priorities below 0.25, they are discarded and not considered as backup routes.

[0144] 4. Route recovery:

[0145] like Figure 10 As shown in Figure 1, when certain nodes fail or are kicked out of the trusted group, their routing links may be affected. This may cause the routing links of certain nodes to become abnormal or disconnected, thus affecting the normal communication of the network. To cope with this situation and ensure the normal communication of edge network nodes, a link recovery mechanism is proposed. When a link failure occurs, the node can automatically or semi-automatically adjust the route and restore the link to ensure the normal operation of the network.

[0146] Specifically, when a node fails or leaves the trusted group, it continuously sends heartbeat packets to the optimal routing link affected by the node. If the edge server receives the heartbeat packet, the optimal routing link is restored to normal. If the edge server does not receive the heartbeat packet communicated via the optimal routing link, it sends a heartbeat packet to the alternative route stored during the route selection process. If the link of the alternative route is receiving normally, the optimal alternative route is selected for use. When the optimal routing link is restored to normal, the optimal routing link is switched to the active route. If the edge server does not receive the heartbeat packet communicated via the optimal routing link within the set time, it reselects the route.

[0147] Sending heartbeat packets lets a peer know of their presence and allows them to detect failures or network anomalies. If a heartbeat packet is received, the peer's connection is considered normal. If not, appropriate measures must be taken, such as reestablishing the connection or switching links. In dynamic network environments such as mobile ad hoc networks, routing links may experience anomalies due to node failures, disrupting normal network communication and requiring continuous updating and maintenance of routing information. To detect these anomalies, heartbeat packets must be sent periodically to monitor the status of routing links.

[0148] Edge network nodes typically store multiple routing entries in their routing tables. To monitor routing communication status, the source node periodically sends heartbeat packets to the edge server using the routing information in the routing table to determine route viability. During the heartbeat packet transmission process, if the source node does not receive an acknowledgment message from the edge server within a specified time, it will attempt to repeat the heartbeat message. For example, if no acknowledgment message is received three times in a row, it indicates that the link has been interrupted for an unknown reason, triggering the link recovery mechanism.

[0149] All edge network node routing tables typically store multiple routing entries, including the active route and multiple alternative routes. The active route is the route currently selected for data transmission, while the alternative route is an alternative path that can be selected if the current route is unavailable. The heartbeat mechanism ensures that all routes in the source node's routing table are surviving routes. If the currently active route sends heartbeat packets multiple times without receiving an acknowledgment, it indicates that the current routing link has failed. In this case, the source node will attempt to perform local link recovery, selecting the first route in the sequence of surviving alternative routes as the active route.

[0150] When a source node experiences a routing failure and all routes in the node's routing table have expired, local link recovery fails and the source node loses contact with the edge server. The source node then needs to recover the entire link, rediscovering routes and broadcasting routing requests to neighboring nodes via multicast. The edge server then determines the new active and alternate routes and transmits them back to the source node via their respective routing paths. Upon receiving these, the source node transmits data using the new routing table, restoring the entire link.

[0151] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. Those skilled in the art can clearly understand that the technology in the embodiments of the present invention can be implemented by means of software plus the necessary general hardware platform. Based on this understanding, the technical solutions in the embodiments of the present invention are essentially or the part that contributes to the prior art can be embodied in the form of a software product. The computer software product can be stored in a storage medium, such as ROM / RAM, a disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present invention or certain parts of the embodiments.

[0152] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions based on the principles of the present invention are within the scope of protection of the present invention. It should be noted that for those skilled in the art, various improvements and modifications that do not depart from the principles of the present invention should be considered within the scope of protection of the present invention.

Claims

1. A network security perception system for edge intelligent Internet of Things, wherein the edge intelligent Internet of Things is configured with a network topology structure, characterized in that: include: A trusted group building module and a routing maintenance module, wherein the routing maintenance module includes a community dynamic self-checking unit and a routing decision unit; Trusted routing construction module: Use fuzzy theory to classify the trust levels of each node in the network topology and build trusted groups based on the classification results; Community dynamic self-check unit: Updates the trusted group based on the interaction between each node and the set trusted group rules, including: updating the trustworthiness of nodes and identifying and handling malicious nodes; Routing decision unit: After the node initiates route discovery, it performs route selection; in addition, during the routing process, if a node fails or leaves the trusted group, it performs route recovery.

2. The network security perception system for edge intelligent Internet of Things according to claim 1 is characterized in that: The trust level classification of each node in the network topology structure by fuzzy theory and the construction of a trustworthy group based on the level classification results are specifically as follows: Define levels of trust, including no trust, low trust, preliminary trust, moderate trust, and high trust; Based on the initial trust level set for each node, each node is divided into trust levels through fuzzy theory, and then the untrusted nodes are eliminated to preliminarily build a trusted group.

3. The network security perception system for edge intelligent Internet of Things according to claim 2 is characterized in that: The trust level of each node is divided by fuzzy theory, specifically: For the initial trust value x of node i, the membership of the initial trust value x to each trust level is obtained through the set membership function; According to the following formula, the probability distribution value of node i belonging to each trust level is calculated, and node i is divided into the trust level corresponding to its maximum probability distribution value; Among them, m i (M j ) is the node i belongs to the trust level M j The probability distribution value, γ i is the degree to which the initial trust value of node i is supported by other trust levels; n is the total number of trust levels.

4. The network security perception system for edge intelligent Internet of Things according to claim 3 is characterized in that: The formula for obtaining the membership degree of the initial trust value x to each trust level is: Among them, M1(x), M2(x), M3(x), M4(x) and M5(x) are the membership of the initial trust value x to the levels of distrust, low trust, preliminary trust, medium trust and high trust, respectively.

5. The network security perception system for edge intelligent Internet of Things according to claim 1 is characterized in that: The updating of the trustworthiness of the node is specifically as follows: According to the set update cycle, obtain the source node and recommended node of the current node, evaluate the direct trust and recommended trust of the current node, and update the comprehensive trust of the current node; The calculation formula of the direct trust degree is: in, is the direct trust value of source node j to current node i at time t, τ k (i, j) is the score of the result of the k-th interaction between the source node j and the current node i, which usually ranges from 0 to 1, with 1 indicating complete satisfaction; K is the total number of interactions, ω k is the weight coefficient corresponding to the kth interaction; The calculation formula of the recommendation confidence is: in, is the recommendation trust of all recommendation nodes to the current node i at time t, is the recommendation trust value of the qth recommendation node to the current node i at time t, w q is the weight of the recommendation trust value corresponding to the qth recommendation node; The comprehensive trust degree T of the current node i i for: Among them, ω1 and ω2 are the weights of direct trust and recommendation trust, respectively.

6. The network security perception system for edge intelligent Internet of Things according to claim 5 is characterized in that: Before obtaining the recommendation trust of all recommendation nodes for the current node i, a similarity algorithm is used to perform similarity analysis on the recommendation trust values ​​of each recommendation node. When the similarity of the recommendation nodes is less than the set threshold, the recommendation trust value of the current recommendation node is penalized.

7. The network security perception system for edge intelligent Internet of Things according to claim 6 is characterized in that: The penalty for the recommendation trust value of the current recommendation node is as follows: in, is the recommendation trust value after punishment; β is the punishment coefficient, which is related to Corresponding to the level.

8. The network security perception system for edge intelligent Internet of Things according to claim 1 is characterized in that: The identification and processing of malicious nodes is specifically as follows: obtaining the updated comprehensive trust of the node in real time; if the comprehensive trust of the node is at a trust level of distrust, the current node is a malicious node, and the malicious node is removed from the trusted group and added to a blacklist; when a node enters the blacklist, all communications and routing related to the node are suspended, and after the group public key is updated, it is broadcast to all nodes in the trusted group.

9. The network security perception system for edge intelligent Internet of Things according to claim 2 is characterized in that: The updating of the trusted group also includes isolating nodes with low trust levels and suspending all communications and routing of low trust nodes; when the node is isolated, the stability of the isolated node signal is continuously monitored and its trust is continuously updated. If the trust of the isolated node increases, or the stability of its signal meets the set time requirement, the isolated node is released from isolation, and the trust level of the isolated node that meets the stability requirements is updated to the preliminary trust level.

10. The network security perception system for edge intelligent Internet of Things according to claim 2 is characterized in that: The route restoration specifically includes: When a node fails or leaves the trusted group, it continuously sends heartbeat packets to the optimal routing link affected by the node. If the edge server receives the heartbeat packet, the optimal routing link returns to normal. If the edge server does not receive the heartbeat packet communicated through the optimal routing link, it sends a heartbeat packet to the alternative route stored in the routing selection process. If the link of the alternative route is in normal reception, the optimal alternative route is selected for use. When the optimal routing link returns to normal, the optimal routing link is switched as the used route. If the edge server does not receive the heartbeat packet communicated through the optimal routing link within the set time, it will re-select the route.

Images