Method, device and equipment for malicious node detection of underwater acoustic sensor network

Abstract

The application relates to a malicious node detection method, device and equipment for an underwater acoustic sensor network. The method comprises the following steps: obtaining node behaviors of a target neighbor node under different channel states in a preset detection time window; determining a current trust degree of the target neighbor node according to the node behaviors and a trust model, wherein the trust model is determined according to a subjective logic framework and an implicit Markov model, the subjective logic framework is used for determining a viewpoint parameter according to the node behaviors and determining the trust degree of the target neighbor node according to the viewpoint parameter, the viewpoint parameter comprises a belief parameter, a disbelief parameter and an uncertainty parameter, and the implicit Markov model is used for describing a channel state transition process; and determining whether the target neighbor node is a malicious node according to the current trust degree. The method can improve the accuracy of malicious node detection.

Description

Technical Field

[0001] This application relates to the field of underwater acoustic sensor network security technology, and in particular to a method, apparatus and device for detecting malicious nodes in an underwater acoustic sensor network. Background Technology

[0002] In recent years, Underwater Acoustic Sensor Networks (UASNs) have been increasingly used in marine monitoring, resource exploration, emergency rescue and other fields. However, the acoustic channel is unstable and the open transmission of signals makes it susceptible to noise interference and attacks from other malicious devices. Therefore, it is urgent to accurately detect malicious nodes in underwater acoustic sensor networks in order to ensure secure communication of underwater wireless networks.

[0003] In existing technologies, reputation-based trust mechanisms can detect potential malicious nodes by defining correct and inappropriate behaviors and monitoring the data transmission behavior of other neighboring nodes. However, due to the instability of underwater acoustic channels, the accuracy of existing technologies in detecting malicious nodes needs improvement. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, apparatus, and device for detecting malicious nodes in underwater acoustic sensor networks that can accurately detect malicious nodes, addressing the aforementioned technical problems.

[0005] In a first aspect, this application provides a method for detecting malicious nodes in an underwater acoustic sensor network, applicable to any node in the sensor network, the method comprising:

[0006] Within a preset detection time window, the node behavior of the target neighbor node under different channel states is acquired;

[0007] The current trust level of the target neighbor node is determined based on node behavior and the trust model. The trust model is determined based on a subjective logic framework and an implicit Markov model. The subjective logic framework is used to determine the viewpoint parameters based on node behavior and to determine the trust level of the target neighbor node based on the viewpoint parameters. The viewpoint parameters include the believe parameter, the disbelief parameter, and the uncertain parameter. The implicit Markov model is used to describe the channel state transition process.

[0008] Determine whether the target neighbor node is a malicious node based on the current trust level.

[0009] In one embodiment, determining whether a target neighbor node is a malicious node based on the current trust level includes:

[0010] If the current detection time window is not the first detection time window, the current trust level is updated based on the historical trust level of the target neighbor nodes;

[0011] Based on the updated trust level of the target neighbor node, determine whether the target neighbor node is a malicious node.

[0012] In one embodiment, the channel state includes a high channel quality state and a low channel quality state. Determining the current trust level of the target neighbor node based on node behavior and a trust model includes:

[0013] The number of erroneous behaviors of the target neighbor node in high channel quality state and low channel quality state is determined based on the node behavior. Erroneous behavior indicates that the target neighbor node did not forward the data packet normally.

[0014] When the number of erroneous behaviors under high channel quality conditions satisfies the first condition in the trust model, the current trust level of the target neighbor node is determined to be 1. The first condition is that the sum of the square of the number of erroneous behaviors under high channel quality conditions and the first product of the first parameter, the second product of the number of erroneous behaviors under high channel quality conditions and the second parameter, and the third parameter is less than 0. The first parameter is determined based on the number of behaviors of the target neighbor node under high channel quality conditions, the second parameter is determined based on the number of behaviors of the target neighbor node under high channel quality conditions, the probability of occurrence of erroneous behaviors under low channel quality conditions, and the number of erroneous behaviors under low channel quality conditions, and the third parameter is a preset fixed parameter.

[0015] When the number of erroneous behaviors under high channel quality and the number of erroneous behaviors under low channel quality satisfy the second condition in the trust model, the current trust level of the target neighbor node is determined to be 0. The second condition is that the number of erroneous behaviors under high channel quality is less than the fourth parameter, and the fourth parameter is determined based on the number of erroneous behaviors under low channel quality.

[0016] In one embodiment, determining the number of erroneous behaviors of the target neighbor node in both high-channel-quality and low-channel-quality states based on node behavior includes:

[0017] The number of initial erroneous actions and the number of initial correct actions of neighboring nodes are determined based on node behavior in high channel quality state and low channel quality state, respectively.

[0018] The number of erroneous behaviors of the target neighbor node in the high-channel-quality state is determined by the product of the first erroneous behavior probability and the number of initial correct behaviors in the high-channel-quality state and the sum of the number of initial erroneous behaviors in the high-channel-quality state. The first erroneous behavior probability is determined based on the preset malicious node attack strength and the first successful transmission probability.

[0019] The number of erroneous behaviors of the target neighbor node in the low-channel-quality state is determined by the product of the second erroneous behavior probability and the number of initial correct behaviors in the low-channel-quality state and the sum of the number of initial erroneous behaviors in the low-channel-quality state; the second erroneous behavior probability is determined based on the preset malicious node attack strength and the second successful transmission probability.

[0020] In one embodiment, updating the current trust level based on the historical trust level of the target neighbor node includes:

[0021] Obtain the decay factor corresponding to each trust level. The decay factor is used to represent the degree of influence of historical trust level on current trust level. Trust level includes historical trust level and current trust level.

[0022] The first confidence level parameter is determined by summing the products of each historical confidence level and its corresponding decay factor.

[0023] The second confidence level parameter is determined based on the difference between the current confidence level and the product of the current confidence level and the corresponding decay factor.

[0024] The updated trust level is determined based on the sum of the first trust level parameter and the second trust level parameter.

[0025] In one embodiment, each node in the sensor network moves with the ocean current field, and the target neighbor nodes include long-term neighbor nodes, old node return nodes, and new neighbor nodes. When the target neighbor node is a long-term neighbor node, the decay factor corresponding to each trust level is related to the number of historical detections. When the target neighbor node is an old node return node, the decay factor corresponding to each trust level is related to the number of historical detections and the familiarity factor, which is determined based on the communication time between the target neighbor node and the node before the return node. When the target neighbor node is a new neighbor node, and the historical trust level of the target neighbor node is not included in the trusted node record, the decay factor is a preset decay value.

[0026] Secondly, this application also provides a malicious node detection device for underwater acoustic sensor networks, which is installed in any node of the sensor network. The device includes:

[0027] The acquisition module is used to acquire the node behavior of the target neighbor node under different channel states within a preset detection time window;

[0028] The first determination module is used to determine the current trust level of the target neighbor node based on node behavior and the trust model. The trust model is determined based on the subjective logic framework and the hidden Markov model. The subjective logic framework is used to determine the viewpoint parameters based on node behavior and to determine the trust level of the target neighbor node based on the viewpoint parameters. The viewpoint parameters include the believe parameter, the disbelief parameter, and the uncertain parameter. The hidden Markov model is used to describe the channel state transition process.

[0029] The second determination module determines whether the target neighbor node is a malicious node based on the current trust level.

[0030] In one embodiment, the second determining module is specifically used to update the current trust level based on the historical trust level of the target neighbor node when the current detection time window is not the first detection time window; and to determine whether the target neighbor node is a malicious node based on the updated trust level of the target neighbor node.

[0031] In one embodiment, the channel state includes a high channel quality state and a low channel quality state. The first determining module is specifically used to determine the number of erroneous behaviors of the target neighbor node in the high channel quality state and the low channel quality state, respectively, based on node behavior. An erroneous behavior indicates that the target neighbor node did not forward data packets normally. When the number of erroneous behaviors in the high channel quality state satisfies the first condition in the trust model, the current trust level of the target neighbor node is 1. The first condition is that the sum of the square of the number of erroneous behaviors in the high channel quality state multiplied by the first parameter, the second product of the number of erroneous behaviors in the high channel quality state multiplied by the second parameter, and the third parameter is less than 0. The first parameter is determined based on the number of behaviors of the target neighbor node in the high channel quality state. The second parameter is determined based on the number of behaviors of the target neighbor node in the high channel quality state, the probability of erroneous behavior occurring in the low channel quality state, and the number of erroneous behaviors in the low channel quality state. The third parameter is a preset fixed parameter. When the number of erroneous behaviors in the high channel quality state and the number of erroneous behaviors in the low channel quality state satisfy the second condition in the trust model, the current trust level of the target neighbor node is 0. The second condition is that the number of erroneous behaviors in the high channel quality state is less than the fourth parameter, which is determined based on the number of erroneous behaviors in the low channel quality state.

[0032] In one embodiment, the first determining module is specifically configured to determine the number of initial erroneous behaviors and the number of initial correct behaviors of neighboring nodes in high channel quality state and low channel quality state, respectively, based on node behavior; determine the number of erroneous behaviors of the target neighboring node in high channel quality state based on the product of a first erroneous behavior probability and the number of initial correct behaviors in high channel quality state and the sum of the number of initial erroneous behaviors in high channel quality state, wherein the first erroneous behavior probability is determined based on a preset malicious node attack strength and a first successful transmission probability; and determine the number of erroneous behaviors of the target neighboring node in low channel quality state based on the product of a second erroneous behavior probability and the number of initial correct behaviors in low channel quality state and the sum of the number of initial erroneous behaviors in low channel quality state, wherein the second erroneous behavior probability is determined based on a preset malicious node attack strength and a second successful transmission probability.

[0033] In one embodiment, the second determining module is specifically used to obtain the attenuation factor corresponding to each trust level, the attenuation factor being used to represent the degree of influence of historical trust levels on the current trust level, and the trust level including historical trust level and current trust level; determine the first trust level parameter based on the sum of the products of each historical trust level and the corresponding attenuation factor; determine the second trust level parameter based on the difference between the current trust level and the product of the current trust level and the corresponding attenuation factor; and determine the updated trust level based on the sum of the first trust level parameter and the second trust level parameter.

[0034] In one embodiment, each node in the sensor network moves with the ocean current field, and the target neighbor nodes include long-term neighbor nodes, old node return nodes, and new neighbor nodes. When the target neighbor node is a long-term neighbor node, the decay factor corresponding to each trust level is related to the number of historical detections. When the target neighbor node is an old node return node, the decay factor corresponding to each trust level is related to the number of historical detections and the familiarity factor, which is determined based on the communication time between the target neighbor node and the node before the return node. When the target neighbor node is a new neighbor node, and the historical trust level of the target neighbor node is not included in the trusted node record, the decay factor is a preset decay value.

[0035] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement any of the methods described in the first aspect above.

[0036] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the methods described in the first aspect above.

[0037] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements any of the methods described in the first aspect above.

[0038] The aforementioned method, apparatus, and device for detecting malicious nodes in underwater acoustic sensor networks acquire the node behavior of target neighbor nodes under different channel states within a preset detection time window. Then, based on the node behavior and a trust model, the current trust level of the target neighbor node is determined. The trust model is determined using a subjective logic framework and a hidden Markov model. The subjective logic framework is used to determine viewpoint parameters based on node behavior, and the viewpoint parameters are used to determine the trust level of the target neighbor node. Viewpoint parameters include believe parameters, disbelieve parameters, and uncertain parameters. The hidden Markov model is used to describe the channel state transition process. Finally, the current trust level is used to determine whether the target neighbor node is a malicious node. When determining the current trust level of the target neighbor node, the forwarding behavior of the target neighbor node under different channel states is fully considered, i.e., the instability of the underwater acoustic channel is taken into account. Therefore, when detecting malicious nodes based on the current trust level, the accuracy of malicious node detection can be effectively improved. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a schematic diagram of a sensor network in one embodiment;

[0041] Figure 2 This is a flowchart illustrating a method for detecting malicious nodes in an underwater acoustic sensor network in one embodiment.

[0042] Figure 3 This is a flowchart illustrating the steps for determining the current trust level of a target neighbor node in one embodiment.

[0043] Figure 4 This is a flowchart illustrating the steps for determining the number of erroneous behaviors of a target neighbor node in one embodiment;

[0044] Figure 5 This is a flowchart illustrating the steps for determining whether a target neighbor node is a malicious node in one embodiment.

[0045] Figure 6 This is a flowchart illustrating the steps for updating the current trust level in one embodiment;

[0046] Figure 7 This is a flowchart illustrating a malicious node detection method for an underwater acoustic sensor network in another embodiment;

[0047] Figure 8This is a schematic diagram of the simulation results in one embodiment;

[0048] Figure 9 This is a schematic diagram of simulation results in another embodiment;

[0049] Figure 10 This is a schematic diagram of simulation results in another embodiment;

[0050] Figure 11 This is a structural block diagram of a malicious node detection device for an underwater acoustic sensor network in one embodiment.

[0051] Figure 12 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0053] In recent years, Underwater Acoustic Sensor Networks (UASNs) have been increasingly widely used in marine monitoring, resource exploration, and emergency rescue. With the development of underwater unmanned vehicles and advanced sensors, they have become a research hotspot. However, the unstable acoustic channels and the open transmission of signals make them vulnerable to noise interference and attacks from other malicious devices. Therefore, ensuring secure communication in underwater wireless networks is an urgent need.

[0054] Current technologies for underwater wireless network security still have many shortcomings. On the one hand, due to the difference in propagation media, mature terrestrial wireless network security strategies are difficult to directly apply to underwater environments. For example, terrestrial wireless networks typically use methods based on packet generation timestamps to detect replay attacks and ensure communication security. However, in the narrow, low-speed underwater channels, the additional communication overhead and redundant packets make this method difficult to apply. On the other hand, due to the dynamic nature of the marine environment, underwater nodes frequently move with ocean currents, rendering the traditional fixed-node topology model of terrestrial networks unsuitable.

[0055] Currently, several methods focusing on trust mechanisms have been studied in underwater network security. Reputation-based trust mechanisms can identify potential malicious nodes by defining correct and inappropriate behaviors and monitoring the data transmission behavior of other neighboring nodes, thereby defending against various attack patterns. The Distributed Reputation-Based Sensor Network (RFSN) framework was the first trust mechanism proposed for wireless sensor networks, evaluating reputation values ​​by calculating the amount of cooperative and non-cooperative communication between nodes. Subsequently, the watchdog-based ad-hoc on-demand distance vector (AODV) protocol and its extended version, trusted AODV (TAODV), have been used in terrestrial mobile networks to measure node trust by monitoring the long-term interaction behavior of neighboring nodes. However, the instability of underwater acoustic channels renders these methods unsuitable, as they do not consider the variable state of the channel. The accuracy of these methods in detecting malicious nodes needs improvement.

[0056] In view of this, this application provides a method for detecting malicious nodes in underwater acoustic sensor networks that can accurately detect malicious nodes. The method for detecting malicious nodes in underwater acoustic sensor networks provided in this application can be applied to, for example... Figure 1 The diagram illustrates an underwater acoustic wireless sensor network scenario. This network comprises multiple randomly distributed small sensor nodes that perform long-term underwater information monitoring tasks and transmit data packets back to an autonomous underwater vehicle (AUV) within a defined area. However, the network may contain malicious nodes. Figure 1 In the diagram, malicious nodes are represented in red, and normal nodes in green. They hinder inter-node communication by intercepting or improperly forwarding data packets. It is assumed that all underwater nodes have the same capabilities (communication, computation) and resources (energy storage, information capacity) in their initial state. The nodes form a multi-hop network; therefore, they can only communicate and probe each other when adjacent nodes move within each other's reachable range. Non-adjacent nodes rely on relays from other nodes.

[0057] Furthermore, due to the instability of the underwater acoustic channel, both channel fluctuations and attacks from malicious nodes can deteriorate the channel state between adjacent nodes. Given the dynamic nature of the marine environment, fixed node topologies are clearly unsuitable. Considering the characteristics of stratified rotating fluids in the ocean, this application employs a Meandering Current Mobility (MCM) model to describe the motion of nodes with the ocean current field, where the vertical motion of the fluid is negligible compared to the horizontal motion. Stream functions are used... The two-dimensional non-divergent velocity field components in the tangential and radial directions can be calculated, i.e. and Therefore, the trajectory of the node in the ocean current is determined by the Hamiltonian ordinary differential equation. and The solution.

[0058] In one exemplary embodiment, such as Figure 2 As shown, a method for detecting malicious nodes in an underwater acoustic sensor network is provided, and this method is applied to... Figure 1 Taking any node in the sensor network as an example, the explanation includes the following steps 201 to 203. Wherein:

[0059] Step 201: Within the preset detection time window, obtain the node behavior of the target neighbor node under different channel states.

[0060] Optionally, the detection time window can be preset, and any node in the sensor network can monitor the node behavior of its neighboring nodes within a detection time window.

[0061] Among them, a neighbor node can be any other node within a node's communication range, and the target neighbor node can be any one of the neighbor nodes.

[0062] In underwater wireless networks, data transmission between nodes is typically not direct, but rather requires forwarding through multiple intermediate nodes according to a pre-defined routing protocol. When a node forwards a target data packet, this behavior will be detected by all neighboring nodes within its communication range. Therefore, nodes can identify potential malicious nodes by acquiring the node behavior of each neighboring node within their communication range. Simultaneously, due to the instability of the underwater acoustic channel, the transmission performance between any two nodes can change drastically within a short period; in other words, the channel state may change multiple times within a detection time window. The channel state can include high channel quality and low channel quality states, corresponding to the initial data velocity, respectively. The channel state can be determined based on parameters such as the signal-to-noise ratio (SNR), bit error rate (BER), or received signal strength indicator (RSSI).

[0063] The node behavior under different channel states can include the target's neighboring nodes forwarding data packets normally (correct behavior) under different channel states, and the target's neighboring nodes not forwarding data packets normally (incorrect behavior) under different channel states.

[0064] For example, a node can determine the current channel state based on the signal-to-noise ratio (SNR) and use a watchdog mechanism to obtain the node behavior of the target neighbor node under the current channel state. The watchdog mechanism can detect whether the target neighbor node adheres to the forwarding obligations stipulated in the routing protocol, determine whether the target neighbor node correctly forwards data packets, and identify forwarding anomalies (dropping, tampering, or delayed forwarding) of the target neighbor node. For instance, when a data packet sent by node 1 needs to be forwarded by node 2 (the target neighbor node), if node 2 is normal, it will broadcast and be detected by all neighbor nodes (including node 1). For node 1, this will be considered as node 2 performing a correct action. If node 1 does not hear node 2's forwarded data, regardless of whether the action is due to a transmission failure caused by low channel quality or malicious interception by node 2, node 1 will consider node 2's action as an erroneous action.

[0065] In this embodiment of the application, the channel state set is represented as h represents high channel quality state, l represents low channel quality state, and the set of behaviors is represented as c s and m s These represent the number of correct and incorrect behaviors performed by the node under different channel conditions, respectively. The number of times a high-quality channel and a low-quality channel state are observed within a detection time window is represented as... and The number of times erroneous behavior is performed under high channel quality conditions and low channel quality conditions is expressed as follows: and .

[0066] Step 202: Determine the current trust level of the target neighbor node based on node behavior and the trust model. The trust model is determined based on the subjective logic framework and the implicit Markov model. The subjective logic framework is used to determine the viewpoint parameters based on node behavior and to determine the trust level of the target neighbor node based on the viewpoint parameters. The viewpoint parameters include the believe parameter, the disbelief parameter, and the uncertain parameter. The implicit Markov model is used to describe the channel state transition process.

[0067] First, let's introduce the subjective logic framework:

[0068] To measure the trustworthiness of a target neighbor node based on observed events of its behavior, this application constructs a subjective logic framework. This is a probabilistic logic framework that handles event uncertainty and incomplete information, using logical perspectives to express the degree of trust in a node. A perspective consists of four parameters: Belief (b), Disbelief (d), Uncertainty (u), and Base-rate (a), denoted as o = {b, d, u, a}, satisfying b + d + u = 1, b, d, u, a ∈ [0, 1]. Here, b and d represent the degree of trust in the node's normal and malicious behavior, respectively; u represents the uncertainty of not being able to determine the node due to a lack of information; and a represents the prior probability that the node is normal when no events occur. The updating of the perspective mainly depends on the number of correct and incorrect behaviors that occur within the detection time window. The three update parameters of the perspective can be expressed by the following formula:

[0069]

[0070] in , which represents the weight assigned to each forwarding behavior by the node under different channel states.

[0071] Secondly, the state of an underwater channel at a certain moment mainly depends on the current environmental factors and is not closely related to previous moments. The embodiments of this application use a Hidden Markov Model (HMM) containing two typical states to represent the channel state transition, which can accurately characterize the channel state and assist in the analysis of node behavior.

[0072] In real-world environments, the channel state cannot be directly observed by nodes. Therefore, it is necessary to infer the unobservable state using some observable indirect information (the quality of the channel can be indirectly measured by the packet forwarding / reception rate under the current channel conditions; for example, a packet reception rate > 80% indirectly indicates a high-quality channel state). This constitutes the Hidden Markov Model (HMM) structure. Nodes infer the current state by combining observed packet forwarding information with the HMM structure and known transition probabilities. When n steps of observation have been performed, the Markov chain can be represented by a state transition matrix as follows:

[0073]

[0074] in , where n represents the number of observation steps in the Monte Carlo simulation. This represents the single-step transition probability from state l to state h. Let represent the single-step transition probability from state h to state l. In addition, the following constraints also apply: and .

[0075] When the number of steps is large enough, the steady-state probability vector Independent of the initial state, it can be obtained from the transition probability matrix. Because The second term in the state transition matrix above tends to 0 as n increases. Therefore, It can be calculated as follows:

[0076]

[0077] The following section describes the process of determining the trust model based on a subjective logic framework:

[0078] To determine whether a node is under malicious attack, this application's embodiments derive a critical value for the degree of trust in the target neighbor node based on a subjective logic framework. The process of judging malicious nodes is a binary decision problem. This is defined by... This represents the level of trust in the target neighbor nodes, where... The target neighbor node is considered to be completely trusted. The target neighbor node is considered malicious. The critical value condition for trust depends on three update parameters of the subjective logic framework, which can be expressed as:

[0079]

[0080] in, β ∈[0,1] This is used to adjust the degree of influence of uncertainty u on the final judgment, and can be changed according to the channel state. In the inequalities of the above judgment conditions, This represents the degree to which the target neighbor node is considered trustworthy after considering both trust and uncertainty. Similarly, This represents the degree to which a target neighbor node is considered malicious, considering a combination of distrust and uncertainty.

[0081] Considering multiple observations of node behavior under different channel conditions, and combining this with the HMM transition model, the probability that the target neighbor node is reliable after N independent observations can be expressed as:

[0082] P[ T M =1|N]=P[b+βu>d+(1-β)u|N]

[0083] Within a detection time window, the number of observed node behaviors is N. + =N, = Therefore, according to the law of total probability, the probability that the target neighbor node is trustworthy can be transformed into:

[0084] P T M =1 N = ∑ N l =0 N ∑ m l =0 N l ∑ m h ∈M P[ m h |N, m l , N l ]P[ m l | N l ,N]P[ N l |N]

[0085] in, P[ N l |N] This represents the probability that the observed channel state is in a low-quality state within all observation counts N. P[ m l | N l ,N] This represents the probability of performing an erroneous action within a given number of times the observed channel state is in a low channel quality state. P[ m h |N, m l , N l ] As an intermediate variable, Indicates in In this observation, the target neighbor nodes were ultimately determined to be a set of erroneous behaviors of trusted nodes, and the channel states of these observations were high-channel-quality states. This can be expressed by the following formula:

[0086]

[0087] Based on the characteristics of node behavior in sensor networks, the probabilities of successful and failed packet forwarding are complementary and independent, following a binomial distribution. Therefore... , The probabilities of erroneous behavior occurring in the two channel states are respectively... and Based on this, the probability that the target neighbor node is trustworthy can be expressed as:

[0088] P T M =1 N = ∑ N l =0 N ∑ m l =0 N l ∑ m h ∈M N- N l i P h(m) i × 1- P h(m) N - N l -i N l m l P l (m) m l × 1- P l(m) N l - m l P[ N l |N]

[0089] Where i represents Each item number in the list, P[ N l |N] This can be expressed by the following formula:

[0090] P[ N l |N]= π h ⋅ ψ h l ( N l ,N)+ π l ⋅ ψ l l ( N l ,N).

[0091] in, This represents the probability of observing k low-channel-quality states within n steps, starting from the initial state s. Combining the Markov property of the HMM model, we first... The first step is to conditionalize it as follows:

[0092]

[0093]

[0094] in The initialization definition is If k > n, then .

[0095] Optionally, when the channel state is a high-quality channel state and is considered completely reliable, the set of erroneous behaviors... ( This can be achieved by solving the conditional inequalities. Determine and set the error behaviors. ( The solution is used as a trust model, as follows:

[0096] Substituting the expressions for updating parameters b, d, and u into the conditional inequality, we can transform the conditional inequality into:

[0097]

[0098] in, The weights are preset fixed weight parameters. It consists of a fixed prior part and a variable part that measures the probability of a malicious node.

[0099]

[0100]

[0101] in, , and For different preset fixed weight parameters, These are variable weights used to measure the importance placed on node erroneous behavior in a channel with mixed states. The value increases based on the erroneous behavior of the target neighbor node under different channel conditions. For example, if the number of erroneous behaviors of the target neighbor node is greater in a high-quality channel than in a low-quality channel, the target neighbor node is likely a malicious node, and the value will increase accordingly. If there are no malicious nodes, the probability of erroneous behavior occurring in high-channel quality states should be significantly lower than in low-channel quality states. In other words, the fewer erroneous behaviors occur in a high-quality channel state, the closer it is to the normal performance of the channel state, and the closer the variable weights are to 0. If the observed events are exactly the opposite, that is... If the target neighbor node is considered to be highly likely to be a malicious node, then the value should be increased accordingly. Numerical value The value can be 1. It should be noted that if a low channel quality condition does not occur within a detection time window, It can be set to 0.5, a variable weight. It can be determined in the following ways:

[0102]

[0103] Weight Substituting the expression into the transformed inequality, and assuming that the weight of the node's correct behavior is the same in both channel states h and l, i.e. , If the weight parameters are preset and fixed, then the inequality can be further transformed into:

[0104]

[0105] in,

[0106]

[0107]

[0108]

[0109]

[0110]

[0111] Then, substituting the expressions for variable weights under both malicious and normal node conditions, we can obtain... The analytical solution is expressed by the following formula:

[0112]

[0113] in, , , .

[0114] Therefore, this analytical solution is taken as a trust model, which includes the first condition. Second condition .

[0115] Optionally, after determining the trust model, the number of times the erroneous behavior is performed in the high-channel-quality state can be determined based on the node behavior of the target neighbor nodes under different channel states. The number of times erroneous behavior is performed under low channel quality conditions Then and When the first condition is met, the current trust level of the target's neighboring nodes is determined to be 1. and When the second condition is met, the current trust level of the target's neighboring nodes is determined to be 0.

[0116] Step 203: Determine whether the target neighbor node is a malicious node based on the current trust level.

[0117] Optionally, the current trust level is the trust level of the target neighbor node within the current detection time window. Therefore, it is possible to directly determine whether the target neighbor node is a malicious node based on the current trust level, or to update the current trust level based on the historical trust level of the target neighbor node in the historical detection time window, and determine whether the target neighbor node is a malicious node based on the updated trust level. This application embodiment does not limit this.

[0118] Understandably, historical trust is also determined based on the historical node behavior and trust model of the target's neighboring nodes within the historical detection time window.

[0119] When determining whether a target neighbor node is a malicious node based on the current trust level, if the current trust level is 0, the target neighbor node is a malicious node; if the current trust level is 1, the target neighbor node is not a malicious node.

[0120] When determining whether a target neighbor node is a malicious node based on the updated trust level, if the updated trust level is less than the preset trust threshold, the target neighbor node is a malicious node; if the updated trust level is not less than the preset trust threshold, the target neighbor node is not a malicious node.

[0121] In the aforementioned method for detecting malicious nodes in underwater acoustic sensor networks, the node behavior of target neighbor nodes under different channel states is acquired within a preset detection time window. Then, the current trust level of the target neighbor node is determined based on the node behavior and a trust model. The trust model is determined using a subjective logic framework and a hidden Markov model. The subjective logic framework is used to determine viewpoint parameters based on node behavior, and the trust level of the target neighbor node is determined based on these viewpoint parameters. Viewpoint parameters include believe parameters, disbelieve parameters, and uncertain parameters. The hidden Markov model is used to describe the channel state transition process. Finally, the current trust level is used to determine whether the target neighbor node is a malicious node. When determining the current trust level of the target neighbor node, the forwarding behavior of the target neighbor node under different channel states is fully considered, i.e., the instability of the underwater acoustic channel is taken into account. Therefore, when detecting malicious nodes based on the current trust level, the accuracy of malicious node detection can be effectively improved.

[0122] In one exemplary embodiment, the channel state includes a high channel quality state and a low channel quality state, such as... Figure 3 As shown, the current trust level of the target neighbor node is determined based on node behavior and a trust model, including the following steps 301 to 303. Wherein:

[0123] Step 301: Determine the number of erroneous behaviors of the target neighbor node in the high channel quality state and the low channel quality state, respectively, based on the node behavior. Erroneous behavior indicates that the target neighbor node did not forward the data packet normally.

[0124] Optionally, in sensor networks, due to the instability of acoustic channels and packet loss during transmission, the packet forwarding behavior of nodes is affected by the probability of successful transmission from the source node. The impact of this necessitates adjusting the number of correct and incorrect actions based on the probability of successful transmission. Furthermore, when malicious nodes are present, their behavior may deviate from the expected routing rules, specifically manifesting as a probability-based approach. Intentionally discarding or intercepting data packets can lead to abnormal behavior. Used to characterize the attack strength of malicious nodes, and P d ∈ [0,1] In this case, the number of correct actions and the number of incorrect actions can be adjusted based on the attack intensity and the probability of successful transmission.

[0125] Among them, the probability of successful transmission under different channel conditions It is the product of the probability that a node correctly transmits packets and the packet loss rate. , For packet error rate, This refers to the packet loss rate.

[0126] In one possible implementation, such as Figure 4 As shown, determining the number of erroneous behaviors of the target neighbor node under high channel quality and low channel quality conditions based on node behavior includes steps 401 to 403. Wherein:

[0127] Step 401: Determine the number of initial erroneous behaviors and the number of initial correct behaviors of neighboring nodes under high channel quality and low channel quality conditions, respectively, based on node behavior.

[0128] Optionally, the number of initial erroneous behaviors of the target neighbor node under high channel quality conditions can be determined from the node behavior. and the number of initial correct actions And the number of initial erroneous behaviors of the target neighbor node under low channel quality conditions. and the number of initial correct actions .

[0129] Step 402: Determine the number of erroneous behaviors of the target neighbor node in the high-channel-quality state based on the product of the first erroneous behavior probability and the number of initial correct behaviors in the high-channel-quality state and the sum of the number of initial erroneous behaviors in the high-channel-quality state.

[0130] The first erroneous behavior probability is the probability that the target neighbor node will perform an erroneous behavior under high channel quality conditions. It can be determined based on the preset malicious node attack strength and the first successful transmission probability, which is the probability that the target neighbor node will successfully transmit data packets under high channel quality conditions.

[0131] For example, since the attack strength of a malicious node is a probability value, the difference between 1 and the attack strength of the malicious node can be calculated. Then, the probability of the node performing the correct behavior can be determined by multiplying the difference with the preset success transmission probability, and the probability of the first incorrect behavior can be determined by the difference between 1 and the probability of the correct behavior. It can be expressed by the following formula:

[0132]

[0133] in, This represents the probability of the first correct action under high channel quality conditions. .

[0134] Optionally, after obtaining the erroneous behavior probability, the product of the erroneous behavior probability and the number of initial correct behaviors under high channel quality conditions, plus the sum of the number of initial erroneous behaviors under high channel quality conditions, can be used as the number of erroneous behaviors of the target neighbor node under high channel quality conditions. It can be expressed by the following formula:

[0135]

[0136] Meanwhile, the number of correct actions of the target neighbor node under high channel quality conditions can be determined by the product of the initial number of correct actions and the probability of correct actions, which can be expressed as:

[0137]

[0138] Step 403: Determine the number of erroneous behaviors of the target neighbor node in the low channel quality state based on the product of the second erroneous behavior probability and the number of initial correct behaviors in the low channel quality state and the sum of the number of initial erroneous behaviors in the low channel quality state.

[0139] The second erroneous behavior probability is the probability that the target neighbor node will perform an erroneous behavior under low channel quality conditions. It can be determined based on the preset malicious node attack strength and the second successful transmission probability. The second successful transmission probability is the probability that the target neighbor node will successfully transmit data packets under low channel quality conditions.

[0140] Second error behavior probability It can be expressed by the following formula:

[0141]

[0142] in, This represents the probability of the second correct behavior under low channel quality conditions. .

[0143] Alternatively, the product of the erroneous behavior probability and the number of initial correct behaviors under low channel quality conditions, plus the sum of the number of initial erroneous behaviors under low channel quality conditions, can be used as the number of erroneous behaviors of the target neighbor node under low channel quality conditions. It can be expressed by the following formula:

[0144]

[0145] Meanwhile, the number of correct actions of the target neighbor node under low channel quality conditions can be determined by the product of the initial number of correct actions and the probability of correct actions, which can be expressed as:

[0146]

[0147] Step 302: When the number of erroneous behaviors under high channel quality conditions satisfies the first condition in the trust model, determine that the current trust level of the target neighbor node is 1.

[0148] The first condition is that the sum of the square of the number of erroneous behaviors under high channel quality conditions and the first product of the first parameter, the second product of the number of erroneous behaviors under high channel quality conditions and the second parameter, and the third parameter is less than 0. The first parameter is determined based on the number of behaviors of the target neighbor node under high channel quality conditions, the second parameter is determined based on the number of behaviors of the target neighbor node under high channel quality conditions, the probability of occurrence of erroneous behaviors under low channel quality conditions, and the number of erroneous behaviors under low channel quality conditions, and the third parameter is a preset fixed parameter.

[0149] Optionally, the first condition ,in, As the first parameter, The second parameter, As the third parameter, here for , and The expression will not be elaborated further.

[0150] Optionally, the number of erroneous behaviors under high channel quality conditions. When the first condition is met, the current trust level of the target's neighboring nodes is set to 1.

[0151] Step 303: When the number of erroneous behaviors under high channel quality conditions and the number of erroneous behaviors under low channel quality conditions satisfy the second condition in the trust model, determine that the current trust level of the target neighbor node is 0.

[0152] The second condition is that the number of erroneous behaviors under high channel quality conditions is less than the fourth parameter, and the fourth parameter is determined based on the number of erroneous behaviors under low channel quality conditions.

[0153] Optionally, the second condition is The fourth parameter is The number of erroneous behaviors under low channel quality conditions Sure, , , , and The value is a fixed value determined based on preset fixed weight parameters, and its expression will not be elaborated further.

[0154] The above method determines the number of erroneous behaviors of a target neighbor node under both high and low channel quality states based on node behavior. An erroneous behavior indicates that the target neighbor node failed to forward data packets correctly. If the number of erroneous behaviors under high channel quality states meets the first condition in the trust model, the current trust level of the target neighbor node is determined to be 1. If the number of erroneous behaviors under both high and low channel quality states meets the second condition in the trust model, the current trust level of the target neighbor node is determined to be 0. This method allows for the determination of the number of erroneous behaviors under different channel quality states, followed by a judgment of whether the first or second condition is met, thereby accurately determining the current trust level of the target neighbor node.

[0155] The dynamic nature of the underwater environment causes nodes and network topology in sensor networks to move. Therefore, when determining whether a target neighbor node is malicious, the current trust level determined within the current detection time window can be updated by combining historical trust levels from historical detection time windows. In an exemplary embodiment, such as... Figure 5 As shown, determining whether a target neighbor node is a malicious node based on the current trust level includes the following steps 501 to 502. Wherein:

[0156] Step 501: If the current detection time window is not the first detection time window, update the current trust level based on the historical trust level of the target neighbor node.

[0157] Among them, historical trust level can be the trust level of the target's neighboring nodes corresponding to all detection time windows before the current detection time window.

[0158] Optionally, a sliding time window mechanism can be used to dynamically update the trust level of the target neighbor node based on its historical trust level. In other words, within a detection time window T, the trust value corresponding to the detection time window is determined based on the trust model and the node behavior of the target neighbor node within that detection time window. After that, the window slides to the next detection time window, and the current trust level is determined based on the same method. Then, the current trust level is updated based on the trust value of the historical window (i.e., the historical trust value).

[0159] Understandably, if the current detection time window is the first detection time window, there is no need to update the current trust level. If the current detection time window is the second detection time window, the trust level corresponding to the first detection time window can be used as the historical trust level, and the current trust level can be updated based on the historical trust level to obtain the trust level for the second detection time window. If the current detection time window is the third detection time window, the trust levels corresponding to the first and second detection time windows can be used as historical trust levels, and the current trust level can be updated based on the historical trust level to obtain the trust level for the third detection time window.

[0160] Step 502: Determine whether the target neighbor node is a malicious node based on the updated trust level of the target neighbor node.

[0161] Optionally, after updating the trust level of the target neighbor node, the target neighbor node is determined to be a malicious node based on the updated trust level.

[0162] For example, if the updated trust level is less than the preset trust threshold, the target neighbor node is a malicious node; if the updated trust level is not less than the preset trust threshold, the target neighbor node is not a malicious node.

[0163] The above approach, when the current detection time window is not the first detection time window, updates the current trust level based on the historical trust level of the target neighbor nodes. Based on the updated trust level of the target neighbor nodes, it determines whether the target neighbor node is a malicious node. This allows for continuous detection of malicious nodes in a dynamic topology. By combining the historical trust level of the historical detection time windows, the trust level of the target neighbor nodes can be accurately determined, improving the accuracy of malicious node detection.

[0164] In one exemplary embodiment, such as Figure 6 As shown, the current trust level is updated based on the historical trust level of the target neighbor node, including the following steps 601 to 604. Wherein:

[0165] Step 601: Obtain the decay factor corresponding to each historical trust level. The decay factor is used to represent the degree of influence of the historical trust level on the current trust level.

[0166] Trust level includes historical trust level and current trust level.

[0167] Optionally, the further away the historical trust level of the target neighbor node is from the current detection time window, the smaller its impact on the current trust level. The decay factor corresponding to the current trust level and the historical trust levels differs due to the different detection time windows in which the detection has been completed. This can be represented by exponential decay:

[0168]

[0169] in, It is a preset adjustable factor, n is the order of completed detection time windows, that is, the number of historical detections. It can be understood that for the first detection time window, the order of completed detection time windows n=0, T is the time length of a detection time window, and t is the time length from the start of detection to the current detection time window.

[0170] Step 602: Determine the first confidence parameter based on the sum of the products of each historical confidence level and its corresponding decay factor.

[0171] Alternatively, the first trust level parameter can be expressed according to the following formula:

[0172]

[0173] in, Indicates historical trust level, The historical trust level corresponding to the first detection time window. The decay factor corresponding to the first detection time window. The historical trust level corresponding to the second detection time window. This is the decay factor corresponding to the second detection time window.

[0174] Step 603: Determine the second trust level parameter based on the difference between the current trust level and the product of the current trust level and the corresponding decay factor.

[0175] Optionally, the decay factor corresponding to the current level of trust. ,in, The second trust parameter can be expressed as ,in, This represents the current level of trust.

[0176] Step 604: Determine the updated trust level based on the sum of the first trust level and the second trust level.

[0177] The updated trust level can be represented by the following formula:

[0178]

[0179] Optionally, each node in the sensor network moves with the ocean current field, and the target neighbor nodes include long-term neighbor nodes, old node regression, and new neighbor nodes. When the target neighbor node is a long-term neighbor node, the decay factor corresponding to each trust level is related to the number of historical detections. When the target neighbor node is an old node regression, the decay factor corresponding to each trust level is related to the number of historical detections and the familiarity factor, and the familiarity factor is determined based on the communication time between the target neighbor node and the node before regression. When the target neighbor node is a new neighbor node, and the historical trust level of the target neighbor node is not included in the trusted node record, the decay factor is a preset decay value.

[0180] It is understandable that the neighboring nodes of the same node may change at different times. For example, node 1 may be within the communication range of node 2 in the detection time window T, but it may leave node 2 and enter the range of node 3 in T+1. After a period of time, node 1 returns to the range of node 2 in T+n. Therefore, in the detection window corresponding to T+n, for node 2, the target neighboring node (node ​​1) is the old node returning, while in the detection window corresponding to T+1, for node 3, the target neighboring node (node ​​1) is the new neighboring node.

[0181] When the target neighbor node is a long-term neighbor node, the corresponding decay factor for each trust level is... .

[0182] When the target neighbor node is an old node returning, the decay factor corresponding to each trust level can be adjusted based on the familiarity factor. The adjusted decay factor corresponds to each trust level. It can be represented as:

[0183] .

[0184] in, For familiarity factor, , Let B be the communication time between the target neighbor node and node A before regression. The familiarity factor indicates that the more familiar the two nodes were in the past, the more important they will be after regression. These are preset coefficients.

[0185] When the target neighbor node is a new neighbor node, blindly trusting or doubting it is unreasonable since there is no prior knowledge about it. However, since trust between nodes can be transitive (i.e., node 1 trusts node 2, node 2 trusts node 3, then node 3 can also be trusted by node 1), when the target neighbor node is a new neighbor node, we can determine whether there is a historical trust level for the new neighbor node in the records of trusted nodes. If there is a historical trust level for the new neighbor node in the records of trusted nodes, we can obtain the historical trust level of the new neighbor node and update the current trust level based on the historical trust level. This embodiment of the application will not elaborate further on this.

[0186] If the trusted node record does not contain the historical trust level of the new neighbor node, then the decay factor is the preset decay value. Meanwhile, since its historical trust level could not be obtained, the updated trust level can be expressed as... .

[0187] Optionally, the trusted node record can be used to store the trust level of each node in the sensor network that is a trusted neighbor node determined in the historical detection time window, or it can be used to store the trust level of each node that is a trusted neighbor node determined in the historical detection time window. This application embodiment does not limit this.

[0188] As an optional implementation method, such as Figure 7 As shown in the embodiments of this application, the method for detecting malicious nodes in an underwater acoustic sensor network may include the following specific steps:

[0189] Step 701: Within the preset detection time window, obtain the node behavior of the target neighbor node under different channel states.

[0190] Step 702: Determine the number of initial erroneous behaviors and the number of initial correct behaviors of neighboring nodes in high channel quality state and low channel quality state, respectively, based on node behavior.

[0191] Step 703: Determine the number of erroneous behaviors of the target neighbor node in the high-channel-quality state based on the product of the first erroneous behavior probability and the number of initial correct behaviors in the high-channel-quality state and the sum of the number of initial erroneous behaviors in the high-channel-quality state.

[0192] The probability of the first erroneous behavior is determined based on the preset attack strength of the malicious node and the probability of the first successful transmission.

[0193] Step 704: Determine the number of erroneous behaviors of the target neighbor node in the low channel quality state based on the product of the second erroneous behavior probability and the number of initial correct behaviors in the low channel quality state and the sum of the number of initial erroneous behaviors in the low channel quality state.

[0194] The probability of the second erroneous behavior is determined based on the preset attack strength of the malicious node and the probability of successful transmission.

[0195] Step 705: When the number of erroneous behaviors under high channel quality conditions satisfies the first condition in the trust model, determine that the current trust level of the target neighbor node is 1.

[0196] The first condition is that the sum of the square of the number of erroneous behaviors under high channel quality conditions and the first product of the first parameter, the second product of the number of erroneous behaviors under high channel quality conditions and the second parameter, and the third parameter is less than 0. The first parameter is determined based on the number of behaviors of the target neighbor node under high channel quality conditions, the second parameter is determined based on the number of behaviors of the target neighbor node under high channel quality conditions, the probability of occurrence of erroneous behaviors under low channel quality conditions, and the number of erroneous behaviors under low channel quality conditions, and the third parameter is a preset fixed parameter.

[0197] Step 706: When the number of erroneous behaviors under high channel quality conditions and the number of erroneous behaviors under low channel quality conditions satisfy the second condition in the trust model, determine that the current trust level of the target neighbor node is 0.

[0198] The second condition is that the number of erroneous behaviors under high channel quality conditions is less than the fourth parameter, and the fourth parameter is determined based on the number of erroneous behaviors under low channel quality conditions.

[0199] Step 707: If the current detection time window is not the first detection time window, obtain the decay factor corresponding to each trust level. The decay factor is used to represent the degree of influence of the historical trust level on the current trust level.

[0200] The trust level includes historical trust level and current trust level. Each node in the sensor network moves with the ocean current field. The target neighbor nodes include long-term neighbor nodes, old node return nodes, and new neighbor nodes. When the target neighbor node is a long-term neighbor node, the decay factor corresponding to each trust level is related to the number of historical detections. When the target neighbor node is an old node return node, the decay factor corresponding to each trust level is related to the number of historical detections and the familiarity factor. The familiarity factor is determined based on the communication time between the target neighbor node and the node before the return node. When the target neighbor node is a new neighbor node and the historical trust level of the target neighbor node is not included in the trusted node record, the decay factor is a preset decay value.

[0201] Step 708: Determine the first confidence parameter based on the sum of the products of each historical confidence level and its corresponding decay factor.

[0202] Step 709: Determine the second trust level parameter based on the difference between the current trust level and the product of the current trust level and the corresponding decay factor.

[0203] Step 710: Determine the updated trust level based on the sum of the first trust level parameter and the second trust level parameter.

[0204] Step 711: Determine whether the target neighbor node is a malicious node based on the updated trust level of the target neighbor node.

[0205] In this embodiment, simulation is performed according to the above method. The simulation conditions are: a 5km*5km square ocean area, a depth of 300m, a seawater current velocity of 0-1.5 m / s, a sensor network including 18 normal nodes and 2 malicious nodes, and a communication range of 100m. The data packet length is 24 bytes. The transition probabilities of the HMM are P... hh =0.87, P ll =0.72. Channel quality is measured by SNR, with thresholds of 7 dB for high channel quality state h and 6.3 dB for low channel quality state l. Each test is independently repeated 10 times (10 detection time windows), with N=20 observation steps. In a channel with mixed h and l states, the following settings are used: This means that uncertainty tends to favor trust. However, when the channel is only in a high-quality state, taking... This means that uncertainty is also seen as distrust.

[0206] like Figure 8 As shown, the attack strength p of different nodes varies with channel state changes. d The impact on the successful identification rate of malicious nodes, with the horizontal axis representing the proportion of high channel quality states (P). h(e) / P l(e) The vertical axis represents the malicious node identification rate, for reference only. Figure 8 For attack strength p d Almost all neighboring nodes with a value >0.7 were identified as malicious nodes, when p d When p < 0.7, the probability of successful recognition is affected by the channel state, and the recognition rate at stationary conditions increases with p. d The decrease is due to the reduction. For example, Figure 9 As shown, this illustrates the impact of node mobility on the identification rate. The horizontal axis represents the distance between the target neighbor node and the node, while the vertical axis represents the malicious node identification rate. When neighbor nodes are close, malicious nodes can be accurately identified under various channel conditions. However, the identification rate decreases with increasing distance, eventually exceeding the communication range. At the same distance, a decrease in channel quality will lead to a significant drop in the identification rate. Figure 10 As shown, the window size of the detection time window affects the malicious node identification rate under different attack intensities. The horizontal axis represents the proportion of high channel quality states (P). h(e) / P l(e) The vertical axis represents the malicious node identification rate, and when p dWhen the time window is 0.5, increasing the time window weakens the dynamic observation of nodes, leading to a decrease in the recognition rate. Conversely, decreasing the time window can improve the recognition rate, but the contribution is limited. For p d For nodes with a resolution greater than 0.8, the sensor network has a high recognition rate. Therefore, although increasing the time window weakens the recognition rate when the channel quality is low, it can still be perfectly recognized as the channel quality improves.

[0207] In summary, the method in this application embodiment can identify nodes with an attack strength greater than 0.38 and has good adaptability to node mobility and dynamic updates over time.

[0208] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0209] Based on the same inventive concept, this application also provides an underwater acoustic sensor network malicious node detection device for implementing the above-described method for detecting malicious nodes in underwater acoustic sensor networks. The solution provided by this device is similar to the implementation described in the above-described method. Therefore, the specific limitations in one or more embodiments of the underwater acoustic sensor network malicious node detection device provided below can be found in the limitations of the underwater acoustic sensor network malicious node detection method described above, and will not be repeated here.

[0210] In one exemplary embodiment, such as Figure 11 As shown, an underwater acoustic sensor network malicious node detection device 1100 is provided, which is installed in any node in the sensor network, and includes: an acquisition module 1101, a first determination module 1102, and a second determination module 1103, wherein:

[0211] The acquisition module 1101 is used to acquire the node behavior of the target neighbor node under different channel states within a preset detection time window;

[0212] The first determining module 1102 is used to determine the current trust level of the target neighbor node based on node behavior and trust model. The trust model is determined based on subjective logic framework and implicit Markov model. Subjective logic framework is used to determine viewpoint parameters based on node behavior and to determine the trust level of the target neighbor node based on viewpoint parameters. Viewpoint parameters include believe parameters, disbelief parameters and uncertain parameters. Implicit Markov model is used to describe the channel state transition process.

[0213] The second determination module 1103 determines whether the target neighbor node is a malicious node based on the current trust level.

[0214] In one embodiment, the second determining module 1103 is specifically used to update the current trust level based on the historical trust level of the target neighbor node when the current detection time window is not the first detection time window; and to determine whether the target neighbor node is a malicious node based on the updated trust level of the target neighbor node.

[0215] In one embodiment, the channel state includes a high channel quality state and a low channel quality state. The first determining module 1102 is specifically used to determine the number of erroneous behaviors of the target neighbor node in the high channel quality state and the low channel quality state, respectively, based on node behavior. An erroneous behavior indicates that the target neighbor node did not forward the data packet normally. When the number of erroneous behaviors in the high channel quality state meets the first condition in the trust model, the current trust level of the target neighbor node is determined to be 1. The first condition is that the sum of the square of the number of erroneous behaviors in the high channel quality state and the first product of the first parameter, the second product of the number of erroneous behaviors in the high channel quality state and the second parameter, and the third parameter is less than 0. The first parameter is determined based on the number of behaviors of the target neighbor node in the high channel quality state, the second parameter is determined based on the number of behaviors of the target neighbor node in the high channel quality state, the probability of occurrence of erroneous behaviors in the low channel quality state, and the number of erroneous behaviors in the low channel quality state, and the third parameter is a preset fixed parameter. When the number of erroneous behaviors in the high channel quality state and the number of erroneous behaviors in the low channel quality state meet the second condition in the trust model, the current trust level of the target neighbor node is determined to be 0. The second condition is that the number of erroneous behaviors in the high channel quality state is less than the fourth parameter, and the fourth parameter is determined based on the number of erroneous behaviors in the low channel quality state.

[0216] In one embodiment, the first determining module 1102 is specifically configured to determine the number of initial erroneous behaviors and the number of initial correct behaviors of neighboring nodes in high channel quality state and low channel quality state, respectively, based on node behavior; determine the number of erroneous behaviors of the target neighboring node in high channel quality state based on the product of a first erroneous behavior probability and the number of initial correct behaviors in high channel quality state and the sum of the number of initial erroneous behaviors in high channel quality state, wherein the first erroneous behavior probability is determined based on a preset malicious node attack strength and a first successful transmission probability; and determine the number of erroneous behaviors of the target neighboring node in low channel quality state based on the product of a second erroneous behavior probability and the number of initial correct behaviors in low channel quality state and the sum of the number of initial erroneous behaviors in low channel quality state, wherein the second erroneous behavior probability is determined based on a preset malicious node attack strength and a second successful transmission probability.

[0217] In one embodiment, the second determining module 1103 is specifically used to obtain the attenuation factor corresponding to each trust level, the attenuation factor being used to represent the degree of influence of historical trust levels on the current trust level, and the trust level including historical trust level and current trust level; determine the first trust level parameter based on the sum of the products of each historical trust level and the corresponding attenuation factor; determine the second trust level parameter based on the difference between the current trust level and the product of the current trust level and the corresponding attenuation factor; and determine the updated trust level based on the sum of the first trust level parameter and the second trust level parameter.

[0218] In one embodiment, each node in the sensor network moves with the ocean current field, and the target neighbor nodes include long-term neighbor nodes, old node return nodes, and new neighbor nodes. When the target neighbor node is a long-term neighbor node, the decay factor corresponding to each trust level is related to the number of historical detections. When the target neighbor node is an old node return node, the decay factor corresponding to each trust level is related to the number of historical detections and the familiarity factor, which is determined based on the communication time between the target neighbor node and the node before the return node. When the target neighbor node is a new neighbor node, and the historical trust level of the target neighbor node is not included in the trusted node record, the decay factor is a preset decay value.

[0219] Each module in the aforementioned underwater acoustic sensor network malicious node detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0220] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 12As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a method for detecting malicious nodes in an underwater acoustic sensor network.

[0221] Those skilled in the art will understand that Figure 12 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0222] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps described in any of the above method embodiments.

[0223] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps described in any of the above method embodiments.

[0224] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps described in any of the above method embodiments.

[0225] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0226] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0227] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for detecting malicious nodes in an underwater acoustic sensor network, characterized in that, For use in any node in a sensor network, the method includes: Within a preset detection time window, the node behavior of the target neighbor node under different channel states is acquired; The current trust level of the target neighbor node is determined based on the node behavior and trust model. The trust model is determined based on a subjective logic framework and a hidden Markov model. The subjective logic framework is used to determine viewpoint parameters based on the node behavior and to determine the trust level of the target neighbor node based on the viewpoint parameters. The viewpoint parameters include belief parameters, disbelief parameters, and uncertainty parameters. The hidden Markov model is used to describe the channel state transition process. Based on the current trust level, determine whether the target neighbor node is a malicious node.

2. The method according to claim 1, characterized in that, The step of determining whether the target neighbor node is a malicious node based on the current trust level includes: If the current detection time window is not the first detection time window, the current trust level is updated based on the historical trust level of the target neighbor node; Based on the updated trust level of the target neighbor node, determine whether the target neighbor node is a malicious node.

3. The method according to claim 1, characterized in that, The channel state includes a high channel quality state and a low channel quality state. Determining the current trust level of the target neighbor node based on the node behavior and trust model includes: The number of erroneous behaviors of the target neighbor node under high channel quality and low channel quality conditions is determined based on the node behavior. The erroneous behavior indicates that the target neighbor node did not forward the data packet normally. When the number of erroneous behaviors under high channel quality conditions satisfies the first condition in the trust model, the current trust level of the target neighbor node is determined to be 1. The first condition is that the sum of the square of the number of erroneous behaviors under high channel quality conditions and the first product of the first parameter, the second product of the number of erroneous behaviors under high channel quality conditions and the second parameter, and the third parameter is less than 0. The first parameter is determined based on the number of behaviors of the target neighbor node under high channel quality conditions, the second parameter is determined based on the number of behaviors of the target neighbor node under high channel quality conditions, the probability of occurrence of erroneous behaviors under low channel quality conditions, and the number of erroneous behaviors under low channel quality conditions, and the third parameter is a preset fixed parameter. When the number of erroneous behaviors under high channel quality and the number of erroneous behaviors under low channel quality satisfy the second condition in the trust model, the current trust level of the target neighbor node is determined to be 0. The second condition is that the number of erroneous behaviors under high channel quality is less than the fourth parameter, and the fourth parameter is determined based on the number of erroneous behaviors under low channel quality.

4. The method according to claim 3, characterized in that, The step of determining the number of erroneous behaviors of the target neighbor node under high channel quality and low channel quality states based on the node behavior includes: Based on the node behavior, determine the number of initial erroneous behaviors and the number of initial correct behaviors of the neighboring nodes under high channel quality and low channel quality conditions, respectively; The number of erroneous behaviors of the target neighbor node in the high channel quality state is determined by the product of the first erroneous behavior probability and the number of initial correct behaviors in the high channel quality state and the sum of the number of initial erroneous behaviors in the high channel quality state. The first erroneous behavior probability is determined based on the preset malicious node attack intensity and the first successful transmission probability. The number of erroneous behaviors of the target neighbor node in the low channel quality state is determined by the product of the second erroneous behavior probability and the number of initial correct behaviors in the low channel quality state and the sum of the number of initial erroneous behaviors in the low channel quality state; the second erroneous behavior probability is determined based on the preset malicious node attack intensity and the second successful transmission probability.

5. The method according to claim 2, characterized in that, The step of updating the current trust level based on the historical trust level of the target neighbor node includes: Obtain the decay factor corresponding to each trust level. The decay factor is used to represent the degree of influence of the historical trust level on the current trust level. The trust level includes historical trust level and current trust level. The first confidence level parameter is determined by summing the products of each historical confidence level and its corresponding decay factor. The second trust level parameter is determined based on the difference between the current trust level and the product of the current trust level and the corresponding decay factor. The updated trust level is determined based on the sum of the first trust level parameter and the second trust level parameter.

6. The method according to claim 4, characterized in that, In the sensor network, each node moves with the ocean current field, and the target neighbor nodes include long-term neighbor nodes, old node regression, and new neighbor nodes. When the target neighbor node is a long-term neighbor node, the decay factor corresponding to each trust level is related to the number of historical detections; When the target neighbor node is an old node returning, the decay factor corresponding to each trust level is related to the number of historical detections and the familiarity factor. The familiarity factor is determined based on the communication time between the target neighbor node and the node before the return. When the target neighbor node is a new neighbor node and the historical trust level of the target neighbor node is not included in the trusted node record, the attenuation factor is a preset attenuation value.

7. A malicious node detection device for underwater acoustic sensor networks, characterized in that, The device, located at any node in a sensor network, includes: The acquisition module is used to acquire the node behavior of the target neighbor node under different channel states within a preset detection time window; The first determining module is used to determine the current trust level of the target neighbor node based on the node behavior and the trust model. The trust model is determined based on a subjective logic framework and a hidden Markov model. The subjective logic framework is used to determine viewpoint parameters based on the node behavior and to determine the trust level of the target neighbor node based on the viewpoint parameters. The viewpoint parameters include a belief parameter, a disbelief parameter, and an uncertainty parameter. The hidden Markov model is used to describe the channel state transition process. The second determining module determines whether the target neighbor node is a malicious node based on the current trust level.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images