Malicious node detection method and apparatus, malicious node defense method and apparatus, and device

Abstract

The present application discloses a malicious node detection method and apparatus, a malicious node defense method and apparatus, and a device. The malicious node detection method comprises: on the basis of monitoring data of nodes in a network, determining forwarding success rates, message integrity, energy levels and resource scores of the nodes, wherein the message integrity represents the integrity of data packets forwarded by the nodes, the energy levels represent the activity levels and states of charge of the nodes, and the resource scores represent the transmission capabilities of the nodes; determining comprehensive trust values of the nodes on the basis of the forwarding success rates, message integrity and energy levels of the nodes, wherein the comprehensive trust values represent the credibility of the nodes; and inputting the comprehensive trust values, message integrity and resource scores of the nodes into a pre-trained classification decision model, and classifying the nodes into trusted nodes and untrusted nodes on the basis of the outputted classification results. In the present application, untrusted nodes can be identified before malicious behavior is fully exposed, thereby improving the overall security of a network.

Description

A method, apparatus and equipment for detecting and protecting against malicious nodes

[0001] Cross-reference to related applications

[0002] This application claims priority to Chinese Patent Application No. 202411661090.9, filed on November 20, 2024, with the State Intellectual Property Office of the People's Republic of China, entitled "A Method, Apparatus and Device for Detecting and Protecting Malicious Nodes", the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application belongs to the field of network security technology, and in particular relates to a method, apparatus and equipment for detecting and protecting against malicious nodes. Background Technology

[0004] Mobile Ad-hoc Networks (MANETs) are a group of self-organizing networks without fixed infrastructure support, where nodes communicate with each other via wireless links. Black hole attacks and gray hole attacks are common forms of network attacks in MANETs. Specifically, a black hole attack involves a malicious node posing as a legitimate node to attract other nodes to send data packets to it, then discarding these packets instead of forwarding them; a gray hole attack involves a malicious node selectively discarding or delaying the forwarding of some data packets after receiving them. Both types of attacks affect the reliability of communication.

[0005] In related technologies, the protection method against the above-mentioned attacks is to first filter out nodes that have been identified as malicious by referring to blacklists and whitelists when nodes are making routing selections. Then, by analyzing the routing information returned by the next-hop node, it is determined whether the behavior of the next-hop node is consistent with the behavior pattern of normal nodes, thereby determining whether the next-hop node is a malicious node. Once a node is identified as a malicious node, it is added to the blacklist to prevent it from continuing to affect the network.

[0006] However, the aforementioned behavior pattern judgment method based on routing information has a relatively single judgment dimension and is only effective for malicious nodes that have already shown malicious behavior. It is slow to react to malicious nodes before their malicious behavior is fully revealed, and there may still be false alarms or missed alarms. Summary of the Invention

[0007] To address the aforementioned issues, this application provides a method, apparatus, and device for detecting and protecting against malicious nodes, which can identify untrusted nodes before malicious behavior is fully revealed, thereby improving the overall security of the network.

[0008] Firstly, this application provides a method for detecting malicious nodes, the method comprising:

[0009] Based on the monitoring data of each node in the network, the forwarding success rate, message integrity, energy level and resource score of each node are determined. The message integrity represents the integrity of the data packets forwarded by the node, the energy level represents the activity and power status of the node, and the resource score represents the transmission capacity of the node.

[0010] Based on the forwarding success rate, message integrity, and energy level of each node, a comprehensive trust value is determined for each node, which represents the trustworthiness of the node.

[0011] The comprehensive trust value, message integrity, and resource score of each node are input into a pre-trained classification decision model, and each node is divided into a trustworthy node and an untrustworthy node based on the output classification results.

[0012] In this embodiment, firstly, based on monitoring data of each node in the network, the forwarding success rate, message integrity, energy level, and resource score of each node are determined. Then, based on these parameters, a comprehensive trust value for each node is determined. Finally, the comprehensive trust value, message integrity, and resource score of each node are input into a pre-trained classification decision model, and based on the output classification results, each node is divided into trusted and untrusted nodes. This application, by comprehensively considering the forwarding success rate, message integrity, energy level, and resource score of a node, can more comprehensively assess the trustworthiness of nodes, identify untrusted nodes before malicious behavior is fully revealed, and improve the overall security of the network.

[0013] In one possible implementation, the forwarding success rate of any given node is determined in the following way:

[0014] Determine the ratio of the number of data packets successfully sent by any node to the same destination node to the number of data packets sent to the same destination node;

[0015] From the determined ratios, the smallest ratio is selected as the forwarding success rate of any given node;

[0016] For any given node, the message integrity of that node is determined in the following way:

[0017] The message integrity of the data packet with the most modifications is selected from the message integrity log corresponding to any one of the nodes and used as the message integrity of that node. The message integrity in the message integrity log corresponding to any one node is determined based on the message integrity carried by the data packet received by that node and the number of times that node modifies the target data packet. The target data packet is the data packet that is modified and forwarded by that node.

[0018] For any given node, its energy level is determined using the following method:

[0019] The energy level of any given node is determined by the ratio of the sum of the number of data packets sent and received by any given node and the battery power of any given node to the total number of nodes in the network.

[0020] For any given node, its resource score is determined using the following method:

[0021] The resource score of any given node is determined by weighted summation of its energy level, processing power, memory, and communication range.

[0022] In this application embodiment, specific methods are provided for calculating the forwarding success rate, message integrity, energy level, and resource score of a computing node. Specifically: by selecting the minimum ratio as the node's forwarding success rate, it can be ensured that the node's forwarding success rate reflects the node's forwarding stability under worst-case conditions; by selecting the message integrity of the data packet with the most modifications as the node's message integrity, the node's message integrity can reflect the most extreme and frequent malicious tampering during the forwarding process; the energy level, determined by the number of data packets sent and received by the node and the battery level, can reflect the node's activity and battery status; the node's resource score is determined by the node's energy level, processing power, memory, and communication range, and by adjusting the weights according to specific application scenarios, the node's resource score can reflect the node's data transmission capabilities under different scenario requirements.

[0023] In one possible implementation, the message integrity record log corresponding to any one of the nodes is obtained in the following way:

[0024] Based on the number of times the target data packet is modified by any node, the message integrity of the target data packet is updated, and the updated message integrity of the target data packet and the number of times the target data packet is modified by any node are saved to the message integrity record log corresponding to any node.

[0025] For any data packet that is not modified and forwarded by any node, the message integrity and zero modification count carried by the unmodified and forwarded data packet are directly saved to the message integrity record log corresponding to any node.

[0026] In this embodiment, for each data packet received by the node, the modification count of the target data packet that has been modified by the node is monitored, and the message integrity of the target data packet is updated. Simultaneously, the modification count and message integrity of data packets forwarded by the node are recorded in the corresponding message integrity log of the node. This achieves the purpose of recording in detail the node's tampering behavior during transmission, providing a basis for subsequent analysis and decision-making.

[0027] In one possible implementation, updating the message integrity of the target data packet based on the number of modifications made to the data packet by any one node includes:

[0028] The message change value is determined by multiplying a preset reduction coefficient by the number of times the target data packet is modified by any node. The reduction coefficient is a preset fixed value or a value dynamically adjusted according to preset rules. The preset rules include adjustments based on a comparison of at least one of the following: real-time network load and the delay time of data packet transmission by any node, with a preset threshold.

[0029] The difference between the message integrity carried by the target data packet and the message change value is determined, and the message integrity carried by the target data packet is updated to the difference.

[0030] In this application embodiment, a method for updating the message integrity of a target data packet is provided. By using a value that is adaptively adjusted based on a preset value or the actual network conditions as a reduction coefficient, and updating the message integrity based on the product of the reduction coefficient and the number of modifications, the impact of real-time network changes and the number of modifications can be quantified, so that the message integrity can reflect the integrity of the data packets forwarded by the node, thereby helping to more accurately assess the malicious behavior of the node.

[0031] In one possible implementation, the classification decision model is trained in the following manner:

[0032] After receiving sample data from normal and malicious nodes, the sample data is preprocessed, and the sample data includes comprehensive trust value, message integrity and resource score;

[0033] The preprocessed sample data is divided into a training set and a validation set;

[0034] The classification decision model is trained on the training set, and the weights and biases of the classification decision model are optimized based on gradient descent and loss function until the classification decision model meets the preset termination condition. The termination condition is that the classification accuracy of the classification decision model on the validation set meets the preset requirement or the number of training times reaches the preset threshold.

[0035] In one possible implementation, the method further includes:

[0036] Based on the comprehensive trust value of each trusted node, an authentication node is selected from each trusted node, and the selected authentication node is notified to the trusted nodes in the network. This enables the authentication node to generate certificates for the source node and the destination node for encrypting and verifying data packets when it determines that both the source node and the destination node corresponding to the forwarding request are trusted nodes.

[0037] In this embodiment, the authentication node selected by the trusted nodes in the network is notified so that the authentication node can generate a certificate for encrypting and verifying data packets between the trusted nodes that need to forward data packets. This can effectively identify and isolate untrusted nodes and improve network security.

[0038] Secondly, this application provides a method for protecting against malicious nodes, the method comprising:

[0039] Based on notifications received from the network, after determining itself as an authentication node, it receives forwarding requests from other nodes in the network; wherein, the authentication node is selected by the network from trusted nodes based on the comprehensive trust value of each trusted node, and the trusted node is determined by the network based on the classification results obtained after inputting the comprehensive trust value, message integrity and resource score of each node into a pre-trained classification decision model;

[0040] Upon receiving a forwarding request, the source node and destination node corresponding to the forwarding request are determined based on the source node identifier and destination node identifier in the forwarding request;

[0041] If the source node and the destination node are trusted nodes, a first certificate is generated for the source node and sent to the source node so that the source node can use the first certificate to encrypt data packets and send them to the destination node. A second certificate is generated for the destination node and sent to the destination node so that the destination node can use the second certificate to decrypt data packets received from the source node.

[0042] In this embodiment, the authentication node verifies forwarding requests from other nodes and generates certificates for encrypting and verifying data packets for the source and destination nodes that pass the verification. This can effectively identify and isolate untrusted nodes, ensure the security and integrity of data packets during transmission, and improve network security.

[0043] In one possible implementation, generating a first certificate for the source node and a second certificate for the destination node includes:

[0044] Generate a first public key and a first private key for the source node, wherein the first public key is used to encrypt data packets and the first private key is used to decrypt data packets encrypted by the first public key;

[0045] A second public key and a second private key are generated for the destination node, wherein the second public key is used to encrypt data packets and the second private key is used to decrypt data packets encrypted by the second public key;

[0046] Based on the generated first public key, first private key, second public key, and second private key, a first certificate is generated for the source node, and a second certificate is generated for the destination node. The first certificate contains the first private key and the second public key, and the second certificate contains the second private key and the first public key.

[0047] Thirdly, this application provides a method for protecting against malicious nodes, the method comprising:

[0048] Based on the notification received from the network, an authentication node is determined. The authentication node is selected by the network from trusted nodes based on the comprehensive trust value of each trusted node. The trusted node is determined by the network based on the classification result obtained after inputting the comprehensive trust value of each node, message integrity, and resource score into a pre-trained classification decision model.

[0049] When a data packet needs to be forwarded to a destination node, a forwarding request is initiated to the authentication node. The forwarding request includes a source node identifier and a destination node identifier. After determining that the source node corresponding to the source node identifier and the destination node corresponding to the destination node identifier are trusted nodes, the authentication node sends a first certificate to the source node and a second certificate to the destination node. The first certificate contains a first private key and a second public key, and the second certificate contains a second private key and a first public key. The first public key is used to encrypt data packets, the first private key is used to decrypt data packets encrypted with the first public key, the second public key is used to encrypt data packets, and the second private key is used to decrypt data packets encrypted with the second public key.

[0050] After receiving the first certificate from the authentication node, the data packet is encrypted using the second public key contained in the first certificate and then forwarded to the destination node.

[0051] In this embodiment, when a source node needs to forward a data packet to a destination node it has not communicated with before, it first sends a forwarding request generated based on its own source node identifier and the destination node identifier to the authentication node. Then, it uses the first certificate received from the authentication node to encrypt the data packet and transmit it to the destination node. This can effectively identify and isolate untrusted nodes, thereby ensuring the security and integrity of the data packet during transmission and improving network security.

[0052] Fourthly, this application provides a method for protecting against malicious nodes, the method comprising:

[0053] The network receives a second certificate sent by an authentication node. The authentication node is selected from trusted nodes by the network based on the comprehensive trust value of each trusted node. The trusted node is determined by the network based on the classification result obtained after inputting the comprehensive trust value, message integrity and resource score of each node into a pre-trained classification decision model. The second certificate is generated by the authentication node after determining that the source node and destination node corresponding to the forwarding request belong to trusted nodes. The forwarding request is sent by the source node to the authentication node. The second certificate contains a second private key and a first public key.

[0054] The system receives data packets sent by the source node, which are obtained by encrypting the data packets using the second public key contained in the first certificate. The first certificate is generated by the authentication node after determining that the source node and destination node corresponding to the forwarding request belong to trusted nodes. The first certificate contains a first private key and a second public key. The first public key is used to encrypt data packets, and the first private key is used to decrypt data packets encrypted with the first public key. The second public key is used to encrypt data packets, and the second private key is used to decrypt data packets encrypted with the second public key.

[0055] The data packets sent by the source node are decrypted using the second private key.

[0056] In this embodiment of the application, after the destination node receives the second certificate from the authentication node, it uses the second certificate to decrypt the data packet received from the source node. This can effectively identify and isolate untrusted nodes, thereby ensuring the security and integrity of the data packet during transmission and improving network security.

[0057] Fifthly, this application provides a malicious node detection device, the device comprising:

[0058] The first evaluation data preparation module is used to determine the forwarding success rate, message integrity, energy level and resource score of each node based on the monitoring data of each node in the network. The message integrity represents the integrity of the data packets forwarded by the node, the energy level represents the activity and power status of the node, and the resource score represents the transmission capacity of the node.

[0059] The second evaluation data preparation module is used to determine the comprehensive trust value of each node based on the forwarding success rate, message integrity and energy level of each node. The comprehensive trust value represents the trustworthiness of the node.

[0060] The node attribute classification module is used to input the comprehensive trust value, message integrity and resource score of each node into the pre-trained classification decision model, and classify each node into a trustworthy node and an untrustworthy node based on the output classification results.

[0061] Sixthly, this application provides a malicious node protection device, the device comprising:

[0062] The authentication node identity verification module is used to determine itself as an authentication node based on notifications received from the network, and then receive forwarding requests from other nodes in the network. The authentication node is selected by the network from trusted nodes based on the comprehensive trust value of each trusted node. The trusted node is determined by the network based on the classification results obtained by inputting the comprehensive trust value, message integrity and resource score of each node into a pre-trained classification decision model.

[0063] The forwarding request verification module is used to determine the source node and destination node corresponding to the forwarding request based on the source node identifier and destination node identifier in the forwarding request after receiving the forwarding request.

[0064] The certificate generation module is configured to generate a first certificate for the source node and send the first certificate to the source node if the source node and the destination node are trusted nodes, so that the source node can use the first certificate to encrypt data packets and send them to the destination node; and to generate a second certificate for the destination node and send the second certificate to the destination node, so that the destination node can use the second certificate to decrypt data packets received from the source node.

[0065] Seventhly, this application provides a malicious node protection device, the device comprising:

[0066] The authentication node determination module is used to determine the authentication node based on the notification received from the network. The authentication node is selected by the network from trusted nodes based on the comprehensive trust value of each trusted node. The trusted node is determined by the network based on the classification result obtained after inputting the comprehensive trust value of each node, message integrity and resource score into a pre-trained classification decision model.

[0067] The request initiation module is used to initiate a forwarding request to the authentication node when it is necessary to forward a data packet to the destination node. The forwarding request includes a source node identifier and a destination node identifier, so that after the authentication node determines that the source node corresponding to the source node identifier and the destination node corresponding to the destination node identifier are trusted nodes, it sends a first certificate to the source node and a second certificate to the destination node. The first certificate contains a first private key and a second public key, and the second certificate contains a second private key and a first public key. The first public key is used to encrypt the data packet, the first private key is used to decrypt the data packet encrypted by the first public key, the second public key is used to encrypt the data packet, and the second private key is used to decrypt the data packet encrypted by the second public key.

[0068] The encryption module is used to encrypt the data packet using the second public key contained in the first certificate after receiving the first certificate from the authentication node, and then forward it to the destination node.

[0069] Eighthly, this application provides a malicious node protection device, the device comprising:

[0070] The certificate receiving module is used to receive a second certificate sent by an authentication node. The authentication node is selected by the network from trusted nodes based on the comprehensive trust value of each trusted node. The trusted node is determined by the network based on the classification result obtained after inputting the comprehensive trust value, message integrity and resource score of each node into a pre-trained classification decision model. The second certificate is generated by the authentication node after determining that the source node and destination node corresponding to the forwarding request belong to trusted nodes. The forwarding request is sent by the source node to the authentication node. The second certificate contains a second private key and a first public key.

[0071] A data packet receiving module is used to receive data packets sent by the source node. The data packets sent by the source node are obtained by encrypting them using a second public key contained in a first certificate. The first certificate is generated by the authentication node after determining that the source node and destination node corresponding to the forwarding request belong to trusted nodes. The first certificate contains a first private key and a second public key. The first public key is used to encrypt data packets, and the first private key is used to decrypt data packets encrypted with the first public key. The second public key is used to encrypt data packets, and the second private key is used to decrypt data packets encrypted with the second public key.

[0072] The decryption module is used to decrypt the data packets sent by the source node using the second private key.

[0073] Ninthly, embodiments of this application provide an apparatus including at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform a malicious node detection method as described in any of the first aspects of this application, or a malicious node protection method as described in any of the second aspects of this application, or a malicious node protection method as described in any of the third aspects of this application, or a malicious node protection method as described in any of the fourth aspects of this application.

[0074] In a tenth aspect, embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, enables a terminal device to perform a malicious node detection method as described in any of the first aspects of this application, or a malicious node protection method as described in any of the second aspects of this application, or a malicious node protection method as described in any of the third aspects of this application, or a malicious node protection method as described in any of the fourth aspects of this application.

[0075] The technical solutions provided by the embodiments of this application bring at least the following beneficial effects:

[0076] This application provides a method, apparatus, and device for detecting and protecting against malicious nodes. First, based on monitoring data of each node in the network, the forwarding success rate, message integrity, energy level, and resource score of each node are determined. Message integrity characterizes the integrity of data packets forwarded by the node, energy level characterizes the node's activity and power status, and resource score characterizes the node's transmission capacity. Next, based on the forwarding success rate, message integrity, and energy level of each node, a comprehensive trust value is determined, which characterizes the node's credibility. Finally, the comprehensive trust value, message integrity, and resource score of each node are input into a pre-trained classification decision model, and based on the output classification results, each node is divided into trusted nodes and untrusted nodes. This application determines trusted nodes by comprehensively considering the forwarding success rate, message integrity, energy level, and resource score of nodes, which can more comprehensively assess the credibility of nodes and identify untrusted nodes before malicious behavior is fully revealed, thereby improving the overall security of the network.

[0077] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0078] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0079] Figure 1 is a schematic flowchart of a malicious node detection method provided in an embodiment of this application;

[0080] Figure 2 illustrates the multi-dimensional decision representation of the node context provided in an embodiment of this application.

[0081] Figure 3 is a schematic diagram of the authentication node selection process provided in an embodiment of this application;

[0082] Figure 4 is a schematic diagram of node interaction provided in an embodiment of this application;

[0083] Figure 5 is a schematic diagram of a malicious node detection device provided in an embodiment of this application;

[0084] Figure 6 is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0085] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. Unless otherwise specified, the embodiments and features in the embodiments of this application can be arbitrarily combined with each other. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than that shown here.

[0086] The terms "first" and "second" in the specification, claims, and accompanying drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive protection. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices. The term "multiple" in this application can mean at least two, for example, two, three, or more, and is not limited by the embodiments of this application.

[0087] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of this application, including various details to aid understanding. These embodiments should be considered merely exemplary. Therefore, those skilled in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of this application. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description. It should be noted that in the embodiments of this application, certain existing industry solutions such as software, components, and models may be mentioned. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solutions of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0088] Before introducing the malicious node detection and protection method provided in the embodiments of this application, the technical background of the embodiments of this application will be described in detail below for ease of understanding.

[0089] Mobile Ad-hoc Networks (MANETs) are a group of self-organizing networks without fixed infrastructure support, where nodes communicate with each other via wireless links. Black hole attacks and gray hole attacks are common forms of network attacks in MANETs. Specifically, a black hole attack involves a malicious node posing as a legitimate node to attract other nodes to send data packets to it, then discarding these packets instead of forwarding them; a gray hole attack involves a malicious node selectively discarding or delaying the forwarding of some data packets after receiving them. Both types of attacks affect the reliability of communication.

[0090] In related technologies, the protection method against the above-mentioned attacks is to first filter out nodes that have been identified as malicious by referring to blacklists and whitelists when nodes are making routing selections. Then, by analyzing the routing information returned by the next-hop node, it is determined whether the behavior of the next-hop node is consistent with the behavior pattern of normal nodes, thereby determining whether the next-hop node is a malicious node. Once a node is identified as a malicious node, it is added to the blacklist to prevent it from continuing to affect the network.

[0091] However, the aforementioned behavior pattern judgment method based on routing information has a relatively single judgment dimension and is only effective for malicious nodes that have already shown malicious behavior. It is slow to react to malicious nodes before their malicious behavior is fully revealed, and there may still be false alarms or missed alarms.

[0092] In view of this, in order to identify untrusted nodes before malicious behavior is fully revealed and improve the overall security of the network, embodiments of this application provide a method, apparatus, device, and medium for detecting and protecting against malicious nodes. Some preferred embodiments of this application are described below with reference to the accompanying drawings.

[0093] Example 1:

[0094] Figure 1 is a schematic flowchart of a malicious node detection method provided by some embodiments of this application. As shown in Figure 1, the process includes the following steps S101-S103.

[0095] S101: Based on the monitoring data of each node in the network, determine the forwarding success rate, message integrity, energy level and resource score of each node.

[0096] Among them, message integrity characterizes the integrity of data packets forwarded by nodes, energy level characterizes the activity and power status of nodes, and resource score characterizes the transmission capacity of nodes.

[0097] The malicious node detection method provided in this application is applied to virtual computing nodes corresponding to each node in a mobile ad hoc network. These virtual computing nodes can monitor each node in the mobile ad hoc network and acquire monitoring data. Specifically, the virtual computing node can monitor the number of data packets sent and received by each node, the number of data packet modifications, the message integrity of sent data packets, and resource status values. Resource status values ​​include battery level, processing power, memory, and communication range. Processing power characterizes the number of operations a node can execute per unit of time.

[0098] In black hole or gray hole attacks, malicious nodes can easily impersonate normal nodes to tamper with, forward, and discard messages. Therefore, in order to identify untrusted nodes before malicious behavior is fully revealed and improve the overall security of the network, this application focuses on three dimensions: the forwarding stability of nodes on each routing path, the degree of packet tampering, and the nature of resources. Based on the monitoring data of each node, it calculates the forwarding success rate, message integrity, energy level, and resource score of each node, thereby enabling a comprehensive assessment of the node's malicious behavior in subsequent operations.

[0099] In some embodiments, the malicious node detection method of this application may be executed according to a set detection period. That is, the monitoring data used by this application to calculate the forwarding success rate, message integrity, energy level and resource score of each node is the monitoring data collected within the current set detection period.

[0100] The following section introduces the calculation methods for forwarding success rate, message integrity, energy level, and resource score.

[0101] 1. Forwarding success rate:

[0102] As a feasible implementation method, the forwarding success rate of any given node is determined using the following method:

[0103] Determine the ratio of the number of data packets successfully sent by any node to the same destination node to the number of data packets sent to that same destination node;

[0104] From the determined ratios, the smallest ratio is selected as the forwarding success rate of that node.

[0105] For example, when determining the forwarding success rate of node A, if node A has sent data packets to nodes B and C respectively, then nodes B and C are the destination nodes of node A. The two ratios calculated based on the above method can respectively characterize the forwarding stability of node A on routing path AB and routing path AC. By selecting the minimum ratio as the forwarding success rate of node A, it can be ensured that the forwarding success rate of the node reflects the forwarding stability of the node under the worst-case scenario.

[0106] Optionally, this application counts the number of data packets sent and received by each node by setting a self-adding data packet sending field and a data packet receiving field for each node.

[0107] For example, for node A above, its data packet sending field can be defined as F. nA For node B mentioned above, its data packet reception field can be defined as Rec. nB When forwarding data packets from node A to node B, the data packet sending field F... nA Increment; when it is determined that node B has received the data packet, then node B's Rec... nB Increment by itself. Then, calculate the ratio of the number of data packets successfully sent from node A to node B to the number of data packets sent from node A to node B. AB Then, as shown in Formula 1 below:

[0108] In the formula, (P s ) A The number of data packets sent from node A to node B is indicated by the data packet sending field F. nA It can be seen that; (P) r ) B The Rec field represents the number of data packets received by node B from node A. nB It can be known that...

[0109] It should be noted that the ratio of a node's forwarding success rate can be used to evaluate the node's stability on the forwarding path. A node that maintains a high forwarding success rate on all paths indicates high reliability under various conditions, while the minimum ratio reflects the node's performance in the worst-case scenario. Therefore, this application selects the minimum ratio as the node's forwarding success rate to ensure that the node's forwarding success rate reflects its forwarding stability under worst-case conditions.

[0110] Optionally, this application also performs a threshold judgment on the minimum value of the ratio calculated by Formula 1 for each node. If the minimum ratio of a node is lower than the preset threshold, the node can be directly judged as an untrusted node, and subsequent steps will not be performed.

[0111] In some embodiments, after directly determining that a node is an untrusted node, no further steps are performed on that untrusted node. This could mean that the current malicious node detection is no longer performed, or that no further malicious node detection is performed on that untrusted node.

[0112] Optionally, considering that malicious nodes performing black hole or gray hole attacks may receive a large number of data packets from other nodes through masquerading but not forward them, this application also performs a threshold judgment on the total number of data packets received by each node. If the total number of data packets received by a node exceeds the threshold, it can be inferred that the node is an untrusted node, which is likely to lead to data packet loss, and subsequent steps will no longer be executed. The threshold value is set based on experience, such as the total number of nodes.

[0113] In some embodiments, if a node is directly determined to be an untrusted node based on the total number of data packets received by the node exceeding a threshold, no further steps will be performed on the untrusted node. This could mean that the malicious node detection will not be performed on the untrusted node this time, or that no malicious node detection will be performed on the untrusted node thereafter.

[0114] 2. Message Integrity Value (MIV):

[0115] For any given node, the message integrity of that node is determined in the following way:

[0116] Select the message integrity score of the data packet with the most modifications from the message integrity log corresponding to any of the above nodes, and use it as the message integrity score of that node.

[0117] The message integrity record in the message integrity log corresponding to any of the above nodes is determined based on the message integrity carried by the data packet received by that node and the number of times that node modifies the target data packet; wherein, the target data packet is the data packet that the node modifies and then forwards.

[0118] In this embodiment of the application, each node corresponds to a message integrity record log, which records the message integrity of the data packets forwarded by the node and the number of times the node modified the forwarded data packets.

[0119] The number of times a data packet is modified can reflect a node's malicious tendencies. Data packets forwarded by a node generally have high message integrity, indicating high credibility. However, the data packets modified most frequently by a node reflect the most frequent tampering behavior during forwarding, representing extreme behaviors that are more likely to reveal the node's potential malicious intent.

[0120] Therefore, this application selects the message integrity of the data packet with the most modifications among the data packets forwarded by the node as the message integrity of the node, so that the message integrity of the node can reflect the most extreme and frequent malicious tampering during the forwarding process.

[0121] In this embodiment, by focusing on the data packet with the most modifications, the abnormal behavior of a node can be amplified, making it easier to detect. Therefore, even when a node behaves normally in most cases but exhibits obvious malicious behavior in certain situations, this method of focusing on the data packet with the most modifications can also capture these abnormal behaviors.

[0122] Optionally, for any given node, this application selects the message integrity of the data packet with the most modifications as the message integrity of that node, and then performs a threshold judgment on the message integrity of that node. If the message integrity of a node is lower than a preset threshold, the node can be directly determined as an untrusted node, and subsequent steps will not be executed. For example, if the message integrity of a node is 0, it means that the message integrity of the node was already 0 when transmitting the data packet, and then the node is directly defined as a malicious node among the untrusted nodes.

[0123] In some embodiments, a threshold judgment is made based on the message integrity of the node. After directly judging the node as an untrusted node, no further steps are performed on the untrusted node. This can mean that the malicious node detection is no longer performed on the untrusted node, or that no malicious node detection is performed on the untrusted node afterward.

[0124] As a feasible implementation method, the message integrity record log corresponding to any node is obtained through the following steps S201-S202.

[0125] S201, based on the number of times the target data packet is modified by any node, update the message integrity of the target data packet, and save the updated message integrity of the target data packet and the number of times the target data packet is modified by any node to the message integrity log corresponding to that node.

[0126] S202, for any data packet that is not modified and forwarded by any node, the message integrity and zero modification count carried by the unmodified and forwarded data packet are directly saved to the message integrity record log corresponding to that node.

[0127] In this embodiment, for each data packet received by the node, the number of times the target data packet modified by the node is monitored and the message integrity of the target data packet is updated. Simultaneously, the number of modifications and message integrity of data packets forwarded by the node are recorded in the node's corresponding message integrity log, thereby achieving a detailed record of the node's tampering behavior during transmission and providing a basis for subsequent analysis and decision-making.

[0128] For example, for any node, if N data packets are forwarded by the node within the detection period, the message integrity log of the node includes N MIV values ​​(representing the message integrity when the N data packets flow through the node) and the number of times the node modifies the N data packets, where N is an integer.

[0129] As a feasible implementation method, in the above S201, the message integrity carried by the target data packet is updated based on the number of times the data packet is modified by any node, including the following steps S301-S302.

[0130] S301, determine the message change value based on the product of a preset reduction coefficient and the number of times the target data packet is modified by any of the above nodes.

[0131] The reduction coefficient mentioned above is either a preset fixed value or a value that is dynamically adjusted according to preset rules. The preset rules include adjusting the value based on a comparison of at least one of the following: real-time network load, the delay time of data packet transmission at any of the aforementioned nodes, and a preset threshold.

[0132] S302, determine the difference between the message integrity carried by the target data packet and the aforementioned message change value, and update the message integrity carried by the target data packet to this difference.

[0133] In some embodiments, this application helps detect untrusted nodes and improves data transmission security by monitoring changes in data packets at nodes and reducing the MIV of modified data packets when a modification action is detected.

[0134] In practice, the number of times the target data packet (the data packet whose content has been modified by the node) has been modified is determined, and the updated value of the MIV is calculated based on the number of modifications. The calculated updated value is then used to update the MIV carried by the target data packet, and the updated MIV value and the number of modifications are recorded in the node's message integrity log. After that, the node will send the target data packet carrying the updated MIV value to the next node, and the next node will generate new data packets and MIVs in the same way.

[0135] Specifically, the updated value of the target data packet's MIV is calculated using the following formula: MIV new =MIV cur -ΔMIV*m Formula 2

[0136] In the formula, MIV new This is the updated value of MIV. cur ΔMIV represents the message integrity of the target data packet when the node receives it, ΔMIV is the reduction factor, and m is the number of times the node modifies the target data packet.

[0137] Optionally, if the malicious node detection method of this application is executed according to a set detection period, then at the end of each detection period, this application calculates the message integrity of the target data packet forwarded by the node in the current detection period based on the number of times the node modifies the target data packet in the current detection period using the above formula 2.

[0138] Optionally, this application can also update the MIV value of the target data packet immediately by reducing ΔMIV after each detection cycle when a node modifies the target data packet. That is, remove m from Formula 2 above and update the value by (MIV) new =MIV cur -ΔMIV) is used to reduce the message integrity of the target data packet by ΔMIV each time a node is detected to have modified the target data packet within the current detection period.

[0139] In some embodiments, as described above, the reduction coefficient ΔMIV in this application is a preset fixed value or a value dynamically adjusted according to preset rules. The preset rules include adjustments based on a comparison of at least one of the following: real-time network load and the latency of data packet transmission by nodes, with a preset threshold. The aforementioned preset rules may adjust the reduction coefficient ΔMIV based on certain real-time network conditions or security status. The preset rules may include the following reference items one to five:

[0140] Reference item 1, network latency: If data packets encounter long delays during transmission, it indicates that the network may be unstable or at risk of attack, and the value of ΔMIV can be increased.

[0141] Reference item 2, Packet Loss Rate: A high packet loss rate may indicate an unreliable network environment, which may lead to data tampering or loss. In such cases, the value of ΔMIV can be increased.

[0142] Reference item 3, Network Load: If the network load is high, it may mean that intermediate nodes are more vulnerable to attack or abuse, so the value of ΔMIV can be increased.

[0143] Reference item four, Path Security: If the path a data packet travels through involves multiple untrusted nodes, the value of ΔMIV can be increased.

[0144] Reference item 5, Attack Detection: If the system detects potential attacks or abnormal behaviors (such as tampering, replay attacks, etc.) in real time, the value of ΔMIV can be increased to reflect the potential risks.

[0145] In this application embodiment, a method for updating the message integrity of a target data packet is provided. By using a value that is adaptively adjusted based on a preset value or the actual network conditions as a reduction coefficient, and updating the message integrity based on the product of the reduction coefficient and the number of modifications, the impact of real-time network changes and the number of modifications can be quantified, so that the message integrity can reflect the integrity of the data packets forwarded by the node, which helps to more accurately assess the malicious behavior of the node.

[0146] 3. Energy Level:

[0147] For any given node, its energy level is determined using the following method:

[0148] The energy level of any given node is determined by the ratio of the sum of the number of data packets sent and received by that node and the battery power of that node to the total number of nodes in the network.

[0149] In this embodiment, the number of data packets sent and received by a node reflects its activity level in the network, while the battery level reflects the node's energy reserves. Nodes with sufficient battery power have stronger sustainability and can remain active for a longer period of time. The ratio of the sum of the number of data packets sent and received by a node and the battery level to the total number of nodes in the network can be used to assess the activity level and battery status of a single node in the network.

[0150] Therefore, the energy level determined by the number of data packets sent and received by the node and the battery level in this embodiment can reflect the node's activity and battery status. Specifically, the energy level of a node is calculated as follows:

[0151] In the formula, Energy node This refers to the energy level, where PF is the number of data packets sent by the node, PR is the number of data packets received by the node, and BP is the node's battery level. i-j The number of nodes in the network indicates that the number of nodes in the network ranges from i to j.

[0152] 4. Resource rating:

[0153] For any given node, its resource score is determined using the following method:

[0154] The resource score of any given node is determined by weighted summation of its energy level, processing power, memory, and communication range.

[0155] As can be seen from the foregoing embodiments, the energy level of this application reflects the power status and activity level of a node. Therefore, in this embodiment, the energy level can be used as a reference indicator for resource scoring of a node. The reasons for selecting the other three reference indicators—processing capacity, memory, and communication range—are as follows.

[0156] Processing capacity: refers to the number of operations a node can execute per unit of time. Processing capacity reflects the computing power of a node. Nodes with high processing capacity can process data packets faster and improve network response speed.

[0157] Memory: Memory reflects the storage capacity of a node. Nodes with more memory can store more data and have higher data forwarding efficiency.

[0158] Communication range: Communication range reflects a node's coverage capability. Nodes with a high communication range can communicate with more nodes and have stronger data forwarding capabilities.

[0159] Therefore, in this embodiment of the application, the resource score of a node is determined by its energy level, processing power, memory and communication range, and the weight of each indicator in the resource score is adjusted according to the specific application scenario, so that the resource score of the node can comprehensively reflect the data transmission capability of the node in different scenarios.

[0160] Specifically, the resource score of a node is calculated using the following formula: R = w1·Energy node +w2·P node+w3·Mem node +w4·C node Formula 4

[0161] In the formula, R is the resource score, and Energy node It refers to the energy level, P. node It refers to processing power, Mem node It's memory, C. node This refers to the communication range, and w1 to w4 are the weighting coefficients of each indicator. The sum of the weighting coefficients is 1.

[0162] Among them, the processing capacity P of a single node node The calculation method is shown in the following formula: P node =f·i Formula 5

[0163] In the formula, f is the processor's clock frequency (in Hertz), and i is the number of data packets that the node can forward per clock cycle.

[0164] The memory of a node (Mem) node The calculation method is shown in the following formula: Mem node =RAM total -Mem used Formula 6

[0165] In the formula, RAM total Mem is the total memory of the node. used Mem is the memory already used by the node. used It is maintained by the memory usage table in the node.

[0166] The communication range of a node is determined by the transmission power and receiving sensitivity of the wireless signal, C node The calculation method can be found in existing technologies and will not be described here.

[0167] Optionally, for any given node, after determining its battery level, processing power, memory, and communication range, and before determining the node's energy level and resource score, this application also performs a threshold judgment on the node's battery level, processing power, memory, and communication range to confirm whether the node is in an abnormal state. If the node is in an abnormal state, it can be directly determined as an untrusted node, and the malicious node detection will not be performed on that node. For example, if the node's battery level is 0 or its communication range is lower than a set value, it is directly considered to be in an abnormal state, and the malicious node detection will not be performed on that node.

[0168] S102: Based on the forwarding success rate, message integrity, and energy level of each node, determine the comprehensive trust value of each node. The comprehensive trust value represents the trustworthiness of the node.

[0169] As can be seen from the foregoing embodiments, a high forwarding success rate indicates that a node can reliably forward data packets in the network and has high reliability; a high message integrity indicates that a node can maintain the integrity of data when forwarding data packets and the degree of data tampering is low; and a high energy level indicates that a node has high activity and strong long-term survival ability.

[0170] In this embodiment, considering that forwarding success rate, message integrity and energy level can all change dynamically according to the actual behavior of the node, while resource score, although also dynamic, changes relatively slowly, this application selects the comprehensive trust value obtained by combining the three indicators of forwarding success rate, message integrity and energy level, so as to initially and comprehensively reflect the trustworthiness of the node, and use it as data for one dimension of the subsequent input classification decision model.

[0171] Optionally, this application determines the comprehensive trust value of each node by summing the forwarding success rate, message integrity, and energy level of each node. The calculation method for the comprehensive trust value of a node is shown in the following formula: InteTrust node =Trust node +MIV node +Energy node Formula 7

[0172] In the formula, InteTrust node It is a comprehensive trust score. node It refers to the forwarding success rate of the node, MIV. node It refers to the message integrity of the node, Energy node It refers to the energy level of the node.

[0173] Optionally, for Formula 7, this application may also determine the comprehensive trust value of each node based on the weighted sum of the forwarding success rate, message integrity and energy level of each node. The weight of each specific indicator is set according to the actual scenario and needs.

[0174] In some embodiments, for any given node, this application uses the comprehensive trust value InteTrust of all nodes. node After normalizing each node to the range of 0 to 1 and classifying them into different trust levels based on the normalization results, the system further determines whether a node is in an abnormal state and whether further steps need to be performed on the node based on its trust level.

[0175] For example, this application sets the normalized comprehensive trust value to correspond to four trust levels: 0-0.4 is "low trust", 0.41-0.6 is "medium trust", 0.61-0.8 is "high trust", and 0.81-1 is "very high trust". If a node's trust level is low trust, the node can be directly determined as an untrusted node, and no further malicious node detection will be performed on that node. Similarly, if a node's trust level is medium trust, the node can be directly determined as an untrusted node, and no further malicious node detection will be performed on that node, but a next malicious node detection can still be performed.

[0176] Specifically, for a node, its overall trust value is InteTrust. node The formula for normalization is as follows:

[0177] In the formula, InteTrust norm It is InteTrust node The normalized result, μ, is InteTrust. node The mean of InteTrust, σ is the value of InteTrust. node The standard deviation.

[0178] S103: Input the comprehensive trust value, message integrity and resource score of each node into the pre-trained classification decision model, and classify each node into a trustworthy node and an untrustworthy node based on the output classification results.

[0179] As can be seen from the foregoing embodiments, the comprehensive trust value can initially and comprehensively reflect the trustworthiness of a node; message integrity characterizes the integrity and degree of tampering of data when a node forwards data packets; and resource score characterizes the transmission capability of a node. Therefore, in order to identify untrusted nodes before malicious behavior is fully revealed and improve the overall security of the network, this application inputs the comprehensive trust value, message integrity, and resource score of each node into a pre-trained classification decision model, and classifies each node into trusted nodes and untrusted nodes based on the output classification results.

[0180] As a feasible implementation method, this application generates and stores node attributes and node classification results through a Multidimensional Table (MDT). Figure 2 shows a schematic representation of the multidimensional decision table describing the node context provided in an embodiment of this application. Specifically, the multidimensional decision table consists of a context classification table and a result output T. output The table structure is as follows. The context classification table stores the three context dimensions of a node (comprehensive trust value, message integrity, and resource score) and the values ​​associated with those three dimensions. The output is T. output The table is used to store the classification results of the nodes. If there are n nodes, the formula for the multidimensional decision table is as follows:

[0181] In the formula, T out (Node i T represents the classification result for node i. trust (Node i Let T be the overall trust value of node i. MIV (Node i T represents the message integrity of node i. prop (Node i ) represents the resource score of node i.

[0182] The three context classification tables include the comprehensive trust value table T. trust Message completeness table T MIV Resource rating table T prop Specifically, there are three context classification tables and a result output table T. output The steps for generating it are as follows.

[0183] 1. Comprehensive Trust Value Table T trust

[0184] T trust The InteTrust value of a node node The normalized value of InteTrust norm The table is composed of values ​​ranging from 0 to 1, with each row representing a node and each column representing the overall trust value of that node. The table structure is as follows:

[0185] Table 1. Structure of the T_trust table

[0186] 2. Message Completeness Table T MIV

[0187] T MIV The table consists of a message integrity MIV field for each node. Each row represents a node. The second column represents the message integrity MIV of the data packets forwarded by that node, and the third column represents the number of times the node modified the data packets (Times). When determining the message integrity of a node, only the MIV of the row with the largest Times value is taken from the table. The table structure is as follows:

[0188] Table 2 T MIV Table Structure

[0189] 3. Resource Scoring Sheet T prop

[0190] T prop It consists of the resource score R value of each node, and the R value changes continuously as the network changes. prop Energy levelnode Processing capacity P node Memory (Mem) node Communication range C node The table is structured as follows: Each row represents a node.

[0191] Table 3 T prop Table Structure

[0192] 4. Output table T output

[0193] T output It consists of the classification results Output of the nodes by the classification decision model.

[0194] Table 4 T output Table Structure

[0195] In some embodiments, this application detects malicious nodes based on a multidimensional decision table, which can integrate the contextual information of all nodes in the network, effectively handle uncertainties in the network, improve the comprehensiveness of malicious node detection, and the decision logic of the multidimensional decision table has strong scalability. It can be adjusted through machine learning or expert knowledge, and by adding tables corresponding to different dimensions, it can adapt to the ever-changing network environment and optimize the node detection effect.

[0196] As a feasible implementation method, the above classification decision model is trained using the following steps S401-S403.

[0197] S401: After receiving sample data from normal and malicious nodes, the sample data is preprocessed. The sample data includes comprehensive trust value, message integrity and resource score.

[0198] S402 divides the preprocessed sample data into a training set and a validation set.

[0199] S403 trains a classification decision model based on the training set, and optimizes the weights and biases of the classification decision model based on gradient descent and loss function until the classification decision model meets the preset termination condition.

[0200] Optionally, the above termination condition is that the classification accuracy of the classification decision model on the validation set meets the preset requirements or the number of training iterations reaches the preset threshold.

[0201] In some embodiments, the classification decision model described above is constructed using the perceptron linear decision function PLA. The feature vector input to the classification decision model for each node is composed of the three items in Tables 1-3: InteTrust value. norm The score consists of Message Integrity (MIV) and Resource Score (R).

[0202] If there are n nodes in the network, the sample vector input to the classification decision model can be represented as: X n ={x1,x2…x t} T t represents the number of dimensions (in this application t=3, corresponding to the three input dimensions of comprehensive trust value, message integrity and resource score), n represents the nth node; the sample output y can be classified as a malicious node (1) and a malicious node (-1).

[0203] For example, when the training set includes 100 samples, 50 positive and 50 negative, the feature dimension is set to 1. The decision rule formula for the classification decision model is as follows:

[0204] In the formula, x∈X n For example, the trust node boundary value is set to 0.41, therefore the bias value b is -0.41. For each training sample (x) i ,y i The computational perceptron outputs y. i ′ =w T x i +b, and output y based on the perceptron. i ′ Compared with the actual situation y i In contrast, if the predicted distance is too large, the weight vector w and bias b can be updated according to the PLA learning rule: w←w+η·(y i ′-y i )·x i b←b+η·(y i ′-y i )

[0205] Where η is the learning rate. To reduce computational costs and improve model training efficiency, gradient descent is used to optimize the classification line by calculating the gradient and updating the parameters, as follows:

[0206] The overall loss function is the sum of the losses over all training samples as follows:

[0207] Where L(w,b) is the loss function. These are the gradients of the loss function with respect to the weights and biases, respectively.

[0208] Based on the weight vector w and bias b obtained from the training, the final function f(x) = sign(w·x+b) is obtained by the perceptron method described above, resulting in a classification decision model that can identify malicious nodes in mobile ad hoc networks.

[0209] As a possible implementation method, the above method further includes:

[0210] Based on the comprehensive trust value of each trusted node, an authentication node is selected from each trusted node, and the selected authentication node is notified to the trusted nodes in the network. This enables the authentication node to generate certificates for the source and destination nodes for encrypting and verifying data packets when it is determined that both the source and destination nodes corresponding to the forwarding request are trusted nodes.

[0211] As can be seen from the foregoing embodiments, the comprehensive trust value obtained by combining the three indicators of forwarding success rate, message integrity and energy level can initially and comprehensively reflect the trustworthiness of nodes. Therefore, based on the comprehensive trust value of each node, this application selects an authentication node from each trusted node and notifies the trusted nodes in the network of the selected authentication node. The authentication node generates a certificate for encrypting and verifying data packets for the trusted node that needs to forward data packets. This can effectively identify and isolate untrusted nodes and improve network security.

[0212] Optionally, this application selects the trusted node with the highest comprehensive trust value as the authentication node. As shown in Figure 3, which is a schematic diagram of the authentication node selection process provided in this application embodiment, the process includes the following steps S501-S503.

[0213] S501, determine the overall trust value of each node.

[0214] The method for confirming the overall trust value of each node can be referred to the aforementioned embodiments, and will not be repeated here.

[0215] S502 selects the trusted node with the highest overall trust value as the authentication node and notifies other trusted nodes in the network of the selected authentication node.

[0216] S503, determine whether the certificate generated by the current authentication node has expired. If so, proceed to step S501; otherwise, proceed to step S503.

[0217] Optionally, the validity period of the certificate generated by the authentication node depends on the cycle of performing malicious node detection. That is, each time the malicious node detection method provided in the aforementioned embodiments is executed and a new authentication node is selected, the certificate of the previous authentication node expires.

[0218] Optionally, in addition to reaching the detection period, the triggering conditions for the malicious node detection method in the foregoing embodiments also include detecting that the authentication node has gone offline from the network. At this time, the network will select a new authentication node and notify other trusted nodes in the network.

[0219] In some embodiments, when the authentication node is unable to communicate, the malicious node detection method described in the foregoing embodiments may be executed again to select a new authentication node.

[0220] In some embodiments, when an authentication node becomes unable to communicate, the remaining trusted node with the highest trust value is selected as the new authentication node. This authentication replacement avoids single points of failure when nodes move out of range, thus preventing network security bottlenecks. Trusted nodes can communicate with each other as long as the issued certificate is valid.

[0221] The following section explains the malicious node protection methods implemented by the authentication node, source node, and destination node.

[0222] In some embodiments, this application provides a method for protecting against malicious nodes applied to authentication nodes, the method including the following steps S601-S603.

[0223] S601, after determining itself to be an authentication node based on notifications received from the network, receives forwarding requests from other nodes in the network.

[0224] The aforementioned authentication nodes are selected by the network from trusted nodes based on the comprehensive trust value of each trusted node. The trusted nodes are determined by the network based on the classification results obtained after inputting the comprehensive trust value, message integrity, and resource score of each node into a pre-trained classification decision model.

[0225] S602: Upon receiving a forwarding request, determine the source node and destination node corresponding to the forwarding request based on the source node identifier and destination node identifier in the forwarding request.

[0226] S603, if the source node and the destination node are trusted nodes, then a first certificate is generated for the source node and sent to the source node so that the source node can use the first certificate to encrypt data packets and send them to the destination node, and a second certificate is generated for the destination node and sent to the destination node so that the destination node can use the second certificate to decrypt data packets received from the source node.

[0227] In this embodiment, the authentication node verifies forwarding requests from other nodes and generates certificates for encrypting and verifying data packets for the source and destination nodes that pass the verification. This can effectively identify and isolate untrusted nodes, ensure the security and integrity of data packets during transmission, and improve network security.

[0228] Optionally, the above process of generating the first certificate for the source node and the second certificate for the destination node is implemented through the following steps S701-S703.

[0229] S701, Generate a first public key and a first private key for the source node, wherein the first public key is used to encrypt data packets and the first private key is used to decrypt data packets encrypted by the first public key;

[0230] S702, Generate a second public key and a second private key for the destination node, wherein the second public key is used to encrypt data packets and the second private key is used to decrypt data packets encrypted by the second public key;

[0231] S703 generates a first certificate for the source node and a second certificate for the destination node based on the generated first public key, first private key, second public key and second private key. The first certificate contains the first private key and the second public key, and the second certificate contains the second private key and the first public key.

[0232] In some embodiments, this application provides a method for protecting against malicious nodes applied to source nodes, the method comprising the following steps S801-S803.

[0233] S801 determines the authentication node based on the notification received from the network.

[0234] The aforementioned authentication nodes are selected by the network from trusted nodes based on the comprehensive trust value of each trusted node. The trusted nodes are determined by the network based on the classification results obtained after inputting the comprehensive trust value of each node, message integrity, and resource score into a pre-trained classification decision model.

[0235] S802, when a data packet needs to be forwarded to the destination node, a forwarding request is initiated to the authentication node. The forwarding request includes the source node identifier and the destination node identifier, so that after the authentication node determines that the source node corresponding to the source node identifier and the destination node corresponding to the destination node identifier are trusted nodes, it sends a first certificate to the source node and a second certificate to the destination node. The first certificate contains a first private key and a second public key, and the second certificate contains a second private key and a first public key. The first public key is used to encrypt the data packet, the first private key is used to decrypt the data packet encrypted by the first public key, the second public key is used to encrypt the data packet, and the second private key is used to decrypt the data packet encrypted by the second public key.

[0236] It should be noted that when the source node in this application needs to forward data packets to the destination node but does not have a valid second public key, it initiates a forwarding request to the authentication node.

[0237] S803, after receiving the first certificate from the authentication node, encrypts the data packet using the second public key contained in the first certificate and then forwards it to the destination node.

[0238] In this embodiment, when a source node needs to forward a data packet to a destination node it has not communicated with before, it first sends a forwarding request generated based on its own source node identifier and the destination node identifier to the authentication node. Then, it uses the first certificate received from the authentication node to encrypt the data packet and transmit it to the destination node. This can effectively identify and isolate untrusted nodes, thereby ensuring the security and integrity of the data packet during transmission and improving network security.

[0239] In some embodiments, this application provides a method for protecting against malicious nodes applied to a target node, the method comprising the following steps S901-S903.

[0240] S901 receives the second certificate sent by the authentication node.

[0241] The aforementioned authentication nodes are selected by the network from trusted nodes based on the comprehensive trust value of each trusted node. The trusted nodes are determined by the network based on the classification results obtained after inputting the comprehensive trust value, message integrity and resource score of each node into a pre-trained classification decision model. The second certificate is generated by the authentication node after determining that the source node and destination node corresponding to the forwarding request belong to trusted nodes. The forwarding request is sent by the source node to the authentication node. The second certificate contains the second private key and the first public key.

[0242] S902 receives data packets sent by the source node.

[0243] The data packet sent by the source node is obtained by encrypting it using the second public key contained in the first certificate. The first certificate is generated by the authentication node after determining that the source node and destination node corresponding to the forwarding request are trusted nodes. The first certificate contains a first private key and a second public key. The first public key is used to encrypt the data packet, the first private key is used to decrypt the data packet encrypted by the first public key, the second public key is used to encrypt the data packet, and the second private key is used to decrypt the data packet encrypted by the second public key.

[0244] S903 uses the second private key to decrypt the data packets sent by the source node.

[0245] In this embodiment of the application, after the destination node receives the second certificate from the authentication node, it uses the second certificate to decrypt the data packet received from the source node. This can effectively identify and isolate untrusted nodes, thereby ensuring the security and integrity of the data packet during transmission and improving network security.

[0246] To better illustrate the interaction steps of the authentication node, source node, and destination node corresponding to the malicious node protection method of this application, Figure 4 shows a schematic diagram of node interaction provided in an embodiment of this application. Taking a network including a trusted node, source node A, and destination node B, where source node A needs to forward data packets to destination node B as an example, the interaction process includes the following steps S1001-S1009.

[0247] S1001 After confirming that it is an authentication node, the authentication node generates a shared key among trusted nodes and notifies other trusted nodes of its own authentication node identity and shared key.

[0248] The shared key mentioned above is used to encrypt messages transmitted between trusted nodes. The trusted nodes that receive the messages include source node A and destination node B.

[0249] S1002, Source node A determines the authentication node and shared key based on the notification received from the network.

[0250] S1003, Source A uses a shared key to encrypt the forwarding request before sending it to the authentication node.

[0251] Specifically, when source node A needs to forward a data packet to destination node B, it generates a forwarding request, encrypts it using the shared key, and sends it to the authentication node to request a certificate. The forwarding request includes the source node identifier ID (SID) of source node A. ID ), Destination node identifier ID (D) of destination node B ID The request information is encrypted using the shared key received by the previously authenticated node.

[0252] S1004, when the authentication node decrypts the forwarding request and determines that the decrypted source node identifier and destination node identifier are trusted nodes, it generates a first public key and a first private key for source node A, and a second public key and a second private key for destination node B.

[0253] The first public key (P.key) s The first private key (Pr.key) is used to encrypt data packets. s Used to decrypt the first public key (P.key) s Encrypted data packets; second public key (P.key) d The second private key (Pr.key) is used to encrypt data packets. d Used to decrypt the second public key (P.key) d Encrypted data packets;

[0254] Optionally, if it is determined that the decrypted S ID and D ID If the request includes an untrusted node, the certified node will discard the forwarding request.

[0255] S1005, the authentication node generates the first certificate for the source node A and the second certificate for the destination node B.

[0256] For example, the first certificate: Certificate A =[S ID (Pr.key) s (P.key) d Second Certificate: Certificate B =[D ID (Pr.key) d (P.key) s ].

[0257] S1006, the authentication node sends the first certificate to the source node A after encrypting it with the shared key.

[0258] S1007, the authentication node sends the second certificate to the destination node B after encrypting it with the shared key.

[0259] S1008, after decrypting the first certificate received from the authentication node, source node A uses the decrypted second public key to encrypt the data packet and forwards it to destination node B.

[0260] S1009, Destination node B receives the second certificate sent by the authentication node and uses the decrypted second private key to decrypt the data packet.

[0261] It should be noted that when node B needs to send a data packet to node A, it can verify the second certificate. B Once valid, use the first public key (P.key) directly. s After encrypting the data packet, it can be forwarded to node A.

[0262] Example 2:

[0263] Based on the same technical concept and the above embodiments, this application provides a malicious node detection device. Figure 5 is a schematic diagram of the structure of a malicious node detection device provided in this application embodiment. As shown in Figure 5, the device includes:

[0264] The first evaluation data preparation module 501 is used to determine the forwarding success rate, message integrity, energy level and resource score of each node based on the monitoring data of each node in the network. The message integrity represents the integrity of the data packets forwarded by the node, the energy level represents the activity and power status of the node, and the resource score represents the transmission capability of the node.

[0265] The second evaluation data preparation module 502 is used to determine the comprehensive trust value of each node based on the forwarding success rate, message integrity and energy level of each node. The comprehensive trust value represents the trustworthiness of the node.

[0266] The node attribute classification module 503 is used to input the comprehensive trust value, message integrity and resource score of each node into the pre-trained classification decision model, and classify each node into a trustworthy node and an untrustworthy node based on the output classification results.

[0267] Example 3:

[0268] Based on the same technical concept and the above embodiments, this application provides a malicious node protection device. The device includes:

[0269] The authentication node identity verification module 601 is used to determine itself as an authentication node based on a notification received from the network, and then receive forwarding requests from other nodes in the network; wherein, the authentication node is selected by the network from trusted nodes based on the comprehensive trust value of each trusted node, and the trusted node is determined by the network based on the classification result obtained by inputting the comprehensive trust value, message integrity and resource score of each node into a pre-trained classification decision model;

[0270] The forwarding request verification module 602 is used to determine the source node and destination node corresponding to the forwarding request based on the source node identifier and destination node identifier in the forwarding request after receiving the forwarding request;

[0271] The certificate generation module 603 is configured to generate a first certificate for the source node and send the first certificate to the source node if the source node and the destination node are trusted nodes, so that the source node can use the first certificate to encrypt data packets and send them to the destination node; and to generate a second certificate for the destination node and send the second certificate to the destination node, so that the destination node can use the second certificate to decrypt data packets received from the source node.

[0272] Example 4:

[0273] Based on the same technical concept and the above embodiments, this application provides a malicious node protection device, which includes:

[0274] The authentication node determination module 701 is used to determine the authentication node based on the notification received from the network. The authentication node is selected by the network from trusted nodes based on the comprehensive trust value of each trusted node. The trusted node is determined by the network based on the classification result obtained after inputting the comprehensive trust value, message integrity and resource score of each node into a pre-trained classification decision model.

[0275] The request initiation module 702 is used to initiate a forwarding request to the authentication node when it is necessary to forward a data packet to the destination node. The forwarding request includes a source node identifier and a destination node identifier, so that after the authentication node determines that the source node corresponding to the source node identifier and the destination node corresponding to the destination node identifier are trusted nodes, it sends a first certificate to the source node and a second certificate to the destination node. The first certificate contains a first private key and a second public key, and the second certificate contains a second private key and a first public key. The first public key is used to encrypt the data packet, the first private key is used to decrypt the data packet encrypted by the first public key, the second public key is used to encrypt the data packet, and the second private key is used to decrypt the data packet encrypted by the second public key.

[0276] The encryption module 703 is used to encrypt the data packet using the second public key contained in the first certificate after receiving the first certificate from the authentication node, and then forward it to the destination node.

[0277] Example 5:

[0278] Based on the same technical concept and the above embodiments, this application provides a malicious node protection device, which includes:

[0279] The certificate receiving module 801 is used to receive a second certificate sent by an authentication node. The authentication node is selected by the network from trusted nodes based on the comprehensive trust value of each trusted node. The trusted node is determined by the network based on the classification result obtained after inputting the comprehensive trust value, message integrity and resource score of each node into a pre-trained classification decision model. The second certificate is generated by the authentication node after determining that the source node and destination node corresponding to the forwarding request belong to trusted nodes. The forwarding request is sent by the source node to the authentication node. The second certificate contains a second private key and a first public key.

[0280] The data packet receiving module 802 is used to receive data packets sent by the source node. The data packets sent by the source node are obtained by encrypting them using the second public key contained in the first certificate. The first certificate is generated by the authentication node after determining that the source node and the destination node corresponding to the forwarding request are trusted nodes. The first certificate contains a first private key and a second public key. The first public key is used to encrypt data packets, and the first private key is used to decrypt data packets encrypted with the first public key. The second public key is used to encrypt data packets, and the second private key is used to decrypt data packets encrypted with the second public key.

[0281] The decryption module 803 is used to decrypt the data packets sent by the source node using the second private key.

[0282] Example 6:

[0283] Based on the same technical concept, and on the basis of the above embodiments, this application also provides an electronic device 900, as shown in FIG6, including at least one processor 902; and a memory 901 communicatively connected to the at least one processor; wherein, the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the malicious node detection method or malicious node protection method described in the foregoing embodiments.

[0284] The aforementioned memory 901 is used to store programs. Specifically, the program may include program code, which includes computer operation instructions. Memory 901 can be volatile memory, such as random-access memory (RAM); it can also be non-volatile memory, such as flash memory, hard disk drive (HDD), or solid-state drive (SSD); or it can be any one or a combination of the above-mentioned volatile and non-volatile memory types.

[0285] The processor 902 mentioned above can be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP. It can also be a hardware chip. The hardware chip can be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0286] Example 7:

[0287] Based on the same technical concept, embodiments of this application also provide a computer-readable storage medium storing a computer program, the computer program including program instructions, which, when executed by a computer, cause the computer to perform the malicious node detection method or malicious node protection method described in the foregoing embodiments.

[0288] The aforementioned computer-readable storage medium can be any available medium or data storage device that can be accessed by the processor in the electronic device, including but not limited to magnetic storage such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), optical storage such as CDs, DVDs, BDs, HVDs, etc., and semiconductor storage such as ROMs, EPROMs, EEPROMs, non-volatile memory (NAND FLASH), solid-state drives (SSDs), etc.

[0289] Based on the same inventive concept, this application also provides a computer program product, which includes: computer program code, which, when run on a computer, causes the computer to execute any of the malicious node detection methods or malicious node protection methods discussed above.

[0290] Since the principle behind the problem-solving of the above-mentioned computer program products is similar to that of the malicious node detection method, the implementation of the above-mentioned computer program products can refer to the implementation of the method, and the repeated parts will not be described again.

[0291] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the above-described device and module can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0292] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, apparatuses, or modules, and may be electrical, mechanical, or other forms.

[0293] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0294] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium.

[0295] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product.

[0296] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0297] The technical solutions provided in this application have been described in detail above. Specific examples have been used in this application to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

[0298] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0299] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in one or more blocks of the flowchart illustrations and / or one or more blocks of the block diagrams.

[0300] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0301] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0302] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for detecting malicious nodes, characterized in that, include: Based on the monitoring data of each node in the network, the forwarding success rate, message integrity, energy level and resource score of each node are determined. The message integrity represents the integrity of the data packets forwarded by the node, the energy level represents the activity and power status of the node, and the resource score represents the transmission capacity of the node. Based on the forwarding success rate, message integrity, and energy level of each node, a comprehensive trust value is determined for each node, which represents the trustworthiness of the node. The comprehensive trust value, message integrity, and resource score of each node are input into a pre-trained classification decision model, and each node is divided into a trustworthy node and an untrustworthy node based on the output classification results.

2. The method according to claim 1, characterized in that, For any given node, the forwarding success rate of that node is determined using the following method: Determine the ratio of the number of data packets successfully sent by any node to the same destination node to the number of data packets sent to the same destination node; From the determined ratios, the smallest ratio is selected as the forwarding success rate of any given node; For any given node, the message integrity of that node is determined in the following way: The message integrity of the data packet with the most modifications is selected from the message integrity log corresponding to any one of the nodes and used as the message integrity of that node. The message integrity in the message integrity log corresponding to any one node is determined based on the message integrity carried by the data packet received by that node and the number of times that node modifies the target data packet. The target data packet is the data packet that is modified and forwarded by that node. For any given node, its energy level is determined using the following method: The energy level of any given node is determined by the ratio of the sum of the number of data packets sent and received by any given node and the battery power of any given node to the total number of nodes in the network. For any given node, its resource score is determined using the following method: The resource score of any given node is determined by weighted summation of its energy level, processing power, memory, and communication range.

3. The method according to claim 2, characterized in that, The message integrity log corresponding to any one of the nodes is obtained using the following methods: Based on the number of times the target data packet is modified by any node, the message integrity of the target data packet is updated, and the updated message integrity of the target data packet and the number of times the target data packet is modified by any node are saved to the message integrity record log corresponding to any node. For any data packet that is not modified and forwarded by any node, the message integrity and zero modification count carried by the unmodified and forwarded data packet are directly saved to the message integrity record log corresponding to any node.

4. The method according to claim 3, characterized in that, The step of updating the message integrity of the target data packet based on the number of modifications made to the data packet by any one node includes: The message change value is determined by multiplying a preset reduction coefficient by the number of times the target data packet is modified by any node. The reduction coefficient is a preset fixed value or a value dynamically adjusted according to preset rules. The preset rules include adjustments based on a comparison of at least one of the following: real-time network load and the delay time of data packet transmission by any node, with a preset threshold. The difference between the message integrity carried by the target data packet and the message change value is determined, and the message integrity carried by the target data packet is updated to the difference.

5. The method according to claim 1, characterized in that, The classification decision model is trained in the following manner: After receiving sample data from normal and malicious nodes, the sample data is preprocessed, and the sample data includes comprehensive trust value, message integrity and resource score; The preprocessed sample data is divided into a training set and a validation set; The classification decision model is trained on the training set, and the weights and biases of the classification decision model are optimized based on gradient descent and loss function until the classification decision model meets the preset termination condition. The termination condition is that the classification accuracy of the classification decision model on the validation set meets the preset requirement or the number of training times reaches the preset threshold.

6. The method according to any one of claims 1 to 5, characterized in that, The method further includes: Based on the comprehensive trust value of each trusted node, an authentication node is selected from each trusted node, and the selected authentication node is notified to the trusted nodes in the network. This enables the authentication node to generate certificates for the source node and the destination node for encrypting and verifying data packets when it determines that both the source node and the destination node corresponding to the forwarding request are trusted nodes.

7. A method for protecting against malicious nodes, characterized in that, include: Based on notifications received from the network, after determining itself as an authentication node, it receives forwarding requests from other nodes in the network; wherein, the authentication node is selected by the network from trusted nodes based on the comprehensive trust value of each trusted node, and the trusted node is determined by the network based on the classification results obtained after inputting the comprehensive trust value, message integrity and resource score of each node into a pre-trained classification decision model; Upon receiving a forwarding request, the source node and destination node corresponding to the forwarding request are determined based on the source node identifier and destination node identifier in the forwarding request; If the source node and the destination node are trusted nodes, a first certificate is generated for the source node and sent to the source node so that the source node can use the first certificate to encrypt data packets and send them to the destination node. A second certificate is generated for the destination node and sent to the destination node so that the destination node can use the second certificate to decrypt data packets received from the source node.

8. The method according to claim 7, characterized in that, The process of generating a first certificate for the source node and a second certificate for the destination node includes: Generate a first public key and a first private key for the source node, wherein the first public key is used to encrypt data packets and the first private key is used to decrypt data packets encrypted by the first public key; A second public key and a second private key are generated for the destination node, wherein the second public key is used to encrypt data packets and the second private key is used to decrypt data packets encrypted by the second public key; Based on the generated first public key, first private key, second public key, and second private key, a first certificate is generated for the source node, and a second certificate is generated for the destination node. The first certificate contains the first private key and the second public key, and the second certificate contains the second private key and the first public key.

9. A method for protecting against malicious nodes, characterized in that, include: Based on the notification received from the network, an authentication node is determined. The authentication node is selected by the network from trusted nodes based on the comprehensive trust value of each trusted node. The trusted node is determined by the network based on the classification result obtained after inputting the comprehensive trust value of each node, message integrity, and resource score into a pre-trained classification decision model. When a data packet needs to be forwarded to a destination node, a forwarding request is initiated to the authentication node. The forwarding request includes a source node identifier and a destination node identifier. After determining that the source node corresponding to the source node identifier and the destination node corresponding to the destination node identifier are trusted nodes, the authentication node sends a first certificate to the source node and a second certificate to the destination node. The first certificate contains a first private key and a second public key, and the second certificate contains a second private key and a first public key. The first public key is used to encrypt data packets, the first private key is used to decrypt data packets encrypted with the first public key, the second public key is used to encrypt data packets, and the second private key is used to decrypt data packets encrypted with the second public key. After receiving the first certificate from the authentication node, the data packet is encrypted using the second public key contained in the first certificate and then forwarded to the destination node.

10. A method for protecting against malicious nodes, characterized in that, include: The network receives a second certificate sent by an authentication node. The authentication node is selected from trusted nodes by the network based on the comprehensive trust value of each trusted node. The trusted node is determined by the network based on the classification result obtained after inputting the comprehensive trust value, message integrity and resource score of each node into a pre-trained classification decision model. The second certificate is generated by the authentication node after determining that the source node and destination node corresponding to the forwarding request belong to trusted nodes. The forwarding request is sent by the source node to the authentication node. The second certificate contains a second private key and a first public key. The system receives data packets sent by the source node, which are obtained by encrypting the data packets using the second public key contained in the first certificate. The first certificate is generated by the authentication node after determining that the source node and destination node corresponding to the forwarding request belong to trusted nodes. The first certificate contains a first private key and a second public key. The first public key is used to encrypt data packets, and the first private key is used to decrypt data packets encrypted with the first public key. The second public key is used to encrypt data packets, and the second private key is used to decrypt data packets encrypted with the second public key. The data packets sent by the source node are decrypted using the second private key.

11. A malicious node detection device, characterized in that, include: The first evaluation data preparation module is used to determine the forwarding success rate, message integrity, energy level and resource score of each node based on the monitoring data of each node in the network. The message integrity represents the integrity of the data packets forwarded by the node, the energy level represents the activity and power status of the node, and the resource score represents the transmission capacity of the node. The second evaluation data preparation module is used to determine the comprehensive trust value of each node based on the forwarding success rate, message integrity and energy level of each node. The comprehensive trust value represents the trustworthiness of the node. The node attribute classification module is used to input the comprehensive trust value, message integrity and resource score of each node into the pre-trained classification decision model, and classify each node into a trustworthy node and an untrustworthy node based on the output classification results.

12. A malicious node protection device, characterized in that, include: The authentication node identity verification module is used to determine itself as an authentication node based on notifications received from the network, and then receive forwarding requests from other nodes in the network. The authentication node is selected by the network from trusted nodes based on the comprehensive trust value of each trusted node. The trusted node is determined by the network based on the classification results obtained by inputting the comprehensive trust value, message integrity and resource score of each node into a pre-trained classification decision model. The forwarding request verification module is used to determine the source node and destination node corresponding to the forwarding request based on the source node identifier and destination node identifier in the forwarding request after receiving the forwarding request. The certificate generation module is configured to generate a first certificate for the source node and send the first certificate to the source node if the source node and the destination node are trusted nodes, so that the source node can use the first certificate to encrypt data packets and send them to the destination node; and to generate a second certificate for the destination node and send the second certificate to the destination node, so that the destination node can use the second certificate to decrypt data packets received from the source node.

13. A malicious node protection device, characterized in that, include: The authentication node determination module is used to determine the authentication node based on the notification received from the network. The authentication node is selected by the network from trusted nodes based on the comprehensive trust value of each trusted node. The trusted node is determined by the network based on the classification result obtained after inputting the comprehensive trust value of each node, message integrity and resource score into a pre-trained classification decision model. The request initiation module is used to initiate a forwarding request to the authentication node when it is necessary to forward a data packet to the destination node. The forwarding request includes a source node identifier and a destination node identifier, so that after the authentication node determines that the source node corresponding to the source node identifier and the destination node corresponding to the destination node identifier are trusted nodes, it sends a first certificate to the source node and a second certificate to the destination node. The first certificate contains a first private key and a second public key, and the second certificate contains a second private key and a first public key. The first public key is used to encrypt the data packet, the first private key is used to decrypt the data packet encrypted by the first public key, the second public key is used to encrypt the data packet, and the second private key is used to decrypt the data packet encrypted by the second public key. The encryption module is used to encrypt the data packet using the second public key contained in the first certificate after receiving the first certificate from the authentication node, and then forward it to the destination node.

14. A malicious node protection device, characterized in that, include: The certificate receiving module is used to receive a second certificate sent by an authentication node. The authentication node is selected by the network from trusted nodes based on the comprehensive trust value of each trusted node. The trusted node is determined by the network based on the classification result obtained after inputting the comprehensive trust value, message integrity and resource score of each node into a pre-trained classification decision model. The second certificate is generated by the authentication node after determining that the source node and destination node corresponding to the forwarding request belong to trusted nodes. The forwarding request is sent by the source node to the authentication node. The second certificate contains a second private key and a first public key. A data packet receiving module is used to receive data packets sent by the source node. The data packets sent by the source node are obtained by encrypting them using a second public key contained in a first certificate. The first certificate is generated by the authentication node after determining that the source node and destination node corresponding to the forwarding request belong to trusted nodes. The first certificate contains a first private key and a second public key. The first public key is used to encrypt data packets, and the first private key is used to decrypt data packets encrypted with the first public key. The second public key is used to encrypt data packets, and the second private key is used to decrypt data packets encrypted with the second public key. The decryption module is used to decrypt the data packets sent by the source node using the second private key.

15. A malicious node protection device, characterized in that, The method includes at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method as claimed in any one of claims 1-6, or the method as claimed in any one of claims 7-8, or the method as claimed in claim 9, or the method as claimed in claim 10.

Images