CN109951451A - A kind of spoof attack detection method based on intensified learning in mist calculating - Google Patents

Abstract

Mist calculate in a kind of spoof attack detection method based on intensified learning belong to information security field.With the continuous development that mist calculates, while improving information processing rate, more secure communication problems also emerge gradually.It is easy the safety problem by spoof attack herein for the communication in mobile mist calculating between mist node and mobile terminal user, proposes a kind of spoof attack detection algorithm based on intensified learning.We construct the spoof attack model in mobile mist calculating first, then devise the spoof attack detection algorithm based on Q-learning algorithm under the model, realize the detection in a dynamic environment to spoof attack.The invention can effectively take precautions against spoof attack in dynamic environment, and detection performance restrains rapidly and reaches stable, detection accuracy with higher and lower average detected error rate.

Description

A kind of spoof attack detection method based on intensified learning in mist calculating

Technical field

The present invention generates physical layer security key using wireless signal channel characteristic, and uses intensified learning Q-learning Algorithm detects the spoof attack in mist calculating network and raising, to realize mist node and the secure communication of terminal user.Physics Layer key generation belongs to the communications field, belongs to computer field using intensified learning detection spoof attack.

Background technique

In the past ten years, mobile Internet flow exponentially increases, and the attraction of mobile device guides always The significant development of wireless communication and network.Be based particularly on the heterogeneous network of junior unit, magnanimity multiple-input and multiple-output (MIMO) and The revolution of millimeter (mm) wave communication, provides gigabit wirelessly access for the next generation.Long-range cloud data center is with higher Processing capacity and biggish memory storage enable reduction process mobile device to run respective calculating service.However, cloud computing Also there is certain limitation.In this new era, due to the distance between static conditions, Cloud Server and terminal user of cloud compared with Far, user may be not appropriate for low latency, reduction process, the demand of low storage to rely on the application of cloud computing, it is possible to say Cloud computing is not suitable for extensive mobile applications.

Mist calculates the extension as a kind of pair of cloud computing concept, and cloud computing is extended to network edge, can use and set Standby direct transmission link improves throughput of system, solves cloud computing poor mobility, geography information perception is weak, time delay is high etc. asks Topic, but also bring communication and problem of data safety.Equipment used in mist calculating can be router or base station, compare cloud It calculates there is no a large amount of resource, but framework used by mist calculates more shows distribution, than cloud computing closer to equipment, from And it is more able to satisfy the high application of requirement of real-time, support the mobility and location aware of terminal user.In mist calculating, mist section Point user between using it is more open, be more vulnerable to attack wireless transmission.Mist calculates different terminals in network and uses Trusting relationship between family or Internet of Things is that building cooperates environment with the necessary condition of optimization system target, a large amount of movement End equipment is communicated by wireless network with mist layer.Trust due to the opening of wireless channel, between mist node and terminal node It is faced with numerous challenges.Traditional safe practice uses close based on the technologies such as key management, digital signature, authentication Code learns system, but the mobility of terminal makes the online distribution of key, maintenance and management become highly difficult in the wireless network.Cause This is provided secure communication by the methods of signal processing, coded modulation, terminal can be helped to use using safety of physical layer technology Safe transmission scheme is established between family and mist node.Safety of physical layer technology provides while avoiding the side of eavesdropping from obtaining information , safety quantifiable communication reliable to communication party has wide research and application prospect in the case where mist calculates network environment.

Safety of physical layer key generates scheme and is believed to meet the demand for security of radio physical layer, it is using wireless What the reciprocity and randomness of fading channel generated, the essence of safety of physical layer is according to the channel medium between receiving-transmitting sides The uniqueness of channel state information (Channel State Information, CSI), randomness and reciprocity, by starting both sides Security key is generated by local computing according to accessed information, this also solves the distribution problem of key.However, physics Layer security key production rate is heavily dependent on the speed of channel variation, and in static radio environment, channel randomness is very It is low, that is to say, that attacker is easy to initiate spoof attack to user or mist node, therefore invention introduces Q-learning Algorithm detects spoof attack, in dynamic infinite environment can be with accurate detection to spoof attack.

Summary of the invention

The present invention considers the wireless communication connection in mobile mist calculates between mist node and terminal user, and applies Q-learning algorithm identifies spoof attack that mist node or terminal user are subject in intensified learning, solves mist node and end Secure wireless communication problem between end subscriber.

Present invention employs the following technical solutions:

WithIt indicates the channel vector for m-th of training sample that n-th of terminal user sends, usesIndicate n-th of terminal The channel record for m-th of training sample that user sends.We useTo indicate m-th of n-th of terminal user transmission The channel gain of training sample channel vector, so there is following hypothesis testing:

If 1) channel gain of channel vectorGreater than E_{A, B}, then n-th of terminal user send m-th of trained sample This channel vector H₀Transmitted by legitimate user, to see formula (5)；

If 2) channel gain of channel vectorGreater than E_{A | B, I}, then n-th of terminal user send m-th of trained sample This channel vector is to see formula (6) transmitted by illegal user；

Wherein, E_{A, B}It is the estimation channel gain of legal terminal user, E_{A | B, I}It is the estimation channel increasing of potential spoof attack person Benefit

Because the CSI of channel be it is unique,WithIt also is all uniquely, to there is this to assume on this basis real The statistic tested are as follows:

Wherein, | | | | it is Fu Luobinniusi norm, S is indicatedWithBetween European normalized cumulant.So can To think to work asLess than setting test threshold λ when the node be legitimate user, it may be assumed that

In contrast, whenMore than or equal to setting test threshold λ when the node person that is spoof attack, That is:

The precision of inspection assumed above depends on test threshold λ, if threshold value is excessively high will to improve omission factor (MDR)；Such as Fruit threshold value is too low will to improve rate of false alarm (FAR).Herein using the Q-learning algorithms selection appropriate threshold in intensified learning.

Q-learning algorithm is a kind of extensive chemical that can find optimal solution using insufficient condition in dynamic environment Practise algorithm.Mist node is according to current state S_tSelect suitable threshold valueCome maximize current income andWherein C_tIt is t The time of time slot between a signal, thus current income andBe then income before the time slot and with each sample in the time slot Adding up for the resulting income of data, then have following formula:

Wherein γ is the set of the training signal of illegal node-node transmission, and T is the training signal quantity transmitted in each time slot； Use R_xThe movement of processing data packet is represented, is represented with 0 receive data packet respectively, 1 represents refusal data packet,It is income immediately Function.To sum up, if withIndicate the income for receiving to obtain when data packet,Then indicate the income obtained when refusal data packet, The two opposite number each other；g₀Expression receives the income of valid data, g₁Expression is to refuse the income of invalid data；c₀It is that receiving is non- The cost of method data, c₁It is the cost for refusing valid data；P_A(λ) and P_B(λ) is that probability its function under present threshold value λ is as follows:

The Q-learning algorithm based on ε-greedy strategy is introduced herein.Every bout mist node has the probability of ε that can select Suboptimum action, so it is 1- ε that every bout, which selects the probability of optimal action, wherein using λ^*Indicate the optimal value of threshold value, λ belongs to L First of quantization level in quantization level, has probability as follows:

In Q-learning, learning rate determines that new information to what extent covers old information, i.e. μ ∈ (0,1). Q value when current t-th of state threshold is λ is expressed as Q (s_t, λ_t), wherein s_tRepresent t-th of state, λ_tIt is in t-th of time slot State threshold value.Discount factor δ indicates that, to the discount currently rewarded, by δ ∈ (0,1) expression, its bigger algorithm of value more exists Meaning immediate interests and less consider the long-term interests.State s_tMaximum Q functional value by V (s_t) indicate, state s_t+1Maximum Q letter Numerical value is by V (s_t+1) indicate.Therefore, receiving end updates its Q value according to following formula:

V(s_t)←maxQ(s_t, λ), λ ∈ { l/L } 0≤l≤L (15)

The optimal value λ of test threshold^*, wherein λ belongs to first of quantization level in L quantization level, it is given by:

λ^*=arg maxQ (s_t, λ), λ ∈ { l/L } 0≤l≤L (16)

Detailed description of the invention

Fig. 1 moves mist computation model schematic diagram

Fig. 2 key generates model schematic

For Fig. 3 as k=-3, rate of false alarm (FAR) is with the increased change for testing wheel number when testing ρ=20 and ρ=10 respectively Change analysis chart, each round updates 20 Q tables

For Fig. 4 as k=-3, rate of failing to report (MDR) is with the increased change for testing wheel number when testing ρ=20 and ρ=10 respectively Change analysis chart, each round updates 20 Q tables

For Fig. 5 as k=-3, vision response test (AER) is with the increase for testing wheel number when testing ρ=20 and ρ=10 respectively Mutation analysis figure, each round update 20 Q tables

Specific embodiment

System model used herein is as shown in Figure 1, assume herein in 20 × 20m²Room in have random dispersal Node is several, and by communicating wireless signals, wireless signal centre frequency is 2.4GHz for mobile terminal user and mist node.At X In user (X ∈ { 1,2,3 ..., x }, x ∈ N*), Y legitimate node (Y ∈ { 1,2,3 ..., y }, 1≤y≤m) is shared, Z non- Self information can be revised as the letter of legitimate node by method node (Z ∈ { 1,2,3 ..., z }, z=x-y), this Z illegal nodes Breath, to carry out spoof attack.Illegal node can be the mist node of illegal camouflage terminal user, be also possible to illegally pretend eventually The terminal node of end subscriber.

The physical layer key that the present invention uses, which generates scheme, can be roughly divided into four steps: 1) receiving end and transmitting terminal both sides are mutual Send several impulse signals；2) signal received is quantified；3) data after extracting a part quantization are as initial close Key；4) receiving end and transmitting terminal both sides carry out key agreement, are corrected with the data for ensuring to malfunction in quantizing process.

When legitimate user and legal mist node are in generating physical layer cipher key processes, receiving end generate initial key it Afterwards, both sides carry out that test portion will be added before key agreement.As shown in Fig. 2, when receiving end both sides are generating cipher key processes Middle spoof attack person launches a offensive, and can examine the normalization Euclidean distance of two continuous signal CSI with according to hypothesis in receiving end It tests gained threshold value to be compared, if not meeting null hypothesis examines setting, is judged as illegal user and discards the data.Such as Fruit meets null hypothesis and examines setting, then is judged as legitimate user and key agreement process is unfolded in both sides.

Mist node indicates that spoof attack person is indicated with I with terminal user with A and B respectively.In channel estimation phase, A Multiple training signals are sent mutually in a time slot with B, are T respectively_AAnd T_B.Then mist node, terminal user and camouflage are attacked at this time The signal Y that the person of hitting receives_A、Y_BAnd Y_ISuch as following formula:

Y_B=G_{A, B}T_A+N_B (1)

Y_I=G_{A, I}T_A+N_I (2)

Y_A=G_{B, A}T_B+N_A (3)

Y_I=G_{B, I}T_B+N_I (4)

Wherein, G_{A, B}Indicate the channel gain of A to B, G_{A, I}Indicate the channel gain of A to I, G_{B, I}Indicate that the channel of B to I increases Benefit.Then N_A、N_B、N_IFor A, additive white noise (Additive White Gaussian Noise, AWGNs) existing for B, I, and Assuming that cordless communication network uses time division duplex protocol (Time-Division Duplexing, TDD).WithIt indicates n-th The channel vector for m-th of training sample that terminal user sends is usedIndicate m-th of trained sample that n-th of terminal user sends This channel record.We useCome indicate n-th of terminal user send m-th of training sample channel vector channel Gain, so there is following hypothesis testing:

If 1) channel gain of channel vectorGreater than E_{A, B}, then n-th of terminal user send m-th of trained sample This channel vector H₀Transmitted by legitimate user, to see formula (5)；

If 2) channel gain of channel vectorGreater than E_{A | B, I}, then n-th of terminal user send m-th of trained sample This channel vector is to see formula (6) transmitted by illegal user；

Wherein, E_{A, B}It is the estimation channel gain of legal terminal user, E_{A | B, I}It is the estimation channel increasing of potential spoof attack person Benefit

Because the CSI of channel be it is unique,WithIt also is all uniquely, to there is this to assume on this basis real The statistic tested are as follows:

Wherein, | | | | it is Fu Luobinniusi norm, S is indicatedWithBetween European normalized cumulant.So can To think to work asLess than setting test threshold λ when the node be legitimate user, it may be assumed that

In contrast, whenMore than or equal to setting test threshold λ when the node person that is spoof attack, That is:

The precision of inspection assumed above depends on test threshold λ, if threshold value is excessively high will to improve omission factor (MDR)；Such as Fruit threshold value is too low will to improve rate of false alarm (FAR).Herein using the Q-learning algorithms selection appropriate threshold in intensified learning.

Q-learning algorithm is a kind of extensive chemical that can find optimal solution using insufficient condition in dynamic environment Practise algorithm.Mist node is according to current state S_tSelect suitable threshold valueCome maximize current income andWherein C_tIt is one The time of time slot between signal, current income andBe then income before the time slot and with each sample data institute in the time slot Adding up for the income obtained, then have following formula:

Wherein γ is the set of the training signal of illegal node-node transmission, and T is the training signal quantity transmitted in each time slot, It is set as 20 in the present invention；Use R_xThe movement of processing data packet is represented, is represented with 0 receive data packet respectively, 1 represents refusal number According to packet,It is revenue function immediately.To sum up,It is revenue function immediately, if withIndicate the receipts for receiving to obtain when data packet Benefit,Then indicate the income that obtains when refusal data packet, the two opposite number each other；g₀Indicate that the income for receiving valid data is set It is set to 9, g₁Expression is that the income of refusal invalid data is set as 6；c₀It is to receive the cost of valid data to be set as 4, c₁It is refusal The cost of invalid data is set as 2；P_A(λ) and P_B(λ) is that probability its function under present threshold value λ is as follows:

The Q-learning algorithm based on ε-greedy strategy is introduced herein, and every bout mist node has the probability of ε that can select Suboptimum action sets ε as 0.5, so there is select probability so it is 1- ε that every bout, which selects the probability of optimal action, in the present invention Calculation formula is as follows:

Wherein, λ belongs to first of quantization level in L quantization level, λ^*For optimal threshold.

In Q-learning, learning rate determines that new information to what extent covers old information, i.e. μ ∈ (0,1), Learning rate μ is set in the present invention as 0.5.Q value when current t-th of state threshold is λ is expressed as Q (s_t, λ_t), wherein s_t Represent t-th of state, λ_tIt is the threshold value in the state of t-th of time slot.Discount factor δ is indicated to the discount currently rewarded, by δ ∈ (0,1) indicate, its bigger algorithm of value more take notice of immediate interests and it is less consider the long-term interests, in the present invention setting discount because Sub- δ is 0.8.State s_tMaximum Q functional value by V (s_t) indicate, next state s_t+1Maximum Q functional value by V (s_t+1) table Show, uses Π_tCome indicate current income and.Therefore, receiving end updates its Q value according to following formula:

V(s_t)←maxQ(s_t, λ), λ ∈ { l/L } 0≤l≤L (15)

The optimal value λ of test threshold^*It is given by, wherein λ belongs to first of quantization level in L quantization level:

λ^*=arg maxQ (s_t, λ), λ ∈ { l/L } 0≤l≤L (16).

Claims (1)

1. a kind of spoof attack detection method based on intensified learning in mist calculating, it is characterised in that:

WithIt indicates the channel vector for m-th of training sample that n-th of terminal user sends, usesIndicate n-th of terminal user The channel record of m-th of the training sample sent；WithTo indicate m-th of training sample of n-th of terminal user transmission The channel gain of channel vector, so there is following hypothesis testing:

If 1) channel gain of channel vectorGreater than E_{A, B}, then the letter for m-th of training sample that n-th of terminal user sends Road vector H₀Transmitted by legitimate user, to see formula (5)；

If 2) channel gain of channel vectorGreater than E_{A | B, I}, then n-th terminal user sends m-th of training sample Channel vector is to see formula (6) transmitted by illegal user；

Wherein, E_{A, B}It is the estimation channel gain of legal terminal user, E_{A | B, I}It is the estimation channel gain of potential spoof attack person

Because the CSI of channel be it is unique,WithIt also is all uniquely, to there is this to assume experiment on this basis Statistic are as follows:

Wherein, | | | | it is Fu Luobinniusi norm, S is indicatedWithBetween European normalized cumulant；So can recognize To work asLess than setting test threshold λ when the node be legitimate user, it may be assumed that

In contrast, whenMore than or equal to setting test threshold λ when the node person that is spoof attack, it may be assumed that

The precision of inspection assumed above depends on test threshold λ, if threshold value is excessively high will to improve omission factor；If threshold value is too low Rate of false alarm will be improved；Use the Q-learning algorithms selection appropriate threshold in intensified learning；

Mist node is according to current state S_tSelect suitable threshold value λ maximize current income andWherein C_tIt is t-th of signal Between time slot time, so current income andBe then income before the time slot and with each sample data institute in the time slot Adding up for the income obtained, then have following formula:

Wherein γ is the set of the training signal of illegal node-node transmission, and T is the training signal quantity transmitted in each time slot；Use R_x The movement of processing data packet is represented, is represented with 0 receive data packet respectively, 1 represents refusal data packet,It is revenue function immediately； To sum up, if withIndicate the income for receiving to obtain when data packet,Then indicate that the income obtained when refusal data packet, the two are mutual For opposite number；g₀Expression receives the income of valid data, g₁Expression is to refuse the income of invalid data；c₀It is to receive invalid data Cost, c₁It is the cost for refusing valid data；P_A(λ) and P_B(λ) is that probability its function under present threshold value λ is as follows:

Every bout mist node has the probability of ε that can select suboptimum action, so it is 1- ε that every bout, which selects the probability of optimal action,, In use λ^*Indicate the optimal value of threshold value, λ belongs to first of quantization level in L quantization level, has probability as follows:

Learning rate μ ∈ (0,1)；Q value when current t-th of state threshold is λ is expressed as Q (s_t, λ_t), wherein s_tIt represents t-th State, λ_tIt is the threshold value in the state of t-th of time slot；Discount factor δ is indicated to the discount currently rewarded, by δ ∈ (0,1) table Show；State s_tMaximum Q functional value by V (s_t) indicate, state s_t+1Maximum Q functional value by V (s_t+1) indicate；Therefore, receiving end Its Q value is updated according to following formula:

V(s_t)←maxQ(s_t, λ), λ ∈ { l/L } 0≤l≤L (15)

The optimal value λ of test threshold^*, wherein λ belongs to first of quantization level in L quantization level, it is given by:

λ^*=arg maxQ (s_t, λ), λ ∈ { l/L } 0≤l≤L (16).