CN101442413A

CN101442413A - Method for detecting ad hoc network helminth based on neighbor synergic monitoring

Info

Publication number: CN101442413A
Application number: CNA2008102364079A
Authority: CN
Inventors: 杨新宇; 侯光霞
Original assignee: Xian Jiaotong University
Current assignee: Xian Jiaotong University
Priority date: 2008-12-22
Filing date: 2008-12-22
Publication date: 2009-05-27
Anticipated expiration: 2028-12-22
Also published as: CN101442413B

Abstract

The invention provides a method for detecting ad hoc network worm based on neighbor collaborative monitoring. The method does not require special hardware support, and uses a collaborative relationship of nodes in the ad hoc network to realize simple and feasible worm attack detection. Against attack feature of worm in the ad hoc network, the detection method provided by the invention is divided into three stages, namely malicious node detection, warning information scatter and malicious node isolation, thereby simply and feasibly detecting the worm attack.

Description

A kind of ad hoc network worm detection method based on neighbor synergic monitoring

Technical field

The invention belongs to wireless mobile ad hoc network safety filed, particularly a kind of ad hoc network worm detection method based on neighbor synergic monitoring.

Background technology

Existing relatively more classical Worm detection method mainly contains in the ad hoc network: multipath statistical analysis technique, timestamp and position stamp method, based on neighbours' detection method of trusted node.

The multipath statistical analysis technique is judged worm attack by the static statistics amount for routing iinformation.This method does not need to change Routing Protocol or introduce extra safety service system, only when statistical analysis, need very little expense, also be fit to other attack detecting, but shortcoming is the communication of node in the network must be waited all link more than two to connect just to begin, communication delay becomes greatly.

The method that stab timestamp and position has been introduced the notion of timestamp and position stamp, relies on them and detects worm attack.The position is stabbed and need be known loose time synchronized between accurate positional information of node and node in this method, and timestamp needs between node precise time synchronous.Need authentication information to come guard time to stab in this method or position stamp information, this need waste very big memory space, and does not isolate malicious node.

In neighbours' detection method hypothesis network based on trusted node a credible authorization node (CA) that resource is not limited is arranged, other nodes obtain the logical address of node by CA, neighbor node is judged suspect node by the positional information of node then, the core of this algorithm is to confirm node location accurately, but too in complexity.

Summary of the invention

The object of the present invention is to provide a kind of ad hoc network worm detection method based on neighbor synergic monitoring, this method does not need the easy detection defence of hardware supports, can discern and isolate malicious node, and can make detect delay and expense as far as possible little.

The present invention comprises isolated three processes of malicious node detection, warning message stroll and malicious node.

Technical scheme of the present invention is achieved in that

The detection-phase of malicious node: each node in the network all is set to listen mode, monitors when neighbor node sends packet.In expire time, to receive the packet number that arrives destination node D be μ when monitoring certain neighbor node M, and the correct number of transmitting is v, and then packet loss adds up to μ-v.If μ-v, thinks then that node M is a suspect node greater than β, put it in the suspicious neighbor list; Otherwise, empty the lost data packets counting, begin the monitoring of next expire time.

The warning message stroll stage: suppose when node detection when neighbors M is suspect node, broadcast oneself suspicious neighbor list, three jumping end to its neighbors.Receive of the suspicious report of other neighborss, the suspicious counting territory about the M catalogue in the suspicious tabulation is added 1 about node M.When counting surpassed r, can judge node M was malicious node, puts into blacklist.

The isolated stage of malicious node: suppose node M in the blacklist of its neighbor node, then neighbor node is given the node M marking, and the state of node M is converted into suspicious state.Beat suspicious status indication if having above r node to M, then the state-transition of node M is an isolated state.Therefore no matter node M moves to any position in the network after, is always isolated state, can not transmit packet.Only after virus was removed in manual intervention, this node just can revert to normal condition, with other node communications.

The present invention utilizes neighbor node to assist to detect worm attack in the ad hoc network, does not need special hardware supports, and is all more simple than detection method before, and the overhead that needs is very little.

Embodiment

Based on being divided into of the ad hoc network worm detection method of neighbor synergic monitoring following three parts describe:

1) variable of using in the definition model

A) be that following three states are distinguished with node division in the testing process:

N _Normal: normal condition;

N _Suspicious: suspicious state;

N _Isolated: isolated state;

B) suspicious factor r: the binding occurrence of node state conversion is provided with α neighbor node and reports that node i is

Malicious node, the physical relationship of the suspicious factor is as follows:

C) monitoring periods expire time: the time cycle of monitoring buffer update;

D) packet loss: the data packet number of losing in the unit interval, packet loss higher limit β to certain specific purpose node;

2) internodal state transforms

In the method, all increase an assessment territory E at first for each node, the credibility of node is mainly assessed in this territory, is the parameter that the decision node state transforms, and malicious node is done permanent marks.Value in the assessment territory is a read message, and the authority that node is not revised without authorization can only be provided with according to neighbor node, specifically is divided into following three kinds of situations:

A) during initialization, each node all is set to normal condition;

B) suppose that it is malicious node that neighbor node i monitors node j, then node i is promptly revised the assessment territory just to node j marking, and suspicious Count of Status adds 1;

C) when the suspicious Count of Status of arbitrary node j reached r, the state of node j became isolated state by suspicious state automatically, and this is a permanent identification.No matter node j moves to Anywhere, and other nodes can obtain its state, therefore is easy to it is isolated.

3) based on the core of the ad hoc network worm detection method of neighbor synergic monitoring

I. the detection of malicious node

Step1: each node in the network all is set to listen mode, monitors when neighbor node sends packet;

Step2: the monitoring buffer memory all is initialized as sky;

Step3: in expire time,, just in monitoring buffer memory W, write down the packet loss number of node M when node N monitors the packet that neighbors M is lost to destination node D;

Step4: to receive the packet number that arrives destination node D be μ when monitoring neighbor node M, and the correct number of transmitting is v, and then packet loss adds up to μ-v, if μ-v, thinks then that node M is a suspect node greater than β, puts it in the suspicious neighbor list; Otherwise, empty the lost data packets counting, begin the monitoring of next expire time, return step3.

Ii. warning message is taken a walk the stage

Step1: suppose when node N detects neighbors M and is suspect node, to upgrade suspicious neighbor list;

Step2:N controls the broadcasting jumping figure to its all jumping neighbors and the own up-to-date suspicious neighbor list of double bounce neighbors broadcasting by the value of TTL.For the situation that common neighbor node is arranged, TTL is set to 2 and gets final product; For the situation of no common neighbor node, it is bigger that TTL will be provided with, and is traditionally arranged to be 3 or 4;

Step3: when node N receives the up-to-date suspicious neighbor list of other neighborss, by the suspicious neighbor list of the content update of receiving oneself;

Step4: when the count value of certain node M in the suspicious tabulation surpassed r, can judge this node M was malicious node, puts into blacklist list.

Iii. isolated stage of malicious node

Step1: suppose node M in the blacklist of its neighbors N, then neighbors N gives the node M marking, promptly revises the value in the assessment territory of node M, and the state of node M is converted into suspicious state by normal condition;

Step2: beat suspicious status indication if having above r node to M, then the state of node M is an isolated state by suspicious state-transition.Therefore no matter node M moves to any position in the network after, is always isolated state, can not transmit packet.Only after virus was removed in manual intervention, this node just can revert to normal condition, with other node communications.

Claims

1. the ad hoc network worm detection method based on neighbor synergic monitoring is characterized in that, may further comprise the steps:

1) detection of malicious node

Step2: the monitoring buffer memory all is initialized as sky;

Step4: to receive the packet number that arrives destination node D be μ when monitoring neighbor node M, the correct number of transmitting is v, then packet loss adds up to μ-v, if μ-v, thinks then that node M is a suspect node greater than β, put it in the suspicious neighbor list, otherwise, empty the lost data packets counting, begin the monitoring of next expire time, return step3;

2) the warning message stroll stage

Step4: when the count value of certain node M in the suspicious tabulation surpassed r, can judge this node M was malicious node, puts into blacklist list;

3) the isolated stage of malicious node

Step2: beat suspicious status indication to M if having above r node, then the state of node M is an isolated state by suspicious state-transition, therefore no matter node M moves to any position in the network after, be always isolated state, can not transmit packet, only after virus was removed in manual intervention, this node just can revert to normal condition, with other node communications.