CN103812864A - Sybil attack detection method in online social network - Google Patents

Abstract

The invention discloses a Sybil attack detection method in an online social network, and aims to provide a Sybil attack detection method in a social network. The technical solution is to select a certain node as a verification node, conduct path notification based on the membership relationship, and construct a relationship path to the verification node; during the notification process, a path selection method based on path k similarity is used to eliminate redundant paths and shared paths; the notification ends Finally, all reachable paths are gathered to the verification node for credibility verification to prevent private creation or tampering of paths; finally, the number of trusted paths of each node is used as the verification standard, and the verification node verifies whether other nodes are Sybil nodes . The present invention uses the number of reachable paths of each node to judge whether the node is a Sybil node, truly restores and utilizes the differences in node relationships, has high accuracy, low false alarm rate, and does not need to rely on key infrastructure or other auxiliary equipment Support, with the advantages of being lightweight and easy to deploy.

Description

Sybil attack detection method in online community network

Technical field

The present invention relates to the detection method that Sybil in online community network attacks, be applicable to the detection of network waterborne troops, electronic voting and vote, the multiple application such as online community network recommendation.

Background technology

Sybil attacks and refers to that in network, malicious user passes through repeatedly registration acquisition multiple identities, and utilizes these identity in web transactions, to occupy mastery status, thereby affects network normal function, destroys network order.

Sybil attacks and is extensively present in the network application and network system of various use recommendations or shared mechanism.In typical as online ballot system, by repeatedly registering repeated vote, upset Justice Order, handle gained vote result; In e-commerce website, utilize multiple identities to manufacture wash sale and false evaluation, the judgement that misguides the consumer, causes bad competition; In online social network sites, use multiple accounts to carry out message forwarding and comment, manufacture " hot issue ", carry out rumour propagation.

Along with the rise of online community network, individual, gradually in network saliency, plays the part of more and more important role.By building private page, participation network activity, everyone becomes the part in network.People not only exchange mutually by network, also actively share, and this is mainly manifested in resource and two aspects of knowledge.No matter be resource-sharing or knowledge sharing, in fact all used recommendation mechanisms, each user can the knowledge background based on oneself recommend, network application or network system are integrated all users' recommendation, utilize swarm intelligence to draw the general conclusion of final appraisal results, and provide support for other users' decision-making.Very important principle of recommendation mechanisms is the equity of user identity, between user, is fair, and the weight that user recommends is consistent, and the final effective aspect of guarantee reveals most of users' wish like this, and recommendation mechanisms is played a role.Due to the existence of Sybil attack, although still show fairness between user, but because assailant has grasped multiple identities, if be same user by these identity fusion, the shared weight of this user is much larger than the weight of normal users so, and is proportional to the quantity of the Sybil identity that this user grasps.Sybil attacks the fairness of having broken user identity, makes assailant in recommendation process, occupy more advantages and even can manipulate final result directly.

Sybil attacks and is extensively present in multiple network application, has not only destroyed network application original function, misleads user and causes the distrust of user to network, also may bring multiple malice serious consequence.For example attack at video, picture website use Sybil illegal contents such as promoting violence, pornographic; Upload the file of the viral trojan horse program of subsidiary malice, and attack deception people by Sybil and download; On the online social application such as microblogging, micro-letter, utilize Sybil to attack and carry out rumour propagation, not only can damage other people reputation, even can cause social fear.

Solving Sybil, to attack effective means be to control user's registration, for example, require to use system of real name mode to register.User account is associated one by one with user real identification like this, has strengthened the difficulty of Sybil account registration, makes sole user cannot continue to handle unlimited many Sybil accounts, thereby weakens or eliminate Sybil and attack.But because this mode requires user to use on network and stores oneself real name information, may cause on the one hand privacy of user and leak, may make on the other hand user produce misgivings, thereby cause customer loss, therefore be difficult to dispose in practice and apply.

Attack owing to eliminating Sybil from root, currently mainly start with from attack detecting, find that the Sybil having broken out attacks and potential Sybil threat.Due to the difference of attack form and method for organizing, such as intrusion detection of traditional detection method etc. are difficult to effectively detect Sybil and attack.The object of Sybil attack detecting is to find Sybil node cluster, the otherness of social relationships between Main Basis member.Attack because Sybil node is mainly used to start Sybil, and be rarely used in daily alternately, therefore cause and the disappearance of normal node relation, on graph of a relation, show closely locally, contact loose minimal cut feature with the external world.This characteristic Y u proposes the earliest in the SybilGuard of SIGCOMM06, and is adopted as the basic assumption of Sybil attack detecting.SybilGuard uses the mode of random route to select the path that arrives verifier's node, and using final reachable path number as each node criterion.SybilLimit improves SybilGuard, but the two all exists False Rate and the high problem of misdetection rate.The GateKeeper of Tran utilizes social relationships between node, to carry out bill distribution, the bill quantity obtaining using final each node is as criterion, improve the accuracy rate detecting, but for the bill total amount of determining that the starting stage is issued, need repeatedly iteration operation distribution operation of detection system, strengthened system operation time and resource consumption.And this several method, for path or bill are verified, all needs the support of additional key infrastructure.

Attack detecting result how to utilize lightweight deployment way to obtain high accuracy is the technical problem that those skilled in the art very pay close attention to.

Summary of the invention

The technical problem to be solved in the present invention is to provide one Sybil attack detection method in community network.

Technical scheme is: choose a certain node for checking node, take member relation as according to carrying out path notice and propagation, build the relation path that arrives checking node; In communication process, adopt based on the similar routing resource eliminate redundancy path of path k and shared path; Whether the final quantity using each node trusted path, as validation criteria, is that Sybil node is verified by checking node to other node.

Use N to represent nodes number, for path P ₁=<u ₁, u ₂, u ₃... u _m>, (1≤m≤N) and path P ₂=<v ₁, v ₂, v ₃... v _n>, (1≤n≤N), defined node phase Sihe path is similar as follows, and m is path P ₁length, n is path P ₂length.

Define 1. node r similar: for 1≤r≤min (m, n) (min (m, n) represents to get m, less number in n), if P ₁r node u _rand P ₂r node v _rsame node, so P ₁and P ₂that node r is similar.

Define 2. path k similar: establish 1≤k≤min (m, n), if to any 1≤j≤k, P ₁and P ₂all that node j is similar, P so ₁and P ₂that k is similar.If meet P ₁and P ₂be that k is similar, k maximum occurrences is K, (1≤K≤min (m, n)), P so ₁and P ₂be (K+1) difference, coefficient of variation is (K+1).

From definition 1 and definition 2, similar if two paths are k, the sequence node before k node of this two paths is all the same so; If two paths are K difference, so this two paths before (K-1) individual sequence node all the same, and if path be all greater than K, their K node is different nodes so.

The concrete technical scheme of the present invention comprises the following steps:

The first step, chooses a certain node for checking node, is labeled as v, and arbitrary node can be served as checking node, and all nodes except checking node are all node to be verified, and each node carries out initialization operation, and method is:

The enciphering and deciphering algorithm of 1.1 all node definitions oneself, algorithm is without external disclosure, can use DES(Data Encryption Standard), AES(Advanced Encryption Standard), the classic algorithm such as MD5, RSA, also can use custom algorithm.

1.2 checking nodes create relation table, and define character string T arbitrarily ₀as checking character string; Institute's node still to be tested creates relation table and routing table.Wherein relation table storage with other nodes of oneself setting up trusted relationships, in table, each is all a node identification; Routing table is used for storing the reachable path that arrives checking node, and in table, each is two tuples, is expressed as <P _i, Sign (P _i) >, (1≤i≤M), wherein M is total path number in network, P _irepresent i paths, Sign (P _i) expression P _imark.Each paths is all an orderly sequence node, and each mark is a character string after encryption.Relation table is by each node according to historical experience oneself definition, and routing table is initially sky.

Second step, by checking node, v carries out reachable path notice to other node, and method is:

2.1v sends advertised information M ₀give all members in the relation table of v.Advertised information M ₀content comprise path, mark, acceptable maximum difference COEFFICIENT K and acceptable MAXPATHLEN L.Because v verifies node exactly, therefore path is { v}; With the cryptographic algorithm of v to T ₀encrypt as the path { mark of v}; Acceptable maximum difference COEFFICIENT K and acceptable longest path length L are all definite by checking node oneself, and the reference value that experiment provides is K=1, L=7.

2.2 have received advertised information M ₀node u _jfirst to M ₀the validity in middle path checks.If M ₀middle path is P, is designated Sign (P), if met the following conditions, judges that P is with respect to u _jeffective:

(1) length of P is less than acceptable longest path length L;

(2) P and u _jrouting table in the coefficient of variation in arbitrary path be less than K, although or u _jrouting table in exist with P coefficient of variation and be more than or equal to the path of K, but P is shorter.If P is with respect to u _jeffectively, execution step 2.3, otherwise turn 2.5.

2.3u _jp is added in the routing table of oneself, and delete other path that is greater than K and grows than P with the coefficient of variation of P in routing table.

2.4u _jconstruct new path and mark.U _jby the afterbody that oneself adds P to form new path P ', if P={u ₁, u ₂... u _l, (1≤l), P ' so={ u ₁, u ₂... u _l, u _j, and use u _jthe cryptographic algorithm Crypt of oneself _uj() encrypted and formed new ID of trace route path Sign (P ')=Crypt Sign (P) _uj(Sign (P)).

2.5u _jsend new advertised information.Use former advertised information M ₀the value of middle K and L, with new path P ' form new advertised information M together with mark Sign (P ') ₁and send to u _jmember in relation list, and send notice prompting to v, go to step 2.6.Noticing the content of reminding is u _jnode identification u _j, be only used for notifying v to notice and still carrying out.

If 2.6 u _jreceive new advertised information M ₁, by M ₀content update be M ₁, go to step 2.2, otherwise go to step 2.7.

2.7 checking node v are according to network size definition reminder time interval, and initialization is reminded timer and starts timing.Be set reminder time interval τ=10*logN second, remind if received to notice within the τ time, the timer of resetting is so zero and goes to step 2.2; If timer exceeds reminder time interval and do not receive any notice and remind, notice and finish so, carry out the 3rd step.

The 3rd step, node still to be tested send the checking that comprises reachable path and ask to checking node v, make all reachable paths gather checking node v place, then by verifying that node v checks that whether all reachable paths credible.Method is:

3.1 node still to be tested adopt new path and the mark of method construct of step 2.4, and new path and mark are sent to checking node v.

3.2 receive from after the checking request of node still to be tested, checking node v sorts according to length to all paths, and carry out successively the credible checking in path, and object is to prevent that some node from privately fabricating non-existent path or distorting path, verification method is:

3.2.1 verify that node v sorts all paths that receive according to length, add in table unverified_table to be verified.The data structure of unverified_table is identical with routing table, and each is all made up of path and mark, and difference is that unverified_table sorts according to path.

3.2.2 from unverified_table, take out shortest path P _sand corresponding mark Sign (P _s), by the known P of notice procedures _slength be necessarily more than or equal to 2, establish P _s={ u ₁, u ₂... u _t, (2≤t≤N).First verify P _swhether credible, method is:

If 3.2.2.1 u ₁for checking node v, turn 3.2.2.2, otherwise turn 3.2.2.8;

If 3.2.2.2 P _slength equal 2, turn 3.2.2.3; Otherwise turn 3.2.2.4;

If 3.2.2.3 u ₂be present in the relation table of v, by u ₂utilize the decipherment algorithm of oneself

() is to Sign (P _s) deciphering, and make result $\mathrm{Res}\left(P_s\right)={\mathrm{Decrypt}}_{u_2}\left(\mathrm{Sign}\left(P_s\right)\right),$ Wherein

() is u ₂decipherment algorithm.If result Res is (P _s) equal init string T ₀, be proved to be successful, turn 3.2.2.7; Otherwise authentication failed turns 3.2.2.8; If u _tbe not present in the relation table of v, illustrate that someone palms off path, authentication failed, turns 3.2.2.8;

3.2.2.4 check P _s-1={ u ₁, u ₂..., u _t-1whether be present in verified_table, if there is no, authentication failed turns 3.2.2.8; Otherwise enter step 3.2.2.5;

3.2.2.5 by P _s-1and Sign (P _s) send to P _sleast significant end node u _t;

3.2.2.6u _tfirst check P _s-1={ u ₁, u ₂... u _t-1whether at u _trouting table in, then use u _tdecipherment algorithm

to Sign (P _s) be decrypted, method is $\mathrm{Res}\left(P_s\right)={\mathrm{Decrypt}}_{u_t}\left(\mathrm{Sign}\left(P_s\right)\right),$ And by result and P _s-1mark Sign (P _s-1) contrast, if Res is (P _s)=Sign (P _s-1) illustrate that this path was not tampered, return to positive feedback message to v, turn 3.2.2.7; Otherwise illustrate that path is tampered, provide negative feedback, turn 3.2.2.8.

3.2.2.7 be proved to be successful, turn 3.3;

3.2.2.8 authentication failed, turns 3.4.

3.3 by P _smove to verified_table from unverified_table, turn 3.5.

3.4 by P _sfrom unverified_table, delete, turn 3.5.

If 3.5 unverified_table non-NULLs, go to step 3.2.2, otherwise turn the 4th step.

The 4th step, judges according to the trusted path quantity of each node whether this node is Sybil node by checking node.

The node of all submission checking requests is added set unverified_set to be verified by 4.1 checking node v, and initialization Sybil node set sybil_set is empty set, and sets decision threshold α.The value of α is variable, can freely adjust according to demand, and lower value can be accepted more normal node, but also may make Sybil node be accepted simultaneously, thereby increases loss; Higher value can be refused more Sybil node, but also may make normal node be rejected simultaneously, thereby false drop rate is increased.The best practices value that we simulate α by test of many times is α=15* (logN) ².

4.2 take out a node from unverified_set, be made as u, the routing table of supposing its submission is path_table (u), calculates trusted path collection trusted_table (u)=path_table (u) ∩ verified_table.If element number is greater than α in trusted_table (u), turns 4.3, otherwise turn 4.4.

4.3 to be proved to be successful be that u is not Sybil node, and u is deleted from unverified_set, turns 4.5.

4.4 authentication faileds are that u is Sybil node, and u is deleted and added sybil_set from unverified_set, turn 4.5.

If 4.5 unverified_set non-NULLs, turn 4.2, otherwise turn 4.6.

4.6 finish, and the node in set sybil_set is all Sybil node.

Adopt the present invention can reach following beneficial effect:

For Sybil user, owing to being subject to the impact of time, energy etc., cannot use all accounts to carry out daily interacting activity, conventionally only can use wherein some or a few, caused the scarcity of other account relation.Meanwhile, owing to using these accounts to carry out Sybil attack simultaneously, between these accounts, formed associated closely.On the present graph of a relation of these mark sheets, just present internal connection tight, with the loose structure of external relation, this causes Sybil node to arrive reachable path disappearance of other normal node.The present invention is as detecting foundation.

In the first step, each node definition the enciphering and deciphering algorithm of oneself, these algorithms are used for the mark of build path, according to mark, credibility carried out in all paths and verify in the 3rd step, thereby guarantee authenticity and the correctness in path, prevent that node from forging, distorting path privately.

In second step, the propagation to reachable path between the declaration by checking node to reachable path and node, each node has all been set up the path that arrives checking node.Concerning Sybil node, due to the scarcity of relation, therefore its path all comes from a few node, claims that these paths are redundant path.By definition K Similar Track and in the time propagating, route availability is checked, can effectively eliminate redundant path, the scarcity that is related to of Sybil node is shown in the scarcity of active path, for the detection of the 4th step provides basis.

The reachable path of all nodes is gathered checking node by the 3rd step, and by checking node, authenticity examination is carried out in these paths.Avoid like this node in order privately to forge path by checking or to distort path; Use the self-defining enciphering and deciphering algorithm of each node to identify path, without the support that relies on critical infrastructures or other auxiliary equipment, there is lightweight, easy advantage of disposing, be more suitable for network environment.

The 4th step utilizes the reachable path quantity of each node to judge that whether this node is Sybil node, owing to truly having reduced and having utilized the otherness of node relationships, has the advantages such as accuracy is high, rate of false alarm is low.

Accompanying drawing explanation

Fig. 1 is overview flow chart of the present invention;

Fig. 2 is a part for network topology;

Fig. 3 is the self-defining relation list of node in topological structure shown in Fig. 2;

Fig. 4 is node u in topology shown in Fig. 2 ₇routing table change;

Fig. 5 is all paths that in the total proof procedure of topology shown in Fig. 2, verifier's node receives;

Fig. 6 is the performance of method detection method under heterogeneous networks scale.

Embodiment

Fig. 1 has provided the main-process stream of detection method.Take a concrete network as example, specific embodiment of the invention method is described.Use stochastic network model to generate analog network, comprise 1,500 node and 22,004 limits.Because network node is too much, we explain concrete implementation detail by the topology that the part of nodes shown in Fig. 2 forms.Wherein v is verifier's node, and other is node to be verified.

Detection method comprises four steps altogether.

The first step, chooses a certain node for checking node, is labeled as v, and arbitrary node can be served as checking node, and all nodes except checking node are all node to be verified, and each node carries out initialization operation: the enciphering and deciphering algorithm of each node definition oneself; And according to being related to initialization relation list, as shown in Figure 3.

Second step, by checking node, v carries out reachable path notice to other node, and method is:

First v sends declaration information to the member u in relation list ₁and u ₂, wherein path parameter is that { v} is designated Crypt _v(T ₀), wherein Crypt _v() is the cryptographic algorithm of v, T ₀for the arbitrary string of v definition.Get all the other parameter K=4, L=7.When initial, the routing table of each node is all empty, so { v} and its mark are added into u in path ₁and u ₂routing table in.

Subsequently, u ₂in original route, form new route { v, u by self adding to ₂, and use encipheror to form new mark to former mark encryption, then by new route and the member u identifying in the relation list that sends to him ₃and u ₄.Due to u ₁relation list be empty, therefore do not need to carry out path declaration.

Similarly, u ₃and u ₄also according to step 1 flow process, path is declared.Fig. 4 has shown node u ₇routing table along with the change procedure of notice procedures.U ₇routing table be initialized as sky, receiving u ₄after the declaration information of sending, routing table is as shown in Fig. 4 (a); Work as u ₇receive from u ₅declaration information after, according to notice procedures, first route availability is checked.New route { v, u ₂, u ₃, u ₅and { v, u ₂, u ₄, u ₅length be all less than L, with original path { v, u ₂, u ₄coefficient of variation be respectively 3 and 4, due to definition maximum difference COEFFICIENT K=4, therefore { v, u ₂, u ₃, u ₅effectively to be added into routing table, and { v, u ₂, u ₄, u ₅invalid being dropped.Now u ₇routing table as shown in Fig. 4 (b).Finally, u ₇receive and come from u ₆declaration information, new route { v, u ₂, u ₄, u ₆and original route { v, u ₂, u ₄coefficient of variation equals 4, equals maximum difference coefficient, be therefore dropped.Final u ₇routing table as shown in Fig. 4 (c).

When all nodes no longer receive that after new advertised information, advertisement phase finishes.

The 3rd step, node still to be tested send the checking that comprises reachable path and ask to checking node v, make all reachable paths gather checking node v place, then by verifying that node v checks that whether all reachable paths credible.

Node still to be tested send to checking node v etc. to be verified by the form of advertised information the content in own routing table.V, sorts according to path, as shown in Figure 5 after request still to be tested receiving.Wherein shortest path shape is as { v, u ₁and { v, u ₂, because u ₁and u ₂all, in the relation table of v, therefore send checking message to u ₁and u ₂, wherein respectively comprise path { v, u ₁and { v, u ₂and mark separately.U ₁and u ₂to returning to v after mark deciphering, after v deciphering, obtain init string T ₀, be therefore proved to be successful, by { v, u ₁and { v, u ₂add in verified_table.

To { v, u ₂, u ₃while verifying, first find { v, u ₂in verified_table, then give most end node u ₃send authorization information, u ₃to feeding back to v after mark deciphering, v is by feedback result and { v, u ₂mark compare, be unanimously proved to be successful, otherwise authentication failed.

After v verifies all paths successively, the credible Qualify Phase in gathering and path finishes.

The 4th step, judges according to the trusted path quantity of each node whether this node is Sybil node, and method is by checking node:

Checking node calculates each node to be verified and has trusted path quantity, if trusted path quantity is greater than checking threshold values, this node verification success is described, otherwise authentication failed.

Be proved to be successful and show that verifier accepts this node, otherwise verifier refuses this node.For invention accuracy is assessed, definition AR is the receptance (Accept Rate) to normal node, and RR represents the reject rate (Reject Rate) to Sybil node.The receptible normal node of the higher expression of AR is more, but it is also more to receive Sybil node simultaneously; The Sybil node that the higher expression of RR can detect is more, but simultaneously also may be more by the normal node of flase drop.Good detection method should be able to obtain higher AR and RR simultaneously.

Use the network of different scales to verify the validity of method, and systematic function under different parameters is contrasted, result is as shown in table 6.Under heterogeneous networks scale, the receptance of the inventive method and reject rate can be up to 90% as we can see from the figure, and along with increasing of node, performance declines to some extent, but also all maintain more than 88%.

The present invention attacks and detects Sybil, the social relationships that form in reciprocal process take node are foundation detection Sybil node, not only can find that the Sybil having started attacks, can also attack to threaten to potential Sybil and detect, thereby avoid to greatest extent attacking the harm causing.Can be applied in the various online community network field that uses recommendation mechanisms and shared mechanism, such as network is voted online, scoring online, video are shared etc.

Claims (7)

1. a Sybil attack detection method in an online social network, is characterized in that comprising the following steps: The first step is to select a certain node as a verification node and mark it as v. Any node can be used as a verification node. All nodes except the verification node are nodes to be verified. Each node is initialized by: 1.1 All nodes define their own encryption and decryption algorithms; 1.2 The verification node creates a relationship table, and defines any string T ₀ as an initialization identifier; all nodes to be verified create a relationship table and a path table; the relationship table stores other nodes that have established a trusted relationship with itself, and each node in the table One item is a node identifier; the path table is used to store the reachable path to the verification node, and each item in the table is a two-tuple, expressed as <P _i , Sign(P _i )>, 1≤i≤M , where M is the total number of paths in the network, P _i represents the i-th path, Sgin(P _i ) represents the identity of Pi, each path is an ordered sequence of nodes, and each identity is an encrypted string , the relationship table is defined by each node based on historical experience, and the path table is initially empty; In the second step, the verification node v advertises reachable paths to other nodes, the method is: 2.1v sends notification information M ₀ to all members in the relationship table of v, the content of M ₀ includes the reachable path to v, the identifier of the reachable path, the acceptable maximum difference coefficient K and the acceptable maximum path length L, Encrypt T ₀ with the encryption algorithm of v as the identification of the path {v}; the acceptable maximum difference coefficient K and the acceptable longest path length L are determined by the verification node itself. 2.2 The node u _j that has received the notification information M ₀ first checks the validity of the path in M ₀ , set the path in M ₀ as P, and sign it as Sign(P), if P is valid relative to u _j , execute the step 2.3, otherwise go to step 2.5; 2.3u _j adds P to its own path table, and deletes other paths in the path table whose difference coefficient with P is greater than K and longer than P; 2.4 u _j constructs a new path and identity: u _j adds itself to the tail of P to form a new path P′, if P={u ₁ , u ₂ ... u _l }, then P′={u ₁ , u ₂ ... u _l , u _j }, 1≤l≤N, N is the number of nodes in the network, and use u _j 's own encryption algorithm Crypt _uj () to encrypt Sign(P) to form a new path identifier , namely Sogn(P′)=Crypt _uj (Sign(P)); 2.5u _j sends new notification information M ₁ : use the values of K and L in the original notification information M ₀ to form new notification information M ₁ together with the new path P′ and the sign Sign(P′) and send it to u _j Members in the relationship list, and send a notification reminder to v, go to step 2.6; the content of the notification reminder is the node identifier u _j of u _j ; 2.6 If u _j receives new announcement information M ₁ , update the content of M ₀ to M ₁ , go to step 2.2, otherwise go to step 2.7; 2.7 Verification node v defines the reminder time interval according to the network scale, and initializes the reminder timer and starts counting; set the reminder time interval τ, if the notification reminder is received within τ time, reset the timer to zero and go to step 2.2; if If the timer exceeds the reminder interval and does not receive any notification reminder, then perform the third step; In the third step, all the nodes to be verified send verification requests containing reachable paths to the verification node v, so that all reachable paths are gathered at the verification node v, and then the verification node v checks whether all the reachable paths are credible, the method is : 3.1 All the nodes to be verified use the method of step 2.4 to construct new paths and identifiers, and send the new paths and identifiers to the verification node v; 3.2 After receiving the verification requests from all the nodes to be verified, the verification node v sorts all the paths according to the length, and performs the path credibility verification in turn, the method is as follows: 3.2.1 The verification node v sorts all the received paths according to the length, and adds them to the unverified table to be verified. The data structure of the unverified_table is the same as that of the path table, and each item is composed of a path and an identifier. The difference is that the unverified_table is sorted according to the length of the path of; 3.2.2 Take out the shortest path P _s and its corresponding sign Sign(P _s ) from the unverified_table, set P _s ={u ₁ , u ₂ ...u _t }, 2≤t≤N, first verify whether P _s Credible, the method is: 3.2.2.1 If u ₁ is the verification node v, go to step 3.2.2.2, otherwise go to step 3.2.2.8; 3.2.2.2 If the length of P _s is equal to 2, go to step 3.2.2.3; otherwise go to step 3.2.2.4; 3.2.2.3 If u ₂ exists in the relationship table of v, u ₂ uses its own decryption algorithm

() Decrypt Sign(P _s ), and make the result $\mathrm{Res}\left(P_{\mathrm{the\; s}}\right)={\mathrm{Decrypt}}_{u_2}\left(\mathrm{sign}\left(P_{\mathrm{the\; s}}\right)\right),$ If the result Res(P _s ) is equal to the initial string T ₀ , then the verification is successful, go to 3.2.2.7; otherwise, go to step 3.2.2.8 if the verification fails; if u _t does not exist in the relational table of v, it means someone faked the path, go to step 3.2.2.8; Fail, go to step 3.2.2.8; 3.2.2.4 Check whether P _s-1 = {u ₁ , u ₂ , ..., u _t-1 } exists in the verified_table, if not, the verification fails and go to step 3.2.2.8; otherwise, go to step 3.2.2.5; 3.2.2.5 Send P _s-1 and Sign(P _s ) to the end node u _t of P _s ; 3.2.2.6 u _t first checks whether P _s-1 = {u ₁ , u ₂ ...u _t-1 } is in the path table of u _t , and then uses the decryption algorithm of u _t

To decrypt Sign(P _s ), the method is Ren(P _s )＝

(Sign(P _s )), and compare the result with the sign of P _s-1 Sign(P _s-1 ), if Res(P _s )=Sign(P _s-1 ), it means that the path has not been tampered with, Return a positive feedback message to v, go to step 3.2.2.7; otherwise, it means that the path has been tampered with, give negative feedback, go to step 3.2.2.8. 3.2.2.7 Verification is successful, go to 3.3; 3.2.2.8 Verification failed, go to 3.4; 3.3 Move P _s from unverified_table to verified_table, go to step 3.5; 3.4 Delete P _s from unverified_table, go to step 3.5; 3.5 If unverified_table is not empty, go to step 3.2.2, otherwise go to step 4; In the fourth step, the verification node judges whether the node is a Sybil node according to the number of trusted paths of each node: 4.1 Verification node v adds all nodes that submit verification requests to the set unverified_set to be verified, initializes the Sybil set sybil_set to an empty set, and sets the judgment threshold α, which can be adjusted freely according to requirements; 4.2 Take out a node u from unverified_set, calculate the trusted path set trusted_table(u)=path_table(u)∩verified_table, where path_table(u) is the path table submitted by u, if the number of elements in trusted_table(u) is greater than α, turn to Step 4.3, otherwise go to step 4.4; 4.3 The verification is successful, that is, u is not a Sybil node, delete u from unverified_set, and go to 4.5; 4.4 Verification failure means that u is a Sybil node, delete u from unverified_set and add it to sybil_set, go to 4.5; 4.5 If unverified_set is not empty, go to 4.2, otherwise go to 4.6; At the end of 4.6, the nodes in the set sybil_set are all Sybil nodes. 2. Sybil attack detection method in the online social network as claimed in claim 1, it is characterized in that the encryption and decryption algorithm of described node definition is DES namely Data Encryption Standard, AES namely Advanced Encryption Standard, MD5, RSA or self-defined algorithm. 3. Sybil attack detection method in the online social network as claimed in claim 1, is characterized in that if satisfy following condition, then judge that P _i is effective with respect to u _j : (1) The length of P _i is less than the longest acceptable path length L; (2) The difference coefficient between P _i and any path in the path table of u _j is less than K, or although there is a path with a difference coefficient greater than or equal to _K in the path table of u _j , P _i is shorter. 4. Sybil attack detection method in the online social network as claimed in claim 1, is characterized in that described coefficient of difference refers to: if path P ₁ and P ₂ are k similar, the maximum value of k is K, 1≤K≤ min(m, n), then P ₁ and P ₂ are (K+1) different, and the difference coefficient is (K+1), m is the length of path P ₁ , and n is the length of path P ₂ . 5. Sybil attack detection method in the online social network as claimed in claim 1, is characterized in that described judgment threshold α=15*(logN) ² , where N is the number of nodes in the network. 6. Sybil attack detection method in online social network as claimed in claim 1, is characterized in that described reminding time interval τ=10*logN second, and N is the node number in the network. 7. The Sybil attack detection method in an online social network according to claim 1, wherein the maximum difference coefficient K=4, and the acceptable maximum path length L=7.

Images