WO2020093907A1

WO2020093907A1 - Trust and noise point detection technology-based intrusion detection method for multi-protocol layer

Info

Publication number: WO2020093907A1
Application number: PCT/CN2019/113952
Authority: WO
Inventors: 李光辉; 许力
Original assignee: 江南大学
Priority date: 2018-11-08
Filing date: 2019-10-29
Publication date: 2020-05-14
Also published as: CN109257750B; CN109257750A

Abstract

Disclosed is a trust and noise point detection technology-based intrusion detection method for a multi-protocol layer, belonging to the field of wireless sensor network security. Said method comprises: using a weighted method to establish trust values of various protocol layers for relative deviation values of a plurality of key parameters in a physical layer, an MAC layer and a network layer, and fusing same to obtain a fused trust value. When malicious nodes are aggregated together, it is difficult to perform detection by means of the relative deviation values, and a data noise point detection technology is introduced. Key parameters of the protocol layers of nodes inside a cluster are detected, a penalty is imposed on nodes with abnormal parameter data, and the abnormal key parameters are regarded as noise points. The key parameters of the protocol layers provide data for data noise point detection, and the trust values provide trustworthy weights for noise point detection and a node penalty degree in a penalty mechanism. The present invention uses the penalty mechanism to reduce the trust values, and feeds back the trust values of nodes, effectively detecting the attack types to different protocol layers.

Description

Multi-protocol layer intrusion detection method based on trust and noise point detection technology

Technical field

The invention relates to a multi-protocol layer intrusion detection method based on trust and noise point detection technology, which belongs to the field of wireless sensor network security.

Background technique

In wireless sensor networks (Wireless Sensor Networks, WSN), due to the openness of sensor node deployment and wireless communication, wireless sensor networks face serious security problems. In the deployment of some wireless sensor networks, nodes may be captured and key information stolen. The purpose of the attacker is to destroy the security attributes of the wireless sensor network, including confidentiality, integrity, availability and identity authentication. In order to achieve these attack targets, the attacker will launch attacks from different protocol layers of the wireless sensor network. In wireless sensor networks, in addition to attacks against a single protocol layer, there are also cross-layer attacks related to multiple protocol layers. Compared with single-layer, cross-layer attacks can obtain better attack effects, and at the same time better hide the attack behavior or reduce the cost of the attack.

The traditional technology has the following technical problems:

The current wireless sensor network (WSN) intrusion detection model still has some unresolved problems. Some models detect attacks based on abnormal network traffic. In fact, not all wireless sensor network attacks will cause abnormal networks. flow. There are also some intrusion detection models that only target several typical attack types, and it is difficult to deal with other types or different types of simultaneous attacks. For cross-layer attacks, the existing wireless sensor network intrusion detection model only considers the trust value change of each layer separately, and sets the detection threshold of each layer to achieve the detection effect. This detection model ignores the connection between protocol layers, while wireless The attack behaviors on the sensor network are usually interrelated and mutually transformed, which results in the existing wireless sensor network intrusion detection model to detect a high rate of false positives and false negatives in the face of cross-layer attacks.

Summary of the invention

The technical problem to be solved by the present invention is to provide a multi-protocol layer intrusion detection method based on trust and noise point detection technology, which can effectively detect the attack types of different protocol layers and can be suitable for a layered structure wireless sensor network It is also suitable for wireless sensor networks with planar structure.

In order to solve the above technical problems, the present invention provides a multi-protocol layer intrusion detection method based on trust and noise point detection technology, including:

Build a wireless sensor network;

The trust value of each sensor node at each layer is obtained by calculating the relative deviation value of key parameters of each sensor node in the wireless sensor network at the physical layer, MAC layer, and network layer respectively;

According to the obtained trust values of each sensor node in the physical layer, MAC layer, and network layer, fusion is performed to obtain the total trust value of each sensor node;

Use the data noise point technology to bring the key parameters into the detection and obtain the noise point list of the sensor nodes in the wireless sensor network;

Use the punishment mechanism to determine the punishment strength and obtain the global trust value of each sensor node. Nodes whose global trust value is lower than the threshold are classified as malicious nodes.

Optionally, the calculation of the relative deviation value of the key parameters of each sensor node in the wireless sensor network at the physical layer, MAC layer, and network layer to obtain the trust value of each sensor node at each layer includes:

Measure energy loss according to the number of packets sent, received, and forwarded by each sensor node, and use the relative deviation value of energy loss to obtain the trust value of the physical layer;

According to the random mechanism of the node's backoff window and the number of packet retransmissions, the idle time and retransmission rate of each sensor node are obtained; the idle time of each sensor node and the relative deviation of the retransmission rate from the neighbor node are used to obtain the MAC layer. Trust value

The trust value of the network layer is calculated according to the packet forwarding rate of each sensor node and the relative deviation between the number of hops from the node to the cluster head node and neighbor nodes.

Optionally, the data noise point technology is used to bring key parameters into the detection to obtain a noise point list of sensor nodes in the wireless sensor network, including:

Send the parameters of each protocol layer as data to the cluster head node or base station;

The cluster head node or base station will use the obtained trust value to give different weights to the parameters of each node, and bring it into the algorithm to obtain the detection result;

Generate a list of sensor noise points from the obtained detection results and send them to each sensor node.

Optionally, the punishment mechanism is used to determine the punishment strength to obtain the global trust value of each sensor node. Nodes whose trust value is lower than the threshold are listed as malicious nodes, including:

Use the fusion trust value of the protocol layer to add weight to the punishment strength of the node. The higher the trust value, the greater the punishment strength;

Penalize the trust value of each sensor node to obtain the global trust value of each sensor node;

Use the false positive rate and false negative rate obtained by experiment to determine the best detection threshold, and compare the node trust value with the detection threshold. If it is less than the detection threshold, it is a malicious node.

A computer device includes a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, any of the steps of the method is implemented.

A computer-readable storage medium having stored thereon a computer program which when executed by a processor implements any of the steps of the method.

A processor for running a program, wherein the method according to any one of the items is executed when the program is running.

The beneficial effects of the invention:

This application uses the relative deviation of parameters of multiple protocol layers as a trust metric, uses the weighting method to establish a trust system model, and establishes a punishment mechanism through data noise point detection technology; the monitoring node observes the monitored node's physical layer, MAC layer and network layer Key parameters, and calculate the relative deviation of these key parameters. Based on the relative deviation of the parameters, the monitoring node aggregates the trust value through different protocol layers to evaluate the credibility of the monitored node, and sends the credibility and key parameters to the cluster Header (CH) or base station (BS). The cluster head and the base station can calculate the aggregated trust value of the node through the evaluation trust values of multiple monitoring nodes. At the same time, the cluster head or the base station will periodically use noise detection technology to obtain abnormal key parameters, and carry out on the nodes with abnormal key parameter data. Penalty, reduce its trust value. If the trust value of a node is less than the threshold, the node is regarded as an abnormal node; the trust value is determined by the key parameters of different protocol layers; it can effectively detect the attack types of different protocol layers.

BRIEF DESCRIPTION

In order to more clearly explain the technical solutions in the embodiments of the present invention, the drawings required in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without paying any creative work, other drawings can be obtained based on these drawings.

FIG. 1 is a schematic diagram of a layered structure wireless sensor network in a multi-protocol layer intrusion detection method based on trust and noise point detection technology.

Figure 2 is a graph of the best false positive rate and false negative rate under various attacks obtained in the experiment.

Figure 3 is a comparison diagram of the detection rates of the multi-protocol layer intrusion detection method based on trust and noise point detection technology and the NBBTE scheme.

Figure 4 is a comparison diagram of the detection rates of the multi-protocol layer intrusion detection method based on trust and noise point detection technology and the PLTB scheme.

Fig. 5 is a comparison chart of the false alarm rate between the multi-protocol intrusion detection method based on trust and noise point detection technology and the NBBTE scheme.

Fig. 6 is a comparison chart of the false alarm rate of the multi-protocol layer intrusion detection method based on trust and noise point detection technology and the PLTB scheme.

FIG. 7 is a comparison chart of the underreporting rate of the multi-protocol intrusion detection method based on trust and noise point detection technology and the NBBTE scheme.

FIG. 8 is a comparison chart of the underreporting rate of the multi-protocol layer intrusion detection method based on trust and noise point detection technology and the PLTB scheme.

detailed description

To make the objectives, technical solutions, and advantages of the present invention clearer, the following describes the embodiments of the present invention in further detail with reference to the accompanying drawings.

Example one:

This embodiment provides a multi-protocol layer intrusion detection method (Trust-MultiProtocollayerNoiseIntrusionDetection, T-MPNID) based on trust and noise point detection technology. The multi-protocol layer intrusion detection model corresponding to this method combines multiple protocols The relative deviation of the key parameters of the layer is used as a trust metric. The weighted method is used to establish a trust system model, and a penalty mechanism is established through data noise point detection technology.

In this intrusion detection method, the monitoring node observes the key parameters of the monitored node to the physical layer, MAC layer and network layer, and calculates the relative deviation of these key parameters. According to the relative deviation of the parameters, the monitoring node can be aggregated through different protocol layers Trust value to evaluate the credibility of the monitored node, and send the credibility and key parameters to the cluster head (CH) or base station (BS).

The cluster head and the base station can calculate the aggregated trust value of the node through the evaluation trust values of multiple monitoring nodes. At the same time, the cluster head or the base station will periodically use noise detection technology to obtain abnormal key parameters, and carry out on the nodes with abnormal key parameter data. Penalty, reduce its trust value. If the global trust value of the node is less than the threshold, the node is regarded as an abnormal node.

Because the scheme proposed by the present invention, the trust value is determined by the key parameters of different protocol layers, therefore, our model can effectively detect the attack types of different protocol layers. Moreover, our model can be suitable for both layered wireless sensor networks and planar structure wireless sensor networks.

The multi-protocol layer intrusion detection method based on trust and noise point detection technology proposed in this application includes the following steps:

Step 1: Build a wireless sensor network

The invention is used for multi-protocol layer and cross-layer intrusion detection. As shown in FIG. 1, it is a layered structure wireless sensor network, that is, a cluster structure. In the wireless sensor network, each cluster It consists of many nodes (Sensors, SNs), including a cluster head node. The nodes in the cluster can communicate with the cluster head nodes directly or through other nodes in the cluster. The cluster head node can directly or through other cluster head nodes send the information collected in the cluster to the base station.

In a wireless sensor network, all nodes within the communication range of a node are neighbor nodes of the node; each node and its neighbor nodes monitor each other and each other are monitoring nodes.

Because wireless sensor network attacks are mainly aimed at the physical layer, MAC layer and network layer, the intrusion detection method proposed in this application is mainly aimed at these three layers.

Step 2: Obtain the trust value of each sensor node at each layer according to the relative deviation value of key parameters of each sensor node at the physical layer, MAC layer, and network layer.

This includes:

Step 21: In the physical layer, the energy loss of each sensor node is used as a key parameter to obtain the trust value of each sensor node.

In practical applications, the energy loss value of each sensor node cannot be directly obtained, but it is related to the total number of packets sent, received, and forwarded, so the relative deviation value of the energy loss of each sensor node is equal to the sensor node sent, received, and forwarded packets The relative deviation value of the sum of the numbers.

Specifically, the relative deviation value of the energy loss is determined according to the relative deviation value of the sum of the number of packets sent, received, and forwarded by each sensor node, and then the relative deviation value of the energy loss of each sensor node and the energy loss of its neighbor stage is used to obtain each sensor The trust value of the node in the physical layer is as follows:

In the physical layer, based on the sum of the number of transmitted packets, forwarded packets, and received packets generated during the transmission and communication between node i and node j, which are mutual monitoring nodes, to roughly estimate their energy consumption in the Δt time period .

The monitoring node i can obtain the total number of packets sent, received, and forwarded by its neighbor node j in the Δt time period TC _j (t), and the total number of packets sent, received, and forwarded by the node j in the Δt time period TC _j (t ) Is the relative deviation value of the energy consumption of node j _Erd (t):

TC _j (t) = S_pack _j (t) + R_pack _j (t) + F_pack _j (t) (1)

In equation (1), S_pack _j (t), R_pack _j (t), and F_pack _j (t) respectively represent the total number of packets sent by node j at time t, the total number of received packets, and the total number of forwarded packets.

In equation (2), ΔTC _j (t) = TC _j (t) -TC _j (t-Δt),

ΔTC _j (t) represents the energy loss of node j in the Δt time period.

Represents the average energy consumption level of all neighboring nodes of node i in Δt time, ΔTC _i (t) represents the energy loss of node i in the time period of Δt, and n represents the number of neighbor nodes of node i.

The greater the energy deviation, the lower the credibility of the node, so the trust value of the physical layer can be obtained

The calculation formula:

In equation (3), if the relative deviation between the energy consumption of the node and the average energy consumption of the neighboring node is greater than 1, it indicates that the energy consumption of the node has exceeded or is lower than the average energy consumption of the neighboring node. At this time, the node may be a malicious node, reducing the trust value to 0.

Step 22: According to the mechanism that the backoff window of the node is random and the number of packet retransmissions, the idle time and the retransmission rate of the node can be obtained. The trust value of the MAC layer is obtained by using the relative deviation between the node idle time and the retransmission rate and the neighbor nodes. That is, at the MAC layer, the idle time and retransmission rate of each sensor node are used as key parameters to obtain the trust value of each sensor node.

Specifically, the interval between two consecutive successful transmissions of a node is defined as idle time. The attacker reduces the waiting time by reducing the random backoff time and the time interval between two transmissions. Therefore, the idle time of the malicious node will be less than the idle time of the non-malicious node.

The malicious node scrambles the frame to obtain the priority of channel access. Because malicious nodes have higher priority for channel access, the retransmission rate of malicious nodes will be lower than that of non-malicious nodes. Taking idle time and retransmission rate as the trust metric of the MAC layer, then node i takes the trust value of node j

Evaluation is:

In equation (4),

Means free time,

Representing the retransmission rate, m ₁ and m ₂ are the weights of the two parameter trust metrics. m ₁ ∈ [0,1], m ₂ ∈ [0,1], and m ₁ + m ₂ = 1. The weight values of m ₁ and m ₂ are determined by the actual situation of the implementation of the detection system.

The following gives the idle time

And retransmission rate

The calculation process:

1) Idle time

In formula (5),

It means the j node starts to receive the xth RTS packet moment,

Indicates the start time of the last packet transmission of node j, f ^ACK indicates the duration of an acknowledgment frame (ACK), and f ^SIFS indicates the duration of a short frame interval (Short Inter-frame Spacing, SIFS) frame,

Indicates the duration of node j data transmission, and f ^DIFS indicates the duration of the node's long frame interval (Distributed Inter-frame Spacing, DIFS) frame,

Represents the random backoff time bt (back-off time) of node j,

Represents the random backoff time of node j. In the network, the neighbor node of node j can be expressed as: K _j = {k ₁ , k ₂ , k ₄ , ..., k _b }.

Represents the average idle time of all nodes that have successfully sent data to the neighbor node of node j; b is the number of neighbor nodes of node j, the average idle time of the neighbor nodes of node j is known, so the idle time of node j and its neighbor nodes can be obtained Deviation value of idle time:

In equation (6), the number of times the m node sends data can be obtained from the relative deviation value of the idle time to obtain the confidence value of the parameter idle time.

From equation (7), we can see that if the idle time of the monitored node is less than the average idle time in the cluster, then its trust value will decrease.

2) Retransmission rate

For calculation

For the trust value of, first calculate the relative deviation of the retransmission times of node j.

The monitoring node or cluster head can detect whether it is a retransmission by observing the repeated sequence number in the frame header. The node retransmission rate can be obtained by using the number of retransmissions. The smaller the retransmission rate, the more likely the node will be attacked. Therefore, within the time period of Δt, the retransmission rate of the monitored node j can be obtained as:

In equation (8), rs _ij (t) represents the number of retransmissions of node j in the period Δt. S_pack _j (t) represents the number of packets sent by node j in the Δt time period.

It is also possible to obtain the average retransmission rate of its neighboring nodes in the Δt time period by monitoring node i.

In equation (9), rs_rate _ik (t) represents the retransmission rate of k nodes in the Δt time period, and k is one of the neighbor nodes of node i. n represents the number of adjacent nodes of node i.

From Equation (13), the average retransmission rate of the neighboring node of the monitored node j can be obtained, and the relative deviation of the retransmission rate can be calculated. We use the relative deviation of the retransmission rate of node j to get the retransmission rate:

Step 23: Calculate the trust value of the network layer based on the packet forwarding rate of the node and the relative deviation value of the node-to-cluster head hop count from the neighbor node.

The calculation of the trust value of the network layer takes the hop count of the node to the cluster head and the packet forwarding rate as trust metrics. That is, at the network layer, the hop count of each sensor node to the cluster head and the packet forwarding rate are used as key parameters To get the trust value of each sensor node, including:

Calculate the trust value of the network layer according to equation (11):

In equation (11), q ₁ ∈ [0,1] and q ₂ ∈ [0,1] are weight values, and q ₁ + q ₂ = 1.

The weight values of q ₁ and q _{2 are} determined according to the actual situation of network deployment.

First calculate the hop count as the trust value of the trust value metric. The monitoring node uses the relative deviation of the hop count of the monitored node and its neighbors as the trusted value.

In equation (12), n represents the number of neighbor nodes of node i, and k is one of the neighbor nodes of the monitored node. From the average hops of neighbor nodes, the relative deviation between the hops of the monitored node j and the average hops of the neighbor nodes can be calculated. From this, the trust value of the monitored j node can be obtained

In equation (13), hop_count _j represents the number of hops from node j to the cluster head. When the hop count of the monitored node is less than the average hop count of the neighbor node, the trust value will drop.

The monitoring node i can obtain the packet forwarding rate of the monitored node j, and can also obtain the trust value of the forwarding rate obtained by the forwarding.

In equation (14), FP _j (t) represents the number of packets that node j successfully forwarded, and RFP _j (t) represents the number of packets forwarded by surrounding nodes from node j. It can be seen from equation (14) that if node j does not forward successfully, then the trust value will decrease accordingly.

Step 3: According to the obtained trust values of each sensor node in the physical layer, MAC layer, and network layer, fusion is performed to obtain the total trust value.

The trust value of node j to node i is obtained according to the relative deviation value of the parameters of each protocol layer of the node. The total trust value formula is

In formula (15),

Represents the trust value calculated by its neighbor node j at time t,

Represents the trust value calculated by its neighbor node j at time t-Δt, μ∈ [0,1] is the weight of the historical trust value.

In this method, μ is set according to actual needs.

In formula (16),

with

It represents the directly calculated trust value of node i to node j at the physical layer, MAC layer and network layer.

w ₁ ∈ [0,1], w ₂ ∈ [0,1], and w ₃ ∈ [0,1], which represent the weights of the trust values of the physical layer, MAC layer, and network layer, where w ₁ + w ₂ + w ₃ = 1.

Consider whether a node is a malicious node, by comparing the trust value of the node with a preset trust value threshold. In the cluster, since the monitoring node sends its trust evaluation results about neighboring nodes to the cluster head, the cluster head can calculate the average trust value of j as its trust value:

Where T _ij (t) is the fusion trust value of the current j node, and n represents the number of neighboring nodes related to node j. The calculation of the trust value of the cluster head is the same as that of the nodes in the cluster.

Step 4: Then the data noise point technology will bring the data into the node where the abnormality is detected to obtain the noise point list of the sensor node.

Step 41: Use the parameters of each protocol layer as data and send them to the cluster head or base station. The cluster head or base station will use the trust value obtained in step 2 to give different weights to the parameters of each node and bring them into the algorithm. Get the test result.

Data noise point detection technology. In the MAC layer, the average size of the backoff window (CW) in the Δt time is used as a key parameter for noise point detection. The smaller the average backoff window, the higher the channel priority and the more likely it is. being attacked. In the network layer, the node packet forwarding rate and the number of hops to the cluster head are used as key parameters for noise point detection, because when a large number of malicious nodes appear in neighbor nodes, the relative deviation value from neighbor nodes will appear serious error. Using the above two parameters as key parameters can reduce the error of the detection process. The cluster head or base station uses the trust value obtained by S1 as the credible weight of the data, and uses the DBSCAN (Density-Based Spatial Clustering of Applications with Noise) algorithm for noise point detection. The DBSCAN algorithm can refer to "Ester MA-Density-Based Algorithms for Discovery Clusters in Large Spatial Databases with Noise [C] // Proceedings of the second ACM International Conference Knowledge Discovery (KDD), 1996. AAAI Press, 1996. ".

Step 42: Generate a list of sensor noise points from the obtained detection results and send them to each node.

The cluster head punishes the nodes in the noise sensor list generated after the detection of data noise points of each cycle to reduce the trust value, and forwards the trust value of the node in the cluster after punishment to each node in the cluster .

Step 5: Use the punishment mechanism to determine the punishment strength and obtain the trust value of the final node. Nodes whose trust value is lower than the threshold are classified as malicious nodes.

Step 51: Use the fusion trust value of the protocol layer to add weight to the penalty power of the node. The higher the trust value, the greater the penalty power. Penalize the trust value of the node to get the global trust value of the final node.

The punishment degree of the present invention is different according to different protocol layers. The global trust value after punishment is expressed as:

In equation (18), C _MAC and C _NET respectively represent the penalty factor in the case of an attack in the MAC layer and the network layer, and the penalty factor determines the value of the final penalty factor after multiple experiments. α ₁ ∈ [0,1] and α ₂ ∈ [0,1] are the weight values of the penalty factors at the MAC layer and the network layer respectively. The present invention sets the weight values of α ₁ and α ₂ to the currently calculated nodes Trust value, when the node's higher trust value is detected as a noise point sensor node, then the node may be maliciously attacked but not detected, then the greater the punishment of the node, otherwise the lower the node's confidence , The less punished the node is.

Step 52: Use the false positive rate and the false negative rate to obtain the best detection threshold, and compare the node trust value with the threshold. If it is less than the threshold, it is a malicious node.

In order to verify that the method proposed in this application (that is, T-MPNID method) can effectively detect the attack types of different protocol layers, the simulation experiments are as follows:

Using MATLAB2016a as a simulation tool, 120 sensor nodes were deployed within a range of 100m × 100m and were divided into 4 clusters on average. The time interval for updating the trust value is 10 minutes. The detailed simulation parameters are shown in Table 1.

Table 1 Experimental parameter values

In the experiment, four typical attacks were simulated at the MAC layer and the network layer, including back-off manipulation, selective forwarding attack, sinkhole attack, and MAC-network attack. For a cross-layer attack (MAC-Network cross-layer attack), the false positive rate (FPR: false positive rate) and false negative rate (FNR: false negative rate) are selected to measure the key performance indicators of the detection system.

False positives refer to: detected as a malicious node, actually a normal node.

Missing reports refer to: detected as a normal node, actually a malicious node.

In order to determine the optimal detection threshold S, the false alarm rate and the false alarm rate under different detection thresholds are simulated in the four attack types. As shown in FIG. 2, when the threshold S of the four types of attacks is 0.885, the false alarm rate and the false alarm rate are both less than 0.07, so this application sets the optimal detection threshold to 0.885.

In terms of detection rate, false alarm rate, and false alarm rate, they are compared with the two latest algorithms. The two latest algorithms are the NBBTE scheme and the PLTB scheme. Among them, the NBBTE scheme can refer to "FENG R, XU X, XIANG Z , et al. A Trust Evaluation Algorithm for Wireless Wireless Sensors Networks Based Node on Behaviors and DS Evidence Theory [J]. Sensors, 2011, 11 (2): 1345-1360. ”For the PLTB scheme, please refer to“ JIAN W, SHUAI J, FAPOJUWOAOAProtocolLayerTrust-BasedIntrusionDetectionSchemeforWirelessSensorNetworks [J] .Sensors, 2017,17 (6): 1227. "

FIG. 3 is a comparison diagram of the detection rate of the T-MPNID method and the NBBTE method proposed in this application. According to Figure 3, the detection rate of the T-MPNID method is better than the NBBTE method under the four attacks. The NBBTE method only focuses on the node behavior of the network layer, so the detection rate at the MAC layer is zero. The detection rate of the method proposed in this application in cross-layer attacks, slot attacks, and selective forwarding attacks is increased by 22%, 10%, and 3%, respectively, compared to the NBBTE method.

As shown in Figure 4, the detection rate of the T-MPNID method is compared with the PLTB method. As the number of malicious nodes increases, the detection rate of the two methods continues to decline. When the proportion of malicious nodes is less than 10%, in the T-MPNID method, the detection rates of the four attacks are maintained above 0.97. When the proportion of malicious nodes is greater than 10%, the detection rate of back-off attacks and cross-layer attacks drops much lower than that of PLTB. When the proportion of the number of malicious nodes is 30%, the detection rate of the T-MPNID method is improved by 0.33, 0.25, 0.08 among the four attacks of back-off attack, cross-layer attack, slot attack and selective forwarding attack respectively. , 0.03.

Figure 5 is a comparison chart of the false alarm rate of the T-MPNID method and the NBBTE method. As the number of malicious nodes increases, the false alarm rate shows an upward trend. Since the NBBTE method does not consider back-off attacks, no analysis of back-off attacks is performed. In slot attacks, cross-layer attacks and selective forwarding attacks, the false alarm rate of the T-MPNID method is lower than that of the NBBTE method. When the proportion of malicious nodes is 30%, the false alarm rate of the T-MPNID method is reduced by 50% and 40% in cross-layer attacks and slot attacks, respectively, compared to the NBBTE method.

Figure 6 is a comparison diagram of the false alarm rate of the T-MPNID method and the PLTB method. When the proportion of malicious nodes exceeds 20%, the false alarm rate of the T-MPNID method is lower than the PLTB method in slot attacks and cross-layer attacks. 5% -8%. In both methods, the false positive rate of selective forwarding attacks is stable at 0.02.

In Figure 7, the false alarm rate of the four attacks in the T-MPNID method is lower than that of the NBBTE method. When the proportion of malicious nodes is 20%, in the T-MPNID method, the underreporting rates of slot attacks, selective forwarding attacks, and cross-layer attacks are reduced by 54%, 51.8%, and 53.1%, respectively, compared with the NBBTE method. When the proportion of malicious nodes is 30%, the under-reporting rate of the T-MPNID method in slot attacks, selective forwarding attacks, and cross-layer attacks is reduced by 20.6%, 22.3%, and 15.8% respectively compared to the NBBTE method.

In Fig. 8, the PLTB method is compared with the T-MPNID method. When the proportion of malicious nodes exceeds 15%, the T-MPNID method has four types of back-off attacks, slot attacks, cross-layer attacks, and selective forwarding attacks. Compared with PLTB, the underreporting rate decreased by 9%, 5%, 3% and 1% on average.

In summary, this application uses the relative deviation of parameters of multiple protocol layers as a trust metric, uses the weighting method to establish a trust system model, and establishes a penalty mechanism through data noise point detection technology; the monitoring node observes the physical layer, MAC layer and network layer. Monitor the key parameters of the node, and calculate the relative deviations of these key parameters. Based on the relative deviations of the parameters, the monitoring node aggregates the trust values through different protocol layers to evaluate the credibility of the monitored node, and compares the credibility and key parameters Send to cluster head (CH) or base station (BS). The cluster head and the base station can calculate the aggregated trust value of the node through the evaluation trust values of multiple monitoring nodes. At the same time, the cluster head or the base station will periodically use noise detection technology to obtain abnormal key parameters, and carry out on the nodes with abnormal key parameter data. Penalty, reduce its trust value. If the trust value of a node is less than the threshold, the node is regarded as an abnormal node; the trust value is determined by the key parameters of different protocol layers; it can effectively detect the attack types of different protocol layers.

A computer-readable storage medium on which a computer program is stored, which when executed by a processor implements any of the steps of the method.

Some steps in the embodiments of the present invention may be implemented by software, and the corresponding software program may be stored in a readable storage medium, such as an optical disk or a hard disk.

The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present invention should be included in the protection of the present invention Within range.

Claims

A multi-protocol layer intrusion detection method, which is characterized by:

Build a wireless sensor network;

The trust value of each sensor node at each layer is obtained by calculating the relative deviation value of key parameters of each sensor node in the wireless sensor network at the physical layer, MAC layer, and network layer respectively;

According to the obtained trust values of each sensor node in the physical layer, MAC layer, and network layer, fusion is performed to obtain the total trust value of each sensor node;

Use the data noise point technology to bring the key parameters into the detection and obtain the noise point list of the sensor nodes in the wireless sensor network;

Use the punishment mechanism to determine the punishment strength and obtain the global trust value of each sensor node. Nodes whose global trust value is lower than the threshold are classified as malicious nodes.
The multi-protocol layer intrusion detection method according to claim 1, characterized in that each sensor is obtained by calculating the relative deviation value of key parameters of each sensor node in the wireless sensor network at the physical layer, MAC layer and network layer respectively The trust value of the node at each layer, including:

Measure energy loss according to the number of packets sent, received, and forwarded by each sensor node, and use the relative deviation value of energy loss to obtain the trust value of the physical layer;

According to the random mechanism of the node's backoff window and the number of packet retransmissions, the idle time and retransmission rate of each sensor node are obtained; the idle time of each sensor node and the relative deviation of the retransmission rate from the neighbor node are used to obtain the MAC layer. Trust value

The trust value of the network layer is calculated according to the packet forwarding rate of each sensor node and the relative deviation between the number of hops from the node to the cluster head node and neighbor nodes.
The multi-protocol layer intrusion detection method according to claim 1, wherein the data noise point technology is used to bring key parameters into the detection to obtain a noise point list of sensor nodes in the wireless sensor network, including:

Send the key parameters of each protocol layer as data to the cluster head node or base station;

The cluster head node or base station will use the obtained trust value to give different weights to the parameters of each node, and bring it into the algorithm to obtain the detection result;

Generate a list of sensor noise points from the obtained detection results and send them to each sensor node.
The multi-protocol layer intrusion detection method according to claim 1, wherein the punishment mechanism is used to determine the punishment strength to obtain the global trust value of each sensor node, and the node whose trust value is below the threshold is classified as malicious Nodes, including:

Use the fusion trust value of the protocol layer to add weight to the punishment strength of the node. The higher the trust value, the greater the punishment strength;

Penalize the trust value of each sensor node to obtain the global trust value of each sensor node;

Use the false positive rate and false negative rate to get the best detection threshold. Compare the node trust value with the detection threshold. If it is less than the detection threshold, it is a malicious node.
A computer device, including a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, when the processor executes the program, any one of claims 1 to 4 is realized Method steps.
A computer-readable storage medium on which a computer program is stored, characterized in that when the program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.
A processor, characterized in that the processor is used to run a program, wherein the method according to any one of claims 1 to 4 is executed when the program is run.