CN102143495B - Method for detecting node attack of wireless sensor network - Google Patents

Abstract

The invention belongs to the field of the application of wireless sensor network and information security cross technology, and provides a method for detecting node attack of a wireless sensor network, which is characterized by comprising the following steps: the method comprises the steps that the wireless sensor network is divided into four deployment areas; numbering the nodes and the deployment areas and forming corresponding mapping relation tables, wherein the nodes are deployed to the corresponding areas; broadcasting the ID and the area number by the node, receiving the feedback of the broadcasted node, taking the node capable of receiving the broadcast as a neighbor node, and recording the ID and the area number of the neighbor node in a neighbor list; the node checks the area numbers of all neighbor nodes in the neighbor list to form a boundary area and a boundary area number; the boundary area and the four initialized deployment areas form a new deployment area partition; when the node area number changes, the received broadcasted node modifies the area number of the corresponding adjacent node in the neighbor list to the neighbor broadcast ID and the new area number to form a wireless sensor network with a new subarea; the new node is added in a secondary detection step of a copy node and the like, and has the advantages of no need of any auxiliary equipment, low energy consumption, high efficiency and convenient realization.

Description

A detection method of wireless sensor network node attack

technical field

The invention is a wireless sensor network security protection scheme, which belongs to the application field of wireless sensor network and information security intersecting technology.

Background technique

Wireless sensor network is a kind of emerging network integrating multiple technologies, which is widely used in various fields such as military and civilian. Due to the characteristics of sensor nodes, it is vulnerable to various attacks. Node replication attack refers to the attack type in which the attacker obtains important information such as keys and node IDs after capturing sensor nodes, forges a large number of replication nodes through these information, and spreads them into the network to carry out sabotage activities. This kind of attack comes from inside the network, and the copy nodes have all the legal information of the captured nodes. Therefore, they are difficult to be found and have strong destructive power to the network.

The detection methods of node replication attack can be divided into three categories: central detection, local detection and broadcast detection. Central detection means that all nodes regularly upload the neighbor list to the central node, and the central node finds out the duplicate nodes. This method consumes a lot of energy, especially the nodes around the central node will become hot spots, and the energy consumption will be very fast. Once the central node is captured, the method will immediately fail . Local detection is to vote among neighboring nodes to find out the replica nodes. The disadvantage is that it cannot find out the replica nodes that are far away and is vulnerable to blacklist attacks. Broadcast detection means that nodes flood broadcast verification information, and the nodes that receive the information record the verification information. This method consumes a lot of energy and requires a lot of storage space.

Contents of the invention

The purpose of the present invention is to overcome the shortcoming of prior art, provide a kind of detection method of wireless sensor network node attack, it adopts the method for the innovative combination of network deployment zoning means and new checkpoint detection means to realize the effective detection of duplicated nodes.

The scheme of the present invention is further described below:

A detection method for a wireless sensor network node attack, characterized in that:

include steps,

1) The wireless sensor network is divided into four deployment area steps;

2) Number the nodes and deployment areas and form a corresponding mapping relationship table, and the nodes are deployed to the corresponding area steps;

3) The node broadcasts the ID and the area number, receives the feedback of the broadcasted node, and regards the node that can receive the broadcast as a neighbor node, and records the ID and the area number of the neighbor node in the neighbor list step;

4) The node checks the area numbers of all neighbor nodes in the neighbor list to form the border area and the border area number; the border area and the four initialized deployment areas form a new deployment area division;

5) When the node area number changes, broadcast ID and new area number to its neighbors, and the received broadcasted node modifies the area number of the corresponding adjacent node in its neighbor list to form a wireless sensor network step with a new partition;

6) A new node joins, and the new node broadcasts its ID and area number; the neighbor node receives the broadcast information and judges whether it is equal to the area number, and if so, finds the duplicate node, otherwise scans its neighbor list to determine whether there is an ID related to the new node. Neighbor IDs for nodes equal, if so to discover duplicate nodes.

Further optimization, when a new node joins, there are also steps

7) The new node randomly selects a non-empty adjacent area to send the verification information, and specifies one of the nodes in the adjacent area to forward the verification information; the node receiving the verification information compares the IDs of the neighbor list and the temporary list by scanning, if they are equal IDs , the second detection step of judging that the new node is a duplicate node.

Description of drawings

Figure 1 is a schematic diagram of the initial deployment area;

Figure 2 is a new schematic diagram of the deployment area in the border area;

Fig. 3 is the first detection flow chart of new node;

Fig. 4 is a flow chart of secondary detection of new nodes.

Detailed ways

Embodiment one

Referring to Figures 1 to 2, the wireless sensor network is divided into four deployment areas (also known as main areas), namely areas 1, 2, 3 and 4; and then in order:

Number the nodes and deployment areas and form a corresponding mapping relationship table, and the nodes are deployed to the corresponding areas;

The node broadcasts the ID and area number, receives the feedback from the broadcasted node, and regards the node that can receive the broadcast as a neighbor node, and records the ID and area number of the neighbor node in the neighbor list;

The node checks the area numbers of all neighbor nodes in the neighbor list to form border areas and border area numbers (as shown in Figure 2, the border areas are areas 5, 6, 7, 8 and 9); the border area and the four initialized deployment areas form a new deployment area;

When the area number of a node changes, it broadcasts the ID and the new area number to its neighbors, and the received broadcast node modifies the area number of the corresponding neighbor node in its neighbor list to form a wireless sensor network with a new partition.

Among them, the following will take node A as an example to illustrate the rules for modifying the area number:

The variable num _x indicates the number of neighbors whose area number is x in the neighbor list, and the corresponding code is as follows:

Here the threshold NUM is to prevent the node from being captured before the region division and destroying the division of the region. Therefore, the NUM value is generally taken as 2. If num _x <NUM exists in the neighbor list of node A, then A randomly selects 3 neighbor nodes and sends the node ID; if the neighbor node returns the same information, it is determined that the ID is a duplicate node. The nodes in areas 2, 3, and 4 are similar, and the nodes in the final deployment area are divided as shown in Figure 2.

There are three possible locations for the newly added nodes: the interior of the main area away from the boundary area, the junction of the corresponding main area and the border area, and the junction of the non-corresponding main area and the border area. First, establish coordinates for these three situations.

The first one: the number of the node area remains unchanged, compare the horizontal and vertical coordinates of each neighboring node, and take the minimum value plus 1 as its coordinate.

The second method: firstly calculate the respective ratios of border region nodes and main region nodes among adjacent nodes, and whichever ratio is greater than 50%, its region number is determined to be the number of that region. If the proportion of nodes in area 9 among the adjacent nodes exceeds 25%, the area number of the newly added node is 9. The coordinates of nodes in area 9 are (0, 0), and the nodes in other boundary areas determine one of them as 0 according to the area number, In other cases, the node coordinates are the same as the first case.

The third type: node failure.

As shown in Figure 3, when a new node joins, the new node broadcasts its ID and area number; the neighbor node receives the broadcast information and judges whether it is equal to the area number, if so, finds the duplicate node, otherwise scans its neighbor list, Determine whether there is a neighbor ID equal to the new node, and if so, find the duplicate node.

As shown in Figure 4, after completing the detection process shown in Figure 3, the new node randomly selects a non-empty adjacent area to send verification information, and designates one of the nodes in the adjacent area to forward the verification information; the node that receives the verification information passes Scan the neighbor list and compare the IDs of the temporary list. If the IDs are equal, it is judged that the new node is a duplicate node. Otherwise, the node receiving the verification information randomly selects a non-empty adjacent area to send verification information to complete the secondary detection.

In summary, compared with the prior art, the method of the present invention is completely completed by normal sensor nodes without any auxiliary equipment, so that the number of sending and receiving packets in the process of attack detection is greatly reduced, and the remote replication node can be directly found ; For the replication nodes in the same area, due to the short distance, there is no need to send a large number of verification lines, thereby saving energy, and compared with the traditional method, the energy consumption will be greatly reduced.

Claims (2)

1. A detection method for a wireless sensor network node attack, characterized in that: include steps, 1) The wireless sensor network is divided into four deployment area steps; 2) Number the nodes and deployment areas and form a corresponding mapping relationship table, and the nodes are deployed to the corresponding area steps; 3) The node broadcasts the ID and the area number, receives the feedback of the broadcasted node, and regards the node that can receive the broadcast as a neighbor node, and records the ID and the area number of the neighbor node in the neighbor list step; 4) The node checks the area numbers of all neighbor nodes in the neighbor list to form the border area and the border area number; the border area and the four initialized deployment areas form a new deployment area division; respectively establish coordinates for the new deployment area, where when the new node When adding to the inside of the main area far away from the boundary area, the number of the node area remains unchanged. Compare the horizontal and vertical coordinates of each neighboring node, and take the minimum value plus 1 as its coordinate. When a new node is added as the corresponding main area and the boundary area At the junction, first calculate the proportion of the border area nodes and the main area nodes among the adjacent nodes, determine which area is the number, compare the horizontal and vertical coordinates of each neighboring node, and take the minimum value plus 1 as its coordinate; When a new node joins the junction of the non-corresponding main area and the border area, the node fails; 5) When the node area number changes, broadcast ID and new area number to its neighbors, and the received broadcasted node modifies the area number of the corresponding adjacent node in its neighbor list to form a wireless sensor network step with a new partition; 6) A new node joins, and the new node broadcasts its ID and area number; the neighbor node receives the broadcast information and judges whether it is equal to the area number, and if so, finds the duplicate node, otherwise scans its neighbor list to determine whether there is an ID related to the new node. Neighbor IDs for nodes equal, if so to discover duplicate nodes. 2. detection method as claimed in claim 1, is characterized in that, also has the step 7) The new node randomly selects a non-empty adjacent area to send the verification information, and specifies one of the nodes in the adjacent area to forward the verification information; the node receiving the verification information compares the IDs of the neighbor list and the temporary list by scanning, if they are equal IDs , the second detection step of judging that the new node is a duplicate node.

Images