Patent Grant
12069481
The present invention belongs to the technical field of wireless communications, and relates to an improved KNN-Based 6LoWPAN network intrusion detection method.
IP is an important trend of the development of wireless sensor network technology, and adopting an IPV6 technology is the inevitable choice of IP of a wireless sensor network. The private protocol communication of an existing wireless sensor network is often related to specific applications, the expansibility and portability are poor, and users from an external network are difficult to directly access the nodes in the wireless sensor network. Through the IPV6 technology, the wireless sensor network can be seamlessly connected with the Internet, thereby realizing the free communication between people and people, people and objects, and objects and objects based on an IP protocol. The Internet Engineering Task Force (IETF) actively promotes wireless sensor network technology based on IPv6, and core standards such as 6LoWPAN, RPL, CoAP have been basically formulated, wherein, a bottom layer of the 6LoWPAN protocol adopts a physical layer and MAC layer protocol of IEEE 802.15.4, while a network layer cuts and optimizes the IPV6 protocol, which is suitable for the embedded IPV6 field, so that a large number of internet of things products can network with each other and also can be connected to a next-generation internet through the IPV6 protocol.
The wireless sensor network based on 6LoWPAN brings freedom, and at the same time, a security problem has become a major obstacle and bottleneck problem restricting the application and popularization thereof. Compared with a traditional wireless sensor network, 6LoWPAN has essential differences, and because of the IP protocol, the attacker has more potential attacks on 6LoWPAN. At the same time, the inherent potential safety hazards that 6LoWPAN has have not been properly solved.
A security protection mechanism provided by 6LoWPAN is insufficient to protect the ICMP abuse and Smurf attack caused by multicast in large-scale network due to heterogeneity and distribution in the process of neighbor discovery, path MTU discovery, address configuration, etc. In addition, UDP protocol does not need to provide a given source address in an authentication request packet, which can access the IP address spoofing attack introduced by a restricted network. The response request in a CoAP protocol introduces DoS attack caused by amplifying the risk and death of ping crashed due the fact that a network buffer is overloaded. The vulnerabilities brought by the collaboration conditions of layer protocols of these upper layer, security issues of the application layer protocol, the limitation of the application scenarios, etc., need to be specifically analyzed on the basis of architecture and theory. Solving a security problem of 6LoWPAN is the prerequisite for large-scale application thereof.
As an automatic security protection technology, intrusion detection can identify, evaluate and report the intrusion, and take active response measures. At present, the scale of the research on an IPV6 Internet intrusion detection system has been preliminarily established, but the research on the wireless sensor network intrusion detection based on the IPV6 protocol is also less, the research on the intrusion detection mechanism based on 6LoWPAN has some solutions for one kind of attack, and this kind of research does not involve detection for unknown attacks.
In IPv6 network intrusion detection, due to the frequent change of streaming data, how to update a normal data profile online to realize the effective judgment of a node behavior is an urgent problem to be solved at present. In order to realize the intrusion detection based on the 6LoWPAN wireless sensor network, a new mechanism is needed, which can detect the intrusion online, and at the same time has the advantages of reliability, extensibility, independent learning, easy management, low maintenance cost, etc.
Some of current researches concentrate on adopting a K-near neighbor (KNN) algorithm to conduct abnormal assessment. The advantages of the KNN algorithm is that it can be used for nonlinear classification, and can generate decision boundary with arbitrary shape; and in addition, the KNN algorithm has lower training time complexity and higher accuracy, and the parameter K is not sensitive to noise. However, the KNN is difficult to be directly on the 6LoWPAN wireless sensor network. The essence of lazy learning makes it difficult for an abnormal detection scheme based on the KNN to be applied to online detection, especially when the communication costs are restricted. The lazy learning is driven through test data, each coming test data need to learn the normal profile independently online, which will produce greater calculation complexity (reflected in the distance calculation). Because the similarity between a test sample and a training sample needs to be calculated one by one, which consumes a great number of resources, at the same time, the sample also has an inbalanced problem (that is, some categories have large numbers of samples, while others have small numbers of samples), the selection and data preprocessing on parameters are needed, otherwise, a nearest neighbor classifier can make false prediction.
To sum up: since the features of a 1.6LoWPAN network are different from those of the traditional IPv6 network, the intrusion detection is difficult; and the node behavior of a 2.6LoWPAN network and the data flow in the network change frequently and randomly, so it is difficult to define the normal data profile which makes the online detection difficult.
For an intrusion detection problem of the 6LoWPAN network, the present invention comprehensively considers the features and operation mode of the 6LoWPAN network given by RFC4944, RFC7252 and RFC6550, proposes a 6LoWPAN network-oriented invasion detection architecture, and at the same time proposes an invasion detection mechanism based on the KNN improved algorithm, uses an improved lightweight algorithm to establish a profile model for a normal behavior, and can adjust the KNN parameters in real time to update and upgrade the profile model. This method can effectively detect DoS, address spoofing, man-in-the-middle attack and other typical intrusion attacks, and can provide redundant detection for unknown attacks to a certain extent.
In view of this, the purpose of the present invention is to provide an improved KNN-based 6LoWPAN network intrusion detection method, which has a good generalization ability for unknown attack types and a certain robustness for network environment changes. The method has small memory and requires little or no prior knowledge.
To achieve the above purpose, the present invention provides the following technical solution:
An intrusion detection architecture of a 6LoWPAN network proposed in the present invention is shown in
After the establishment of the above network, a hybrid network topology is adopted in the 6LoWPAN subnet, and a multi-hop routing method is adopted to create DODAG according to a RPL routing protocol (RFC 6550) and specific applications. The monitoring network element (MN) will monitor the communication from the neighbors thereof (comprising parent network element and sub-network element). A network element (MN) creates a monitoring table for each of the neighbors thereof to store the monitoring data for the network element.
The judgment process of intrusion detection can be divided into direct judgment based on the feature of a certain network element and comprehensive judgment on the state data table of the network element established based on the features of several network elements. The specific process is as follows:
I. Learning Process
The concepts will appear high frequently below in the present invention: state data of network element yi and feature data of network element yiq; in a learning process, the console will establish the state data table of network elements to cache the data and process the data in the table. The following contents will explain a construction method of the state data table of the network elements, a selection method of network element features, a capturing method of feature data of the network elements and an implementation object of the captured feature data.
1. State Data Table of Network Element
A state data table architecture of the network elements defined by the present invention is introduced firstly below. The network is shown in
A specific construction method in table 1 is started to be introduced below:
The method is mainly divided into three steps of:
The specific construction is as follows:
The number of sample state data in the state data table of the network elements shall not be less than the number of the network elements in the network nor more than two times the total number of the network elements, that is, the number of samples that can find outliers is optimal. The state sets of several network elements cached in the table are set as {y1, . . . , yi}. The present invention specifies m<i<2m. The present invention specifies three time periods of T0→T1, T1→T2 and T2→T3. Before T0, the network has started and the node joining process is completed, as shown in
m<i<2m; and the parameter p is used during an updating process and is a parameter in an updating algorithm. The value of p is specified by the console. At this time, the states
and yx are the states of the same network element in different time periods. The data in the table are updated after these state data are screened according to the probability of p. Since the states of the network elements in the table have been converted into the data, the console does not need to reflect time when the table is constructed, and the previous states of the network elements do not need to be replaced.
As stated above, the data amount of the states of the network elements will be determined in this step, as shown in Table 2.
(1) Construction of Feature Set of Network Elements
Here, it should be further noted that some features are time-based statistical features of network traffic, that is,
In order to avoid the influence of time period on the statistical feature data, these features are uniformly represented by the “frequency of message occurrence”;
The weights are assigned according to an impact factor console of each feature, satisfying Σweight=1. The assigned weights can reduce the bias caused by distinct features.
A process that a series of features of network elements in the table are constructed as feature sets is introduced below step by step.
Since the state data of the network elements in the table are captured at different times in the process of firstly forming the state data table of the network elements, the cases of capturing data in different (T0→T1, and T1→T2) time periods will be explained in the process of constructing the following feature set. Except that the cases of capturing data in different time period exists in the process of firstly forming the table, the other cases are that the data are captured in the same (T2→T3) time period.
The process of constructing the state data table of network elements in time sequence is described below in detail.
Firstly, describing a first forming process of the state data table of network elements:
Capturing, by an intrusion detection auxiliary device 2, an address unreachable message that is returned to a network element, conducting statistical monitoring on the messages in T0→T1, monitoring the occurrence frequency, and recording the feature as vicmp1.
This step is that recording the network element feature of vicmp1 in the table, and the state data table of network elements becomes:
An intrusion detection device and a proxy network element in T0→T1: conducting statistics on network element notification messages; comparing the difference between the notification messages obtained by both; and monitoring the difference number of the messages, and recording the feature as ΔCON.
This step is that recording the feature of ΔCON in the table, and the state data table of the network element becomes:
This step is that recording the feature of Δack in the table, and the state data table of the network element becomes:
This step is that recording the feature of vicmp2 in the table, and the state data table of network elements becomes:
FFD and 6R in T0→T1, time period: conducting statistics on the self-energy, and processing the message obtained through the statistics, to obtain the energy feature. Thus, the state data table of the network element becomes:
topo
forward
In T1→T2 time period, a construction process of the state data table of the network elements is as shown in
topo
forward
In T0→T2 time period, the feature data of network elements are captured in two time periods, as shown in table 11, and the obtained data are in a firstly constructed state data table of the network element after the network is started.
topo
forward
In T2→T3 time period, the capturing mode and the specific implementation object of the feature data of the network elements are the same, and the construction process is as shown in
network elements will be
captured, and the state of network elements in the network needs to be captured with
time period in T2→T3 time period. └x┘ is a function representation for an integer part of a decimal. The finally constructed state data table of the network element are shown in Table 11 below:
After the completion of the construction for the state data table of the network elements, the processing mode of the console for specific feature data of the network elements in the state data table of the network elements will be specifically explained below.
(3) Data Preprocessing after the State Data Table of the Network Elements is Filled
The console checks whether there are some non-numerical variables and obviously unreasonable data in the state data table of the network elements, which are invalid; after the denoising process, the feature data set of the network elements of the nth feature in the table is set as y|n={y1n, y2n, . . . , yin}, i.e., the nth column of the state data table of the network elements. The threshold values of the y|n set are maxn and minn, where minn is a minimum value in the set and maxn is a maximum value;
and in addition, the console also needs to rematch the weight of each feature according to the impact factor of the feature;
Special attention should be paid to the fact that parts of features of the network elements analyzed below are not listed in the state data table of the network elements. for three reasons:
In the present invention, the features are screened and finally determined below step by step by analyzing network features.
In addition, in the process of selecting the following features, all frequency limits are hypothetical, with a view to illustrating that these features can reflect the secure state of the network elements to a certain extent. The intrusion detection mechanism is proposed in the present invention just because of unpredictability and dynamic variability of limiting value of the network features.
Process 1: Address Assignment and Resolution
Each time the 6R network element sends a RA message, the intrusion detection auxiliary device 1 (close to the 6R network element) captures the RA message in the T0→T1, T1→T2 and T2→T3 time periods respectively, and parses and compares the RA message contents; and captures different messages from the 6R, wherein the address prefixes are respectively:
prefix1,prefix2, . . . ,prefixn
The intrusion detection auxiliary equipment 2 monitors NS messages of subnet intranet elements in T0→T1, T1→T2 and T2→T3 time periods respectively. Once any network element receives the NS frequency exceeding the limit, the subnet intranet elements are actively detected, that is, and the subnet intranet elements send NS messages in reverse. If NA is not returned, or NA messages from other MAC addresses are received, the behavior is proved to be abnormal, ND table entries are not updated, and the behavior is reported to the console. Supposing that the network element is under normal condition, the frequency limit of the received NS message is vlimit-ns, and suppose a source IP address of the received NS message is Address0, the source IP address of the returned NA message is Address1. if vns>vlimit-ns, the NS message is sent in reverse; Step 1: if the NA message is not returned, the network element is abnormal; Step 2: if the NA message is returned, the IP address is compared; Address0⊕Address1=1, the network element is abnormal; Address0⊕Address1=0, the network element is normal; if vns<vlimit-ns, the network element is normal;
If the destination address of the data packet is not in the network elements (FFD and 6R) cache, that is, when the data packet is targeted in the network element address, and if it does not exist or has not received a reply, and has not received a response for a long time, the destination address is unreachable. Therefore, it is necessary for an adaptation layer to provide an address unreachable message, and it is necessary to return an address unreachable message to the network element that sends the data packet, i.e., an error reporting message of ICMPv6 specification.
The intrusion detection auxiliary device 2 captures the address unreachable message returned to the network element and detects the message rate. Once the rate exceeds the threshold, it illustrates that the destination address does not exist in the network, or there is a malicious use condition. The intrusion detection auxiliary device 2 filters and extracts the ICMP message in T0→T1, T1→T2 and T2→T3. Supposing that
a is the number of the ICMP error response messages received by certain network elements (FFD and 6R) in
is the occurrence frequency of error response messages received by the injured network element within
If the network is normal and not invaded, the maximum frequency of the received error response messages is V′max.
the intrusion detection auxiliary device 2 determines that the network element is injured;
the network element is normal;
The device is routed according to RFC6550. It should be noted in advance that the network element needs to be divided into sub-network element and parent network element, and measured by a rank value, and the higher the level, the smaller the rank value is and ETX value are. The networking is conducted in the initial state that the 6R joins DAG, the 6R network element that have joined to the DAG will regularly send the DIO message of multicast addresses. In addition, the network element (RFD or FFD) requested to join in can also make the 6R network element respond to the DIO message by sending a DIS message. The network element in the DAG will regularly send a DAO message (containing prefix information that the network element uses) to upper-level network element. After the upper-level receives the DAO message, the prefix information of the sub-network element will be cached, and DAO-ACK is responded. In the above process, an intrusion detection mechanism performs the following steps:
In this process, the present invention uses monitoring network elements to capture, analyze data and extracts the data. The information from an MN monitoring list comes from DIO and DAO messages that determine the network elements. MN monitoring list:
It is required that the sent and received network elements along a route are obliged to check whether a rank rule is broken, and a rank-error bit is set in the RPL packet information, to ensure that a rank value cannot be faked; in the above process, the execution step of which the network element in the network and the intrusion detection auxiliary device capture the feature data are as follows:
each monitoring network element is responsible for the behavior flow of a network element object within a monitoring range in T0→T1, T1→T2 and T2→T3. When the monitoring network element hears the DIO message from the network element object for the first time, it indicates that the topology setting starts and the state changes. Then, the monitoring network element extracts all the necessary information (i.e., a monitoring list) in the specific entries of the objects in a monitoring table thereof from the DIO and DAO messages, to determine the control messages sent or received by the monitored network element objects:
The application layer uses a CoAP protocol subscriber pattern to collect information. A CoAP Client observes the resources on a Server, the Client subscribes the resources to the Server, and only the resource state changes, the Server will notify the Client of new state of the resources. It should be noted that Client is the gateway for each DODAG (i.e. 6R), the Server is a subnet Intranet element (FFD), and the Proxy is the RFD in the subnet.
In the above process, the execution action steps of each unit in the network and the execution step of which the network element in the network and the intrusion detection auxiliary device capture the feature data are as follows:
The above feature (occurrence frequency of get message) is only for 6R, so the occurrence frequency of the get message is not listed in the feature set.
In another case, when the data changes, the network element subscribed by each agent client sends notification to the client as a request response, and the notification is a CON message. The intrusion detection device 1 also captures the CON message sent to 6R and statistically calculates the notification rate from each network element. Each agent network element 6R(i.e., a network element that does not collect information but only forwards) needs to statistically monitor the information in T0→T1, T1→T2 and T2→T3:
Once a certain network element is detected to send notifications too frequently, exceeding the threshold value, it illustrates that the network is abnormal, and at this point, it is impossible to determine whether the proxy network element is abnormal or the network element in a sub-network (i.e., the server) is abnormal, therefore, the statistical information by the intrusion detection device 1 and the proxy network element is compared.
Supposing that ΔCON=|CONproxy−CONIDS|, if ΔCON is overlarge, the console further compares CONproxy−CONIDS; and if CONproxy−CONIDS>0, the proxy network element can be abnormal. If CONproxy−CONIDS<0, the server can be abnormal.
The notification is the CON message, 6R and the proxy network element need ACK to respond to the CON message, and if the ACK response is not received for a long time, the client will automatically cancel the subscription to the server network element. The intrusion detection auxiliary device 1 needs to statistically monitor the occurrence rate at which the gateway returns the ACK message in T0→T1, T1→T2 and T2→T3; and the proxy also needs to statistically monitor the occurrence frequency of the ACK message in T0→T1, T1→T2 and T2=>T3.
If the occurrence frequency of the ACK message is significantly lower than that of the CON message, it illustrates that the gateway or the proxy network element is abnormal; and at this time, the occurrence frequency of the statistical ACK message by the gateway and the proxy network element are compared to further judge the abnormity. The judgment for the CON message is similar, which will not be repeated herein in detail. In the above two features, the occurrence frequencies of CON messages captured respectively by the proxy network element and the intrusion detection auxiliary device are related.
During the data packet uploading process, if the data packet exceeds the current network element MTU, the data packet will be discarded and an ICMP error report message will be returned. The intrusion detection auxiliary device 2 filters and extracts ICMP messages in T0→T1, T1→T2 and T2→T3. Supposing that
is the occurrence frequency of the error response message received by the injured network element in
If the network is normal and not invaded, the maximum frequency of the received error response message is Vmax.
the network element is injured; and
the network element is normal;
Feature7 the establishment is completed.
Feature6:
with the weight of weight7.
During a normal operation of the network, an FFD and a 6R need to conduct energy statistics. The specific measures are as follows:
The FFD and the 6R store neighbor information in a routing registry. A neighbor table and DODAG are as follows:
The network element A needs to attach a timestamp to the data packets received and sent thereby, so as to conduct periodic energy statistics, and the statistical energy is used as the key security information on abnormal detection. Supposing that
mαRcv
<
A network element A processes data packets sent by k2 in the same way. The table maintained by network element A caches data for 2 cycles.
Further, for the energy statistics, the statistics on the energy of a received packet and a sent packet is conducted. Here, a Kbit data packet is sent within the distance d, which is represented as ETx(k,d), and the Kbit data packet is received, which is represented as ERx(k,d), and the formula is as follows: the distance between neighboring nodes set herein is within the distance d, so the distance can not be considered in this energy statistics.
If the network is invaded, there are two abnormal network elements: one is an attacked network element, and the other is a captured and controlled puppet network element.
There are three attack scenarios:
The network element A finally needs to send the information on Rateforward, EnergySent, RcvAk1, RcvAk2, EnergyRcvAk1, EnergyRcvAk2 and EnergyRcv to the gateway;
These information on RcvAk1, RcvAk2, EnergyRcvAk1 and EnergyRcvAk2 are respectively feature data of k1 and k2, and the homogeneous feature data of the network element A is obtained by the statistical calculation of the upper-level network element A of the network element B and recorded as RcvBA;
Although the features RcvAk and EnergyRcvAk are captured by the network element i, the features are actually the feature attribute of the next-level network element, i.e., k1 and K2;
with the weight of weight1;
with the weight of weight6;
The specific measures for capturing the above 10 features are as follows:
In addition, judging the behavior of the network not only needs these data with IPV6 features, but also needs to conduct feature filtering on the principal components in a training set of an existing wireless sensor network, so as to select appropriate and important network features. The feature vector space is composed of the above features and the features selected in the training set. This is not the point of the present invention, which will not be repeated herein in detail.
The weights assigned to each feature by the console are multiplied by the corresponding feature data, and the result of adding all the feature data assigned to the weights can effectively reflect the state of the network element.
At this point, the feature data of network elements has been quantitatively analyzed in terms of the features and typical attacks of the 6LoWPAN network, the selection of the features (qualitative analysis on network element state), specific indicators (quantitative analysis on feature data of network elements) of the action execution of the network elements in the network have been completed.
II. Detection Process
The present invention has collected all the data required for intrusion detection above, and the state data table of the network element is formed in the console, and the console is used for intrusion detection.
A key assumption is that normal data points appear in a dense neighborhood, and abnormal data points are far away from a nearest neighbor.
The improvement of feature space, selection of algorithm parameters and a judgment principle of normal profiles and a detection basis will be illustrated in detail below.
The console positions the state data of the network elements in the hypercube feature space and calculates whether the state data of the network elements fall into the normal profile. The console uses a principle of the method that the hypercube with dense data points is the normal profile. Although this method with fixed boundary sacrifices precision to a certain extent, the resulting reduction in computational complexity is rare.
A detection principle is as follows: supposing that the hypercube is Cul, . . . , uq, a diagonal line of the hypercube is d/2, and h is a coordinate unit. The hypercube is expressed by
and after the training data are ready, a structure of the hypercube is fixed. Supposing that L1(Cul, . . . , uq) is a neighbor of the hypercube Cul, . . . , uq, which can cover a detection area of the state data of any
network elements that falls into the hypercube Cul, . . . , uq, and satisfies the following equation
Based on a super-grid structure after mobility, the detection are of the state data of any network element can not be accurately inspected, but a geometric DR that replaces the inspection area can be founded. For the state data y∈Cul, . . . , uq of the network element, the replaceable DR is defined as follows: J(y)={Cvl, . . . , vq|vi=ui, ui+ei}, where
and the state data of the network element are y={yl, . . . , yq}, and mapped on the hypercube.
Two parameters d and k exist in the in the intrusion detection mechanism of the present invention, because the parameters can not be accurately selected without prior knowledge, the parameters are estimated with the known information. The parameter k is usually specified by a user, At this time, k set as 0.01m,m is the number of network elements in the network Through the observation and statistics on the network, the established hypercube structure can be modified to find out the most appropriate d value.
III. Online Updating Process
First, a part of the state data table of the network element is formed in the console. When the state data of the network elements fill in the state data table of the network elements at the console end, the normal profile is formed in the feature space constructed by the console. After the state data table of the network elements are filled for the first time in the T0→T1 and T1→T2 time periods, the first round of detection is conducted, as shown in
The first round of detection is conducted, and at the same time, the state data table of the next round of network elements is continued to be filled. When the state data amount of the network element saved by the console in T2→T3 reaches i/p, the console randomly selects the state data of the network elements saved in the T2→T3 time period at the probability p, fills the state data of the selected network elements into the state data table of the network elements, and discards the remaining data. After the state data table of the network elements is completely replaced by new data, the network element sends a request to update the state data table of the network elements, and the normal profile is relearned and updated. The present invention specifies that T2→T3 is a period for updating the state data table of the network elements. The table is then updated as shown above, with a fixed period.
As shown in
An operation of the distributed mode requires all sensor nodes to participate in the internal calculation of the network, and the collection of these network features needs the cooperation of each network element in the network, instead of being captured by the intrusion detection auxiliary device.
Thus it can be concluded that in addition to being captured of the auxiliary device, the feature data of IPV6 wireless sensor network also has the cooperation of the network elements in the subnet, therefore, the following points need to be considered for the scheduling of network resources:
Each proxy network element RFD detects the CON/get/ACK message rate.
In addition, the above 6 points that need to be considered occur in parallel, and the tasks of some network elements are multiple, therefore, the above 6 points need to be considered simultaneously in time slot allocation, so that the communication resources can be reasonably configured.
The present invention has the following beneficial effects:
To enable the purpose, the technical solution and the beneficial effects of the present invention to be more clear, the present invention provides the following drawings for explanation:
Preferred embodiments of the present invention will be described below in detail in combination with drawings.
The embodiment mainly illustrates the process of intrusion detection after 6LoWPAN heterogeneous network attack, describes a logical process of intrusion detection, and illustrates the effect after detection.
A 6LoWPAN heterogeneous network in an embodiment is shown in
The role description has been illustrated in
Simulated attack implementation:
The attack is an attack against the 6LoWPAN network, so an attacker needs to attack within the wireless coverage range (within 30 meters) of a vulnerable network element.
The 6LoWPAN is a wireless communication specification constructed based on IEEE 802.15.4, which allows the forwarding of the IPV6 packet through low-power Personal Area Networks (PAN).
In order to monitor and inject 6LoWPAN traffic, a peripheral device based on an IEEE 802.15.4 specification is needed. The device is installed with an ATMEL AVR Raven of a Contiki 6LoWPAN firmware image, and provides a standard network interface, which can monitor and inject the network traffic into the 6LoWPAN network. The network traffic is monitored and injected into the 6LoWPAN network through the network interface.
Through an incoming process of a new node and by monitoring the data packet captured from the 6LoWPAN network simultaneously, the network protocol thereof is parsed, and the message is constructed, to control the network element and send any data packet.
Attack results: Suppose the node 10 implemented by attacking is captured. That is, the node 10 is a puppet network element.
Intrusion detection implementation:
There are nodes in the network, with the total of 12 network elements. wherein, a 6R network element exists.
Therefore, the state data amount of network elements is 20.
The network starts running, each network element captures the data in T0→T1, and T1→T2, and the state data table of the network elements is firstly formed on the console.
The algorithm to firstly form the state data table of network elements is as follows:
Intrusion detection results:
See parameter k=1/12*20≈2
In the process of intrusion detection, the data points in a hypercube where node 10 is located are less than K, so the node 10 is judged to be abnormal.
Finally, it should be noted that the above preferred embodiments are only used for describing, rather than limiting the technical solution of the present invention. Although the present invention is already described in detail through the above preferred embodiments, those skilled in the art shall understand that various changes in form and detail can be made to the present invention without departing from the scope defined by claims of the present invention.
| Number | Date | Country | Kind |
|---|---|---|---|
| 201810994988.6 | Aug 2018 | CN | national |
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/CN2019/090137 | 6/5/2019 | WO |
| Publishing Document | Publishing Date | Country | Kind |
|---|---|---|---|
| WO2020/042702 | 3/5/2020 | WO | A |
| Number | Name | Date | Kind |
|---|---|---|---|
| 6944673 | Malan | Sep 2005 | B2 |
| 7363656 | Weber | Apr 2008 | B2 |
| 8001601 | Duffield | Aug 2011 | B2 |
| 8800036 | Khayam | Aug 2014 | B2 |
| 11606387 | Doron | Mar 2023 | B2 |
| 20020032717 | Malan | Mar 2002 | A1 |
| 20020131366 | Sharp | Sep 2002 | A1 |
| 20060173992 | Weber | Aug 2006 | A1 |
| 20060272018 | Fouant | Nov 2006 | A1 |
| 20070283436 | Duffield | Dec 2007 | A1 |
| 20170148077 | Phillips | May 2017 | A1 |
| Number | Date | Country |
|---|---|---|
| 2018100222 | Mar 2018 | AU |
| 101013976 | Aug 2007 | CN |
| 103731433 | Apr 2014 | CN |
| 104158800 | Nov 2014 | CN |
| 109120627 | Jan 2019 | CN |
| Number | Date | Country | |
|---|---|---|---|
| 20210266748 A1 | Aug 2021 | US |
