空间信息网虫洞攻击检测算法研究与仿真

发布时间：2018-10-23 14:50

【摘要】：空间信息网是一种综合性的异构网络,应用领域广阔,具有十分重要的战略意义。但由于节点种类多样并且暴露在空间环境中,以及使用的无线通信方式等特点使其容易遭受种类繁多的攻击。其中,虫洞攻击是一种针对路由协议的严重攻击形式,根据攻击者的表现形式可以分为显式和隐式两种类型。虫洞攻击的特殊性是易发动、难检测且危害严重。因此,空间信息网虫洞攻击检测算法的研究具有十分重要的意义。本论文提出一种时延与拓扑异常相结合的空间信息网虫洞攻击检测算法,算法分为触发、检测和响应三个阶段。在路由发现或邻居建立过程中,节点通过发现往返时延异常的可疑链路,触发虫洞攻击的检测；检测阶段包括检测可疑邻居、判断恶意节点和查找异常拓扑三部分,节点首先利用往返时延检测一跳可疑邻居和两跳可疑邻居,然后利用拓扑特性进一步确认,节点根据两个邻居节点间是否存在相同的一跳邻居判断网络是否受到显式虫洞攻击,根据两个两跳邻居的交集中彼此为非一跳邻居的节点个数和两个邻居节点间是否存在相同的一跳真实邻居判断网络是否受到隐式虫洞攻击,根据虚拟拓扑和星间链路建立条件判断卫星骨干网是否受到虫洞攻击；在响应阶段,采用发送警告消息的方式隔离伪邻居节点或者恶意节点,保障网络的安全。本论文采用NS2网络模拟软件对所提出的算法进行仿真,分析检测算法的性能。结果表明：算法能够检测出两种类型的虫洞攻击,对两种类型的虫洞攻击均有较高的检测率和较低的误判率。
[Abstract]:Spatial information network is a kind of comprehensive heterogeneous network, which has a wide application field and has very important strategic significance. However, due to the diversity of nodes and their exposure to space environment, as well as the use of wireless communication methods, they are vulnerable to a wide variety of attacks. Among them, wormhole attack is a serious attack against routing protocol, which can be divided into two types: explicit and implicit according to the expression of the attacker. The particularity of wormhole attack is easy to launch, difficult to detect and serious harm. Therefore, the research of space information network wormhole attack detection algorithm is of great significance. In this paper, a new algorithm for detecting wormhole attack in spatial information network is proposed, which combines delay and topology anomaly. The algorithm is divided into three stages: trigger, detection and response. In the process of routing discovery or neighbor building, nodes trigger the detection of wormhole attacks by discovering suspicious links with round-trip delay anomalies, which include detecting suspicious neighbors, judging malicious nodes and finding abnormal topology. The node first detects one hop suspicious neighbor and two hop suspicious neighbor by round trip delay, and then further confirms that the node determines whether the network is under explicit wormhole attack according to the existence of the same one hop neighbor between the two neighbor nodes. According to the number of nodes with non-hop neighbors in the intersection of two two-hop neighbors and whether there are identical one-hop real neighbors between the two neighbor nodes, the network is judged whether the network is under implicit wormhole attack. According to the virtual topology and the condition of establishing the intersatellite link, the satellite backbone network is judged whether it is attacked by wormhole, and in the response stage, the pseudo-neighbor nodes or malicious nodes are isolated by sending warning messages to ensure the security of the network. In this paper, NS2 network simulation software is used to simulate the proposed algorithm, and the performance of the detection algorithm is analyzed. The results show that the algorithm can detect two types of wormhole attacks, and has a higher detection rate and a lower misjudgment rate for both types of wormhole attacks.
【学位授予单位】：东北大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TN927

【相似文献】