基于攻击特征的DTN黑洞节点检测机制

Detection Mechanism of Blackhole Nodes Based on Attack Features in DTN

物联网中的时延容忍网络(DTN)采用存储-搬运-转发的路由方式,节点之间的合作程度直接影响DTN网络的性能,而DTN节点的恶意行为严重影响了节点间的配合,其中黑洞攻击是典型的一种恶意行为。为有效检测和遏制节点的黑洞攻击,提出一种基于黑洞攻击特征的黑洞节点检测机制AFD-Prophet。该检测机制可提取出黑洞攻击的3个本质性特征:虚假的高转发能力,消息数目的不平衡性和高丢包率。在上述特征的基础上,采用本地投票和节点间联合检测方式确定某个节点为黑洞节点的概率。仿真实验结果表明,与基于信誉的检测机制T-Prophet相比,该检测机制在保证不增加递交时延的前提下,能有效提高消息的递交率。

The nodes in the delay tolerant networks rely on the cooperation among nodes to forward the messages to destinations. How to effectively enhance the cooperation among nodes in Delay Tolerant Network（DTN）is a challenge,and the Blackhole attack is a typical incorporation behavior. In order to detect and restrain the Blackhole attack,a Blackhole nodes detection mechanism based on attack features is proposed,which extracts three essential features of the Blackhole attack：the forged high relay capacity,the imbalance of the number of messages forwarded between nodes and high message loss rate. The mechanism exploits the local vote and the cooperative detection among nodes to determine the probability that a node is a blackhole node. Simulations results show that the blackhole nodes detection mechanism based on attack features named AFD-Prophet can improve the delivery rate while not increasing the delivery delay in comparison with the reputation-based detection protocol T-Prophet.