CN111585885A - Multi-courtyard medical information security routing strategy based on online learning - Google Patents

Abstract

The invention relates to a multi-hospital medical information security routing strategy based on online learning, which includes the following steps: Step 1: Calculate the elasticity value of a sending source AS against prefix hijacking attacks; Step 2: Calculate the history of nodes by means of online learning performance; Step 3, combine the two indicators of node elasticity value and historical performance to perform weighted allocation to obtain the best next hop node; Step 4, select a node with a higher node weight as the next hop node. With the above technical solution, the present invention refers to the concept of elasticity to measure the defense ability of the node against Prefix Interception attack, and uses the online learning method to calculate the historical performance of the router node, the security routing strategy will calculate the elasticity value and The historical performance is weighted to obtain the best next-hop router, so as to ensure that the data packets of the sending source can be safely delivered to the correct source.

Description

Online learning-based multi-hospital medical information security routing strategy

technical field

The invention belongs to the technical field of network communication security, in particular to an online learning-based multi-hospital medical information security routing strategy for resisting random prefix hijacking attacks.

Background technique

With the development of the economy and the gradual improvement of medical equipment, a hospital usually contains multiple branch areas. The transmission of information between various branch districts is unavoidable, and due to the importance of medical information, it is very important in today's society to ensure the security of information during information transmission. The network of each branch area constitutes an autonomous system (AS). The information exchange between ASs is mainly realized through the Border Gateway Protocol (BGP). BGP integrates the entire network. It is the exchange of routing information and changes between ASs. Important criteria for routing. In BGP, the routing path taken by Internet Protocol (IP) packets is usually determined by prefix announcement. Since routers do not verify the correct source of prefixes announced by AS, BGP is vulnerable to Prefix Interception attacks.

Prefix Interception attack means that the adversary AS announces the prefix code that does not belong to itself, but the router does not verify the correct source AS of the prefix, but only forwards the IP packet according to the local routing policy, which causes the data packet to flow into the wrong source AS. The attacker of the Prefix Interception attack sends the packet to the correct source after receiving the packet, making the attack difficult to detect.

Given the lack of authoritative information about prefixes and ASs in the Internet, real-time forged route detection remains a challenging and open problem. To detect prefix hijacking and path spoofing routing, it is necessary to know the connections between the assigned prefixes in the Internet and their legitimate source ASs and the import/export routing policies between ASs.

SUMMARY OF THE INVENTION

In order to resist the above-mentioned Prefix Interception attack, the present invention provides a new security routing strategy, which adopts an elastic evaluation algorithm and an online learning algorithm to evaluate the node's ability to resist the Prefix Interception attack and the historical performance of the node's BGP router, respectively. These two features are combined to select the optimal route and achieve the purpose of resisting the Prefix Interception attack.

The purpose of the present invention and the technical problem to be solved are achieved by adopting the following technical solutions. A multi-hospital medical information security routing strategy based on online learning proposed according to the present invention includes the following steps:

Step 1. Calculate the resilience value of the source AS against prefix hijacking attacks;

Step 2. Calculate the historical performance of the node by the method of online learning;

Step 3. Combine the two indicators of node elasticity value and historical performance for weighted allocation to obtain the best next-hop node;

Step 4. Select the node with higher node weight as the next hop node.

Further, in step 1, α(m,j,f) is used to represent the result of the node being attacked, so the following formula is used to calculate the elasticity when judging the elasticity of the node:

In this formula, l(j,m) is the number of paths from the sending source AS j to the correct source AS m, and l(j,f) is the number of paths from the sending source ASj to the wrong source AS f; in a network , when the sending source AS and the correct source AS are determined, the elasticity value of the sending source ASj can be obtained by the elasticity of the aggregation node, and the formula is:

In the formula, H represents the number of all nodes in the network topology.

Further, in step 2, the calculation steps of the node historical performance are as follows:

公式如下：A: Calculate t rounds, the security risk of j node

The formula is as follows:

In the formula, T represents the T-th round, and 1 represents the indicator function. Because the attack is time-sensitive, the historical performance defined in the time interval is valid;

B: When using the online learning method to calculate the historical performance, summarize the historical performance with the following formula:

代表路由器s已经选择过的下一跳路由器，

代表在t轮次路由器s可以选择的下一跳路由器集合，1代表指示函数，J代表可选择下一跳路由器集合，s代表当前所处的路由器集合；in the formula

represents the next-hop router that has been selected by router s,

represents the set of next-hop routers that can be selected by router s in round t, 1 represents the indicator function, J represents the set of selectable next-hop routers, and s represents the current set of routers;

那么问题可以转化为：C: Assume that router s chooses the next hop router to obey the distribution

Then the problem can be transformed into:

代表了选择下一跳路由器集合概率，

代表了选择下一跳路由器风险值的矩阵向量，其中：in the formula

represents the probability of selecting the next hop router set,

A matrix vector representing the risk value of choosing a next-hop router, where:

代表了

的概率单纯形，p(j)代表节点s选择节点j作为下一跳的概率，

代表选择下一跳路由器集合J的概率，值为正；

represents

The probability simplex of , p(j) represents the probability that node s selects node j as the next hop,

represents the probability of selecting the next hop router set J, and the value is positive;

D: The evaluation of the historical performance of each router is calculated by the following formula:

代表步长，

代表累积安全风险，累积安全风险的定义如下：in

represents the step length,

Represents cumulative security risk, which is defined as follows:

代表安全风险估计值，其定义如下：in the formula

represents the security risk estimate, which is defined as follows:

代表所有节点n和节点j相连的边都存在于

代表在线学习算法的学习率；

代表节点s的邻居节点n被选择的概率；

代表过去的轮次中所选择的下一跳路由器集合

与t轮次可以选择的下一跳路由器集合；下一跳路由器的集合

已经揭露，那么路由器s选择下一跳路由器j的概率为：in the formula

Represents that all edges connecting node n and node j exist in

represents the learning rate of the online learning algorithm;

The probability that the neighbor node n representing node s is selected;

Represents the set of next-hop routers selected in past rounds

The set of next-hop routers that can be selected in round t; the set of next-hop routers

It has been disclosed, then the probability that router s chooses the next hop router j is:

E: Analyze the performance of online learning algorithms by calculating regret values, defined as follows:

代表了最佳的下一跳路由器列表；In the formula,

represents the best next-hop router list;

The definition of regret value depends on the best selectable next-hop router, and the bound of regret value of randomly selected next-hop router is:

为学习率。in the formula

is the learning rate.

In step 3, when the weighted distribution of node elasticity value and historical performance is carried out, the adjustable parameter β∈[0,1] is introduced to combine the node elasticity value and historical performance. The calculation formula is:

In the formula, W _j represents the weight of node j after combining the elasticity value and historical performance.

With the above technical solution, the present invention designs a secure routing strategy based on online learning. A network-level attacker can initiate a Prefix Interception attack by declaring an IP prefix code that does not belong to himself. When the code is received, a part of the sending source AS is deceived by the wrong source AS, and sends the data packet to the wrong source AS instead of sending the data packet to the correct source AS. After the attacker receives the data packet, Xu will send the data packet to the correct source AS, which makes the attack difficult to detect. The invention refers to the concept of elasticity to measure the defense ability of the node against PrefixInterception attack, and uses the online learning method to calculate the historical performance of the router node. Obtain the best next-hop router to ensure that the data packets from the sending source can be safely delivered to the correct source.

The above description is only an overview of the technical solution of the present invention, in order to understand the technical means of the present invention more clearly, it can be implemented according to the content of the description, and in order to make the above and other objects, features and advantages of the present invention more obvious and easy to understand , the following specific preferred embodiments, and in conjunction with the accompanying drawings, are described in detail as follows.

Description of drawings

FIG. 1 is a schematic flow chart of the present invention.

Detailed ways

The technical solutions of the present invention will be further described in detail below with reference to the accompanying drawings and preferred embodiments.

First of all, a network-level attacker can launch a PrefixInterception attack by declaring an IP prefix code that does not belong to him. Therefore, when the attacker announces the prefix code of intercepting packets, some ASs are deceived by the wrong source AS and send the packets to the fake source AS. Instead of sending to the real source AS. The attacker will send the packet to the correct source AS after receiving the packet, which makes the attack difficult to detect. In the present invention, the concept of elasticity is used to measure the defense ability of nodes against Prefix Interception attacks, and the online learning method is used to calculate the historical performance of router nodes. This application designs a multi-hospital medical information security routing strategy based on online learning. The security routing strategy uses the calculated elastic value and historical performance through weighted calculation to obtain the best next-hop router. The specific process is as follows Figure 1.

In order to realize the relevant functions of this design scheme, it is necessary to design an algorithm for calculating the elastic value of a node and an algorithm for calculating the historical performance of the node. The functions and method steps of each module are described in detail below.

1. Calculate the resilience value of AS to resist prefix hijacking attacks

In this part, the concept of resilience is introduced to evaluate the ability of nodes to resist Prefix Interception attacks. An AS-level adversary announces an AS prefix code that does not belong to itself to launch a Prefix Interception attack, and each node has multiple paths leading to the wrong source AS f and the true source AS m. Source AS j is resilient to this prefix hijacking attack if source ASj is not spoofed by wrong source ASf, and still sends its traffic to correct source AS m. The attacked node of each node is success or failure, and α(m, j, f) is used to represent the attack result of the node. Therefore, when judging the resilience of a node, use the following formula to calculate resilience:

In this formula, l(j,m) is the number of paths from source AS j to correct source AS m, and l(j,f) is the number of paths from source AS j to faulty source AS f. In a network, when the source AS j and the correct source AS m are determined, the resiliency of the source AS j can be obtained by aggregating node resiliency, the formula is as follows:

In the formula, H represents the number of all nodes in the network topology.

The resilience value of the node against Prefix Interception attack is measured by predicting the route. The choice of route is determined by the following conditions: (1) The consumer route takes precedence over the peer-to-peer network route, and the peer-to-peer network route takes precedence over the provider route; ( 2) Among the paths with the highest local priority, the path with the shortest hop count will be preferentially selected. In the present invention, nodes are traversed using breadth-first search based on the above-mentioned priorities and characteristics. First, the path with the highest priority is searched, that is, the provider-consumer route; second, the peer-to-peer route is searched; and finally, the consumer-provider route is searched. Nodes are searched from the highest priority node to the lowest priority node, these searches have the same priority in the same steps, and this order will speed up the calculation of elasticity.

2. Calculate the historical performance of the router through online learning

表示选择路由器的安全风险，其公式为：When the present invention uses routers for information exchange, it should be noted that the data packets with different prefixes flowing into the AS in recent rounds, the present invention uses

Indicates the security risk of choosing a router, and its formula is:

In this formula, T represents the T-th round, and 1 represents the indicator function. Because the attack is time-sensitive, the historical performance defined over time interval D is valid.

When using the online learning method to calculate the historical performance, the historical performance can be summarized by the following formula:

代表路由器s已经选择过的下一跳路由器，

代表在t轮次路由器s可以选择的下一跳路由器集合，1代表指示函数，J代表可选择下一跳路由器集合，S代表当前所处的路由器集合。假定路由器s选择下一跳路由器服从分布

问题可以转化为：in

represents the next-hop router that has been selected by router s,

represents the set of next-hop routers that can be selected by router s in round t, 1 represents the indicator function, J represents the set of selectable next-hop routers, and S represents the set of routers currently located. Assume that router s chooses the next hop router to obey the distribution

The problem can be transformed into:

代表了选择下一跳路由器集合概率，

代表了选择下一跳路由器风险值的矩阵向量，其中：in the formula

represents the probability of selecting the next hop router set,

A matrix vector representing the risk value of choosing a next-hop router, where:

代表了

的概率单纯形，p(j)代表节点s选择节点j作为下一跳的概率；

代表选择下一跳路由器集合J的概率，值为正。对于每一个路由器的历史性能的评估用以下公式进行计算：

represents

The probability simplex of , p(j) represents the probability that node s selects node j as the next hop;

Represents the probability of selecting the next hop router set J, and the value is positive. The evaluation of the historical performance of each router is calculated using the following formula:

代表步长，

代表累积安全风险，累积安全风险的定义如下：in

represents the step length,

Represents cumulative security risk, which is defined as follows:

代表安全风险估计值，其定义如下：in

represents the security risk estimate, which is defined as follows:

代表所有节点n和节点j相连的边都存在于

代表该在线学习算法的学习率；

代表节点s的邻居节点n被选择的概率；

代表上过去的轮次中所选择的下一跳路由器集合

与t轮次可以选择的下一跳路由器集合。下一跳路由器的集合

已经揭露，那么路由器s选择下一跳路由器j的概率为：in

Represents that all edges connecting node n and node j exist in

represents the learning rate of the online learning algorithm;

The probability that the neighbor node n representing node s is selected;

Represents the set of next-hop routers selected in the last round

The set of next-hop routers that can be selected for round t. set of next-hop routers

It has been disclosed, then the probability that router s chooses the next hop router j is:

The performance of the online learning algorithm is analyzed by calculating the regret value, which is defined as follows:

代表了最佳的下一跳路由器列表。in,

Represents a list of best next-hop routers.

The rationale for the definition of regret value is to rely on the best selectable next-hop router. The bound of the regret value of the randomly selected next-hop router is:

为学习率。in

is the learning rate.

In summary, the algorithm steps of historical performance are as follows:

Step 1. Calculate the historical performance of the j node for round t and j

Step 2: Expose the set of next-hop routers that can be selected;

Step 3: Calculate the probability that node s selects the next hop router;

发送给邻居节点；Step 4. Identify the security risks of each node

Send to neighbor nodes;

Step 5. Calculate the security risk

Step 6. Assess security risks

Step 7: Enter the next round of calculation.

3. Combine the elasticity value and historical performance of the node to obtain the best next-hop router.

Two important performance indicators of routers have been described above: resilience and historical performance. If only the elasticity value is considered, the security of the route cannot be guaranteed; if only the historical performance is considered, the reachability of the route cannot be guaranteed. Combining the resiliency and historical performance of routers to ensure routing security and reachability. First, the resilience value of the router is evaluated; then the historical performance of the router is evaluated; finally, a tunable parameter β∈[0,1] is introduced to combine these two performances, and the formula is as follows:

In the formula, W _j represents the weight of node j after combining elasticity value and historical performance.

To sum up, the specific execution steps of the routing policy in this embodiment are as follows:

Step 1: Predict the route according to the local route priority, so as to calculate the node elasticity;

Step 2: Calculate the historical performance of the node according to the online learning method;

Step 3: Weighted allocation of node elasticity and historical performance;

Step 4: Select a node with a higher node weight W _j as the next hop node, so that the data packet of the sending source AS j is safely sent to the correct source.

The above are only the preferred embodiments of the present invention. Any person skilled in the art, without departing from the scope of the technical solution of the present invention, can make any simple modifications to the above embodiments according to the technical essence of the present invention, Equivalent changes and modifications still fall within the scope of the technical solutions of the present invention.

Claims (4)

1. The on-line learning-based multi-institution medical information security routing strategy is characterized by comprising the following steps:

step 1, calculating an elastic value of a sending source AS for resisting prefix hijack attack;

step 2, calculating the historical performance of the nodes by an online learning method;

step 3, combining two indexes of the node elasticity value and the historical performance to carry out weighting distribution so as to obtain the best next hop node;

and 4, selecting the node with the higher node weight value as the next hop node.

2. The online-learning-based multi-institution medical information security routing policy of claim 1, wherein: in step 1, the result of the node being attacked is represented by α (m, j, f), so the elasticity is calculated using the following formula when judging the elasticity of the node:

in this formula, l (j, m) is the number of paths from the transmission source AS j to the correct source ASm, and l (j, f) is the number of paths from the transmission source ASj to the error source AS f; in a network, when a sending source AS and a correct source AS are determined, the elasticity value of the sending source ASj can be obtained by aggregating node elasticity, with the formula:

in the formula, H represents the number of all nodes in the network topology.

3. The online-learning-based multi-institution medical information security routing policy of claim 2, wherein: in step 2, the calculation steps of the node historical performance are as follows:

a: calculating the safety risk r of the j node in the t round_t ^s(j) The formula is as follows:

in the formula, T represents the tth round, and 1 represents an indication function, since the attack is time-sensitive, it is effective to define the historical performance in the time interval;

b: when the on-line learning method is used for calculating the historical performance, the historical performance is summarized by the following formula:

in the formula

Representing the next hop router that router s has selected,

representing a set of next hop routers which can be selected by the router s in the t round, 1 representing an indication function, J representing a set of selectable next hop routers, and s representing a set of routers where the router is currently located;

c: assume that router s selects the next hop router obedient distribution

Then the problem can be translated into:

in the formula

Representing the probability of selecting the next hop router set,

a matrix vector representing risk values for selecting a next hop router, wherein:

represent

P (j) represents the probability that node s selects node j as the next hop,

represents the probability of selecting the next-hop router set J, and the value is positive;

d: the evaluation of the historical performance for each router is calculated using the following formula:

wherein

The step size is represented as a function of,

represents the cumulative security risk, which is defined as follows:

in the formula

Represents a security risk estimate, defined as follows:

in the formula

Representing that all edges connecting node n and node j exist

Represents a learning rate of an online learning algorithm;

probability that a neighbor node n representing a node s is selected;

representing the set of next hop routers selected in the past round

A set of next hop routers selectable with the t round; set of next hop routers

As already disclosed, the probability of router s selecting next hop router j is:

e: the performance of the online learning algorithm is analyzed by calculating the regret value, defined as follows:

in the formula,

represents the best next hop router list;

the regret value definition is dependent on the best selectable next hop router, and the regret value of a randomly selected next hop router is bounded by:

in the formula

Is the learning rate.

4. The online-learning-based multi-institution medical information security routing policy of claim 3, wherein: when the node elasticity value and the historical performance are weighted and distributed in the step 3, an adjustable parameter beta is introduced to be the [0,1] and is combined with the node elasticity value and the historical performance, and the calculation formula is as follows:

in the formula, W_jAnd representing the weight value of the node j after combining the elasticity value and the historical performance.

Images