Research on sybil attack detection method for industrial wireless sensor networks based on CNN BiLSTM attention and K-means clustering

In Industrial Wireless Sensor Networks (IWSNs), Sybil attacks compromise network topology and reduce data reliability by forging virtual nodes, leading to degraded network performance and significantly diminished monitoring accuracy. To address these issues, this study aims to propose a high-accuracy and highly robust Sybil attack detection method to overcome the limitations of traditional detection approaches, such as low precision and difficulty in handling ambiguous probability boundaries. The research designs a collaborative detection mechanism that integrates a CNN-BiLSTM-Attention (CBSA) deep learning module with the K-means clustering algorithm. By combining "multidimensional feature extraction via deep learning + clustering-based classification boundary optimization," an end-to-end Sybil attack detection model (CBSA-Kmeans) is constructed.The specific implementation includes four parts: 1. A Convolutional Neural Network (CNN) processes the raw sensor data matrix to extract spatial local patterns and capture abnormal correlation features among nodes. 2. A Bidirectional Long Short-Term Memory network (BiLSTM) processes the feature sequences output by the CNN. The forward LSTM learns the "past-present" temporal dependencies to identify the cumulative effects of attacks, while the backward LSTM models the "present-past" temporal correlations to trace attack origins. 3. An Attention mechanism is introduced to dynamically focus on key time steps corresponding to critical attack features, generating a weighted context vector and outputting attack probability predictions. 4. The K-means clustering algorithm is employed to perform secondary partitioning on the prediction probability space output by the CBSA module. By measuring Euclidean distances, high-density attack clusters and normal data clusters are constructed to form decision regions, thereby optimizing classification boundaries.Through a progressive approach of "spatial feature extraction → temporal dependency modeling and key feature enhancement → probability space clustering optimization," the model achieves attack detection: CNN first performs preliminary spatial feature screening, BiLSTM and Attention collaboratively mine temporal attack features and highlight critical information, and finally, K-means clusters the prediction probabilities to clarify the boundaries between attack and normal data. Experimental results demonstrate that the CBSA-Kmeans model excels in IWSN Sybil attack detection tasks: it achieves a detection accuracy of 98.2% and a recall rate of 96.7%, representing an improvement of over 12% compared to traditional detection methods. Additionally, the model has minimal negative impact on network performance, increasing IWSN network throughput by 23.5% and reducing data transmission latency by 31.8%, while effectively addressing the ambiguous probability boundary issue present in traditional methods. In conclusion, the CBSA-Kmeans model achieves high-precision and highly robust detection of Sybil attacks in IWSNs through the synergistic integration of deep learning and clustering algorithms, validating the effectiveness and superiority of this collaborative detection mechanism. This method provides a practical technical solution for IWSN security protection, ensuring network topology integrity and data transmission reliability while enhancing operational efficiency and monitoring accuracy. It holds significant practical application value for ensuring the secure and stable operation of wireless sensor networks in industrial settings.