CN112351353B - Detection and location method of multi-point crosstalk attack in multi-domain optical network based on distributed PCE - Google Patents

Abstract

The invention belongs to the technical field of multi-domain optical networks, and discloses a multi-domain optical network multi-point crosstalk attack detection and positioning method based on a distributed PCE. By using BER detection comparison of the alarm node, the state information value S of the alarm node is obtained _nk And obtaining an OALP set through attack discrimination to achieve the purpose of eliminating interference alarm, and then adopting an MD-PLVM algorithm suitable for multi-domain optical network attack positioning to position a multi-point high-power crosstalk attack source of the OALP to obtain an inter-domain link subjected to crosstalk attack and an intra-domain link subjected to crosstalk attack.

Description

Detection and location method of multi-point crosstalk attack in multi-domain optical network based on distributed PCE

technical field

The invention belongs to the technical field of multi-domain optical network multi-point crosstalk attack detection and positioning, and in particular relates to a multi-domain optical network multi-point crosstalk attack detection and positioning method based on distributed PCE.

Background technique

In large-scale, large-capacity, and high-speed optical networks, malicious users can easily use the transparent characteristics of network transmission to conduct high-power crosstalk attacks on intra-domain and inter-domain links. These high-power attacks may occur at any time and any location. Crosstalk attacks will cause attack propagation effects in the network, and even lead to the paralysis of the entire network, resulting in immeasurable losses. Therefore, how to accurately detect and quickly locate high-power crosstalk attacks in multi-domain optical networks is an important research content to ensure network security and improve the survivability of optical networks.

Since each domain of a multi-domain optical network is managed by different service providers, the domains do not exchange internal information with each other, which brings difficulty to the location of cross-domain crosstalk attacks. The multi-domain optical network architecture based on distributed PCE can solve this problem well. The path calculation structure and communication mechanism of PCE can support the attack positioning of inter-domain links. At the same time, strict synchronization is required between PCEs. Network status in this domain, such as topology and resource information, and its calculated path set and reserved resources are real-time.

In a multi-domain optical network, high-power crosstalk attacks will cause LP attack propagation. Once a link is attacked by high-power crosstalk, not only all LPs passing through it will be affected by crosstalk attacks, but also the propagation of crosstalk attacks will cause A large number of SALPs and DALPs appear in the network. Therefore, an optical path under crosstalk attack is likely to cause a large number of alarms in the optical network, and traditional network attack detection and location methods cannot locate the source of the crosstalk attack at all.

SUMMARY OF THE INVENTION

The object of the present invention is to provide a multi-domain optical network multi-point crosstalk attack detection and positioning method based on distributed PCE, in order to solve the attack propagation for high-power crosstalk attacks in the prior art and cause a large number of alarms in the optical network, The resulting problem is that the workload of the attack positioning phase is large and the positioning speed is low.

In order to realize the above-mentioned tasks, the present invention adopts the following technical solutions:

The method for detecting multi-point crosstalk attack in multi-domain optical network based on distributed PCE includes the following steps:

Step 1: collect the BER information of all attacking optical paths at each alarm node, where the BER information of the attacking optical paths includes the detection BER value, the reference BER value and the threshold value of the attacking optical path;

Step 2: According to the BER information of all attacking optical paths at each alarm node, obtain the state information set Z _n ={S _nk } of the attacking optical paths;

Br_nk为第n个告警节点的第k个攻击光路的检测BER值，Bb_nk第n个告警节点的第k个攻击光路的基准BER，Bt_nk表示第n个告警节点的第k个攻击光路的阈值，dBr_nk＝|Br_nk-Bb_nk|，Br_nk、Bb_nk和Bt_nk的取值范围均为(0,1)；in,

Br _nk is the detection BER value of the k-th attack optical path of the n-th alarming node, Bb _nk is the reference BER of the k-th attacking optical path of the n-th alarming node, and Bt _nk represents the k-th attacking optical path of the n-th alarming node The threshold of , dBr _nk = |Br _nk -Bb _nk |, the value range of B _nk , Bb _nk and Bt _nk are all (0,1);

Step 3: Determine the attack light path with the status information of 2 at each alarm node as the original attack light path, and obtain the original attack light paths at all alarm nodes as the original attack light path set.

The distributed PCE-based multi-domain optical network multi-point crosstalk attack detection and positioning method includes the following steps:

Step 1: The boundary node of each domain and the destination node of each optical path in the multi-domain optical network are used as alarm nodes, and the BER information of all attacked optical paths at each alarm node is collected. The original attack optical path set is obtained by the multi-domain optical network multi-point crosstalk attack detection method based on PCE;

According to each original attack optical path in the original attack optical path set including the destination node DN of the original attack optical path and the domain boundary node BN of the original attack optical path, the DN set and the BN set are obtained;

Step 2: Let the DN set and the BN set send signaling, and obtain all the crosstalk attack domains in the multi-domain optical network according to the sending and receiving signaling relationship between the DN set and the BN set, including the following sub-steps:

Step 2.1: Each DN in the DN set sends an intra-domain alarm signaling to the intra-domain PCE and all nodes in the domain where it is located. The intra-domain alarm signaling includes the domain ID of the sending node, the node ID, and all the attacked optical paths passing through the node. id and length;

The entry of each BN in the BN set sends inter-domain alarm signaling to the intra-domain PCE, all nodes in the domain, the PCE of the upstream domain, and the BN of the upstream domain, and also sends monitoring signals to the upstream DN and upstream BN. The signaling includes the domain ID of the sending node, the node ID, and the IDs and lengths of all attacked light paths passing through the node;

The egress of each BN in the BN set sends inter-domain alarm signaling to the intra-domain PCE, all nodes in the domain, the PCE of the downstream domain, and the BN of the downstream domain, and also sends monitoring signals to the downstream DN and downstream BN;

Step 2.2: Obtain the signaling received by the border nodes that do not belong to the BN set in the multi-domain optical network. If any border node that does not belong to the BN set receives the inter-domain alarm signaling including the domain ID of Any downstream BN that does not belong to the border node of the BN set sends control signaling, the control signaling includes the node ID of the sending node, and step 2.3 is performed; otherwise, step 2.3 is performed;

Step 2.3: Obtain the number of DNs and BNs in each domain, as well as the signaling received by each BN in the BN set, and judge according to the judgment criteria to obtain all the crosstalk attack domains in the multi-domain optical network. The judgment criteria include:

If the domain only contains DN but no BN, the domain is judged as a crosstalk attack domain;

If no BN in any domain receives control signaling and all DNs and BNs receive monitoring signals, it is determined that there is no crosstalk attack in this domain; otherwise, this domain is determined to be a crosstalk attack domain;

If any BN receives an inter-domain alarm signaling of a domain ID other than its own domain, the inter-domain link formed by the BN and the signaling sending node is added to the crosstalk attack domain;

Step 3: Determine the quantitative relationship between DNs and BNs in the crosstalk attack domain. If only DNs are included but no BNs, perform intradomain crosstalk attack positioning to obtain intradomain links that are attacked by crosstalk; otherwise, perform interdomain crosstalk attack positioning to obtain crosstalk attacked links. The interdomain link of the attack.

Further, the crosstalk attack positioning method in step 3 adopts the MD-PLVM algorithm.

Compared with the prior art, the present invention has the following technical characteristics:

(1) The detection method of the present invention utilizes the BER detection and comparison of the ALP of the OXC port at the alarm place to obtain its state information value S _nk , calculates the state information value of the ALP according to the relationship between the actual value and the threshold value, and performs the attack discrimination and classification of the ALP , and an OALP set is obtained through attack discrimination, so as to achieve the purpose of eliminating interference alarms. The workload of the attack positioning phase is reduced, and the positioning speed is improved.

(2) The present invention aims at the problem that high-power crosstalk attacks cause optical path attack propagation, thereby causing a large number of alarms to be generated in the optical network. On the premise, an algorithm MD-PLVM, which is suitable for multi-domain optical network multi-point crosstalk attack location, is proposed, which realizes the fast location of multi-point crosstalk attack sources between domains and intra-domains. Finally, the distributed PCE-based multi-domain optical network multi-point crosstalk attack detection and localization method (DP-CADL) is verified by simulation experiments. Accurate detection and fast positioning, and have a high positioning accuracy.

Description of drawings

Fig. 1 is the multi-domain optical network of topology composition in the embodiment;

Fig. 2 is the structural schematic diagram of OXC port optical path;

Fig. 3 is the detection BER comparison diagram of each ALP in the embodiment;

Fig. 4 is the attack discrimination result graph in the embodiment;

5 is a schematic diagram of the accuracy of attack positioning in the embodiment;

Figure 6 shows the maximum attack positioning delay in seven cases;

Figure 7 shows the average attack location delay in seven cases.

Detailed ways

First, the technical terms that appear in the present invention are explained:

Multi-domain optical network: A multi-domain optical network has multiple domains, each domain has multiple links, and each domain has a PCE responsible for the topology of the nodes in the domain and the calculation of intra-domain and inter-domain links. In an optical network, in order to enable normal communication and mutual cooperation among PCEs, communication protocols, standard interfaces and message formats need to be designed between the PCEs and the network entities that communicate with them. In the multi-domain optical network G=(V, L, W), V represents the set of nodes including optical fibers, EDFA, OXC, etc.; L represents the set of all links in the network, and an L link can use the ordered pair in V to represent; W represents the number of power accumulations from one node to another.

OALP (original attacked LP): The original attacked optical path, the optical path generated by the crosstalk attack source.

SALP (secondary attacked LP): The second-order attacked optical path, the optical path affected by the OALP attack, although the attack power of SALP has a certain degree of loss, it still has the attack propagation ability.

DALP (destination attacked LP): The destination attacked optical path, the optical path affected by the SALP attack, the attack power of DALP is severely attenuated, so it does not have the attack propagation capability.

OXC: optical cross-connect equipment, in the present invention, OXC is an alarm node.

OXC port optical path: Figure 2 shows the definition and description of the port optical path of an OXC, with LP _n representing the optical path set of all optical ports of the nth OXC, LPi _nk representing the kth input port of the nth OXC, LPo _nk represents the k-th output port of the n-th OXC, LPI _n ={LPi _n1 ,LPi _n2 ,...,LPi _nm } is the input optical port set of the n-th OXC, LPO _n ={LPo _n1 ,LPo _n2 ,...,LPo _nm } is the output optical port set of the nth OXC, and LP _n =LPI _n ∪LPO _n .

Parallel Finite Boundary Vector Matching Algorithm (PLVM): One of the most commonly used and effective algorithms for attacking multiple links in optical networks, from the literature Mazen Khair, Jun Zheng, Hussein T. Mouftah. Distributed Multi-Failure Localization Protocol for All- Optical Networks.ONDM.2009. The PLVW algorithm extends the LVM algorithm, introduces the concept of executing routing queues to classify the optical paths affected by different link attacks, and then limits the areas of different attacks and executes LVM in each area. algorithm, so as to achieve the purpose of locating multi-link attacks.

This embodiment discloses a distributed PCE-based multi-domain optical network multi-point crosstalk attack detection method, including the following steps:

Step 1: collect the BER information of all attacking optical paths at each alarm node, where the BER information of the attacking optical paths includes the detection BER value, the reference BER value and the threshold value of the attacking optical path;

Step 2: According to the BER information of all attacking optical paths at each alarm node, obtain the state information set Z _n ={S _nk } of the attacking optical paths;

Br_nk为第n个告警节点的第k个攻击光路的检测BER值，Bb_nk第n个告警节点的第k个攻击光路的基准BER，Bt_nk表示第n个告警节点的第k个攻击光路的阈值，dBr_nk＝|Br_nk-Bb_nk|，Br_nk、Bb_nk和Bt_nk的取值范围均为(0,1)；in,

Br _nk is the detection BER value of the k-th attack optical path of the n-th alarming node, Bb _nk is the reference BER of the k-th attacking optical path of the n-th alarming node, and Bt _nk represents the k-th attacking optical path of the n-th alarming node The threshold of , dBr _nk = |Br _nk -Bb _nk |, the value range of B _nk , Bb _nk and Bt _nk are all (0,1);

Step 3: Determine the attack light path with the status information of 2 at each alarm node as the original attack light path, and obtain the original attack light paths at all alarm nodes as the original attack light path set.

Classify the state information of the attacking optical path, determine the ALP with Snk =0 as _DALP , determine the ALP with Snk =1 as SALP, determine the ALP with Snk =2 as _OALP , and use the set of optical paths corresponding to _OALP as the original attack Optical path set, the meaning of each state value is shown in Table 1:

Table 1 Meaning table of the status values of the attacking optical path ALP

This embodiment also discloses a distributed PCE-based method for detecting and locating a multi-point crosstalk attack in a multi-domain optical network, including the following steps:

Step 1: The boundary node of each domain and the destination node of each optical path in the multi-domain optical network are used as alarm nodes, and the BER information of all attacked optical paths at each alarm node is collected. The multi-point crosstalk attack detection method in the domain optical network obtains the original attack optical path set;

According to each original attack optical path in the original attack optical path set including the destination node DN of the original attack optical path and the domain boundary node BN of the original attack optical path, the DN set and the BN set are obtained;

Step 2: Let the DN set and the BN set send signaling, and obtain all the crosstalk attack domains in the multi-domain optical network according to the sending and receiving signaling relationship between the DN set and the BN set, including the following sub-steps:

Step 2.1: Each DN in the DN set sends an intra-domain alarm signaling to the intra-domain PCE and all nodes in the domain where it is located. The intra-domain alarm signaling includes the domain ID of the sending node, the node ID, and all the attacked optical paths passing through the node. id and length;

The entry of each BN in the BN set sends inter-domain alarm signaling to the intra-domain PCE, all nodes in the domain, the PCE of the upstream domain, and the BN of the upstream domain, and also sends monitoring signals to the upstream DN and upstream BN. The signaling includes the domain ID of the sending node, the node ID, and the IDs and lengths of all attacked light paths passing through the node;

The egress of each BN in the BN set sends inter-domain alarm signaling to the intra-domain PCE, all nodes in the domain, the PCE of the downstream domain, and the BN of the downstream domain, and also sends monitoring signals to the downstream DN and downstream BN;

Step 2.2: Obtain the signaling received by the border nodes that do not belong to the BN set in the multi-domain optical network. If any border node that does not belong to the BN set receives the inter-domain alarm signaling including the domain ID of Any downstream BN that does not belong to the border node of the BN set sends control signaling, the control signaling includes the node ID of the sending node, and step 2.3 is performed; otherwise, step 2.3 is performed;

Step 2.3: Obtain the number of DNs and BNs in each domain, as well as the signaling received by each BN in the BN set, and judge according to the judgment criteria to obtain all the crosstalk attack domains in the multi-domain optical network. The judgment criteria include:

If the domain only contains DN but no BN, the domain is judged as a crosstalk attack domain;

If no BN in any domain receives control signaling and all DNs and BNs receive monitoring signals, it is determined that there is no crosstalk attack in this domain; otherwise, this domain is determined to be a crosstalk attack domain;

If any BN receives an inter-domain alarm signaling of a domain ID other than its own domain, the inter-domain link formed by the BN and the signaling sending node is added to the crosstalk attack domain;

Step 3: Determine the quantitative relationship between DNs and BNs in the crosstalk attack domain. If only DNs are included but no BNs, perform intradomain crosstalk attack positioning to obtain intradomain links that are attacked by crosstalk; otherwise, perform interdomain crosstalk attack positioning to obtain crosstalk attacked links. The interdomain link of the attack.

Specifically, in step 3, the crosstalk attack positioning method adopts the MD-PLVM algorithm, and the parameter definitions of the MD-PLVM algorithm are as shown in Table 2:

Table 2 MD-PLVM algorithm parameter definition table

Specifically, in step 2, determining the crosstalk attack domain by the MD-PLVM algorithm includes the following sub-steps:

Step 2a: The DN included in the OALP set starts a timer with a duration of 2D _l /v ₀ , and sends "INTRADA" to the PCE and all nodes in the domain;

Step 2b: The entry BN included in the OALP set starts a timer with a duration of 2d/v ₀ , and sends "INTERDA" to the PCE and all nodes in the domain, and also sends "INTERDA" to the PCE and border nodes in the upstream domain, and also sends "INTERDA" to the downstream BN and DN send "MS";

Step 2c: The egress BN included in the OALP set starts a timer with a duration of 2d/v ₀ , and sends "INTERDA" to PCEs and all nodes in the domain, and also sends "INTERDA" to PCEs and border nodes in the downstream domain, and sends "INTERDA" to the downstream BN and DN send "MS";

Step 2d: When a border node that does not belong to the BN set receives "INTERDA" in this ID field, it will send "GA" to its connected downstream border node;

Step 2e: if a border node receives "INTERDA" of different ID domains, the inter-domain link formed by the node and the signaling sending node is judged into the crosstalk attack domain;

Step 2f: If a domain contains only DN but no BN, the domain is determined as a crosstalk attack domain;

Step 2g: If no egress border node in a certain domain receives "GA", and all DNs and egress BNs have received correct "MS", it is determined that there is no crosstalk attack link in this domain. Otherwise, the domain is judged as a crosstalk attack domain.

Specifically, in step 3, the location of the inter-domain multipoint crosstalk attack by using the MD-PLVM algorithm includes the following sub-steps:

Step 3a: if a border node that does not belong to the BN set receives "INTERDA" of different ID domains, then it is determined that the interdomain link formed by the node and the signaling sending node is subject to crosstalk attack;

Step 3b: If a BN receives "INTERDA" in different ID fields, find out whether at least one node in the pair of border nodes has received the correct "MS" within 2d/v ₀ , and if so, determine this. The inter-domain link formed by the border node is not subject to crosstalk attack, otherwise it is determined to be subject to crosstalk attack.

Specifically, in step 3, the location of the intra-domain multipoint crosstalk attack by the MD-PLVM algorithm includes the following sub-steps:

Step 4a: Define the DN in the domain as a potential execution node PES, each PES sends "INTRADA" to all nodes in the domain, the "INTRADA" contains the ID of the PES and the length of all the OALPs reaching it in the domain.

Step 4b: When a PES receives "INTRADA", it extracts all OALPs pointing to it, and inserts them into a list in ascending order according to their lengths. If the lengths of the two OALPs are the same, the OALP with the smaller source node ID is inserted preferentially; if the source nodes are the same, the node with the smaller ID connected to the OALP is preferentially inserted.

Step 4c: Each PES compares the OALPs in the list with the following OALPs in turn, and stores the two OALPs without a common link in different execution path queues ERQi, where i=1, 2, 3,... ,n. If the first OALP in the list has a common link with other OALPs in the table, the second OALP will be compared with other OALPs in the table, and so on, until two OALPs without public links are found. OALP. If all OALPs in the list are compared and no OALP without a public link can be found, the attack is judged as a single point crosstalk attack, and the LVM protocol can be used to locate the attack.

Step 4d: After finding two separated OALPs, compare them with the remaining OALPs in the list. The specific steps are as follows:

Step 4d.1: If there is a public link between a remaining OALP in the list and one of the two OALPs without a public link, add it to the ERQi corresponding to the OALP.

Step 4d.2: If there is a public link between a remaining OALP in the list and the two OALPs without public links, it is determined that this OALP will not provide a useful reference for attack positioning and is ignored.

Step 4d.3: If there is no public link between a remaining OALP in the list and the two OALPs without public links, add it to a new ERQi. This situation indicates that a new attack has been discovered, and this OALP is then compared with the OALPs in the list.

Step 4d.4: Loop this process until all remaining light paths in the list have been aligned.

Step 4e: At this point, all OALPs in the network have been stored in different ERQi according to the impact of different attacks. Next, single-point attack positioning is performed on each ERQi. The positioning process can be carried out at the same time. The specific steps of attack positioning for each ERQi are as follows:

Step 4e.1: Define the first OALP in ERQi as the execution path ER, because its link length is the shortest, and at the same time determine the PES of the OALP as the execution node ES.

Step 4e.2: The ES will generate an attack-affected link vector ALV for the ER, while determining a restricted area LA. This LA includes all nodes and links in the ER and its adjacent nodes. Then the ES broadcasts the ALV to all nodes in the LA.

Step 4e.3: When the node in the LA receives the ALV, the node will match the link vector LV of its own optical path with the ALV, and the matching result is represented by a binary vector BV. For OALP, if there is a common link between its LV and ALV, set the corresponding binary bit in BV to 1, otherwise set it to 0, and set the OALP state to 0; for normal LP, if its If there is a common link between LV and ALV, the corresponding binary bit in BV is set to 0, otherwise, it is set to 1, and the LP state is set to 1.

Step 4f: If the obtained BV and ER do not have a common link, the corresponding destination node will not send the binary vector to the ES. On the contrary, the corresponding destination node will send the BV to the ES.

Step 4g: Each ES performs a logical AND operation on all the BVs received within the LA range. If the number of "1" in the result is 1, it means that the crosstalk attack has been accurately located, the ES will transmit the information of the attack link to the PCE in this domain, and the PCE will broadcast an ATTACK_LOCATION message to all the The PCE of the domain adjacent to the domain. Otherwise, the ES will expand the scope of the LA, that is, the neighbor nodes of the adjacent nodes of the ALV will be added to the scope of the LA, and the positioning will be performed again.

Specifically, if the OALP where the attack link in a certain domain is located passes through this domain and is transmitted to other domains, it will cause BN alarms at both ends of the inter-domain link. The DN in the domain, the egress BN that does not receive the correct "MS" within 2d/v ₀ , and the egress border nodes that receive "GA" are all defined as potential execution nodes PES, and then execute the multipoint crosstalk attack positioning in the domain. Steps 4a to 4g perform crosstalk attack positioning.

Example 1

Figure 1 shows a multi-domain optical network with 34 nodes and 62 links under distributed PCE. For the convenience of analysis, it is assumed that the multi-domain optical network has established a small number of optical paths LP. Suppose there are 11 optical paths in the network: LP1={3-6-11-34-25}, LP2={5-6-12-13}, LP3={16-15-21}, LP4={16- 17-18-19-23}, LP5={17-18-19-32}, LP6={17-22-24-21-15}, LP7={18-19-24-20}, LP8={ 23-18-19-24-20-15}, LP9={23-19-24-21}, LP10={29-26-27-31}, LP11={30-25-26-33}.

It is assumed that two links in the multi-domain optical network are attacked by high-power crosstalk, namely the inter-domain links {11-34} of D1 and D3 and the intra-domain links {18-19} of D2. High-power crosstalk attacks will directly affect LP1, LP4, LP5, LP7, and LP8. These five optical paths are the optical paths where the high-power crosstalk attack source is located, that is, OALP. For a general link failure, these two attacks will only generate alarms for the destination nodes and the border nodes passing through the five optical paths. However, because high-power crosstalk attacks have the characteristics of optical path attack propagation, during the attack propagation process of these five OALPs , will have attack propagation effects on LP6, LP9, and LP11, making them SALPs with attack propagation capabilities, and these three SALPs will then attack LP3 and LP10, making them DALPs. That is to say, ten optical paths in the entire network are affected by high-power crosstalk attacks, and alarms will be generated at their destination nodes and the border nodes they pass through.

The inter-domain links {11-34} of D1 and D3 and the intra-domain links {18-19} of D2 were attacked by high-power crosstalk, causing n15, n19, n20, n21, n23, n25, n31, n32, n33 and n34 generate alarms, and there are interference alarms in various alarms at this time. The PCE in each domain collects the alarm information of the domain, summarizes the optical path ALPs affected by the attack with the alarm point as the destination node, and finds their IDs and the OXC ports corresponding to the alarm points. Perform BER detection on the ALPs of these ports, calculate the dBr _nk of each ALP according to equation (5-1) and compare it with its corresponding Bt _nk , and then obtain each ALP according to the different relationships in equation (5-2). The state information value S _nk of , is shown in Table 5-3. Then, according to different Snk, all ALPs are classified and classified, and the interference alarm nodes n21, _n31 and n33 are excluded, and finally an OALP set is obtained. The judgment results are shown in Table 5-4. Through the analysis of the above steps, the attack detection module based on ALP state discrimination can solve the problem of a large number of interference alarms in multi-domain optical networks, and output a final OALP set for the crosstalk attack location module.

Table 3 Status information values of ALP

ID S_nk LP1 2 LP3 0 LP4 2 LP5 2 LP6 1 LP7 2 LP8 2 LP9 1 LP10 0 LP11 1

Table 4 ALP state discrimination results

Attack status Attack Light Path ID OALP LP1, LP4, LP5, LP7, LP8 SALP LP6, LP9, LP11 DALP LP3, LP10

Example 2

According to the OALP={LP1, LP4, LP5, LP7, LP8} output by the crosstalk attack detection module in the first embodiment, define DN={n15, n20, n23, n25, n32}, BN={n19, n32, n34}. First, determine the high-power crosstalk attack domain, and execute Step1 to Step7 of determining the crosstalk attack domain in the MD-PLVM algorithm. It is found that the exit border node of D2 does not receive "GA", and the DN and exit BN in the domain are also incorrect. Therefore, D2 is determined to be the crosstalk attack domain.

Then, the high-power crosstalk attack between domains was located, and it was found that n11, which does not belong to the BN set, received "INTERDA" from a different ID domain, namely D3, so it was determined that the inter-domain link formed between n11 and the signaling sending node n34 { 11-34} are high-power crosstalk attack sources. It is found that n32 belonging to the BN set has received "INTERDA" of different ID domains D2. Further analysis finds that n32 has received the correct "MS" within 2d/v ₀ , so it is determined that the inter-domain link {19-32} is not large Power crosstalk attack source.

Next, the OALP in D2 is located for crosstalk attack, and it is found that there are not only DNs, but also BNs in D2, so it is concluded that D2 contains cross-domain OALPs, so all n15, n19, n20 and n23 are defined as PES, and then execute In the MD-PLVM algorithm, the OALP crosstalk attack positioning step in the domain is executed. When it is executed to Step 3, it is found that when all the OALPs in the list are compared, but still no OALP without a public link can be found. Therefore, it is determined that there is only one OALP in the D2 domain. High-power crosstalk attack, so directly execute Step5's ERQi single-point attack positioning:

Define the light path LP7 with the shortest length as the execution path ER, and at the same time determine n20 as the execution node ES, ES generates an ALV and transmits it to each node in the LA. The ALV is shown in Table 5:

table 5

When n21 receives the ALV sent by ES, it will match the link vector LV of its own optical paths LP3 and LP9 with ALV. Although LP3 and LP9 do not belong to the OALP set, they are in the LA of LP7, so n21 will do ES In response, the LV of n21 is shown in Table 6:

Table 6

According to the matching rule in step 4e.3 of the MD-PLVM algorithm, for a normal LP that does not belong to the OALP set, if its LV and ALV have a common link, set the corresponding binary bit in the BV to 0, otherwise set it to 1, and set the LP state to 1. At the same time, n21 will transmit the status of LP and the generated BV to ES, and the corresponding BV and LP status generated after matching are shown in Table 7:

Table 7

When ES receives the matching result of n21, it will judge that link {19-24} is not the source of high-power crosstalk attack. When n15 receives the ALV sent by ES, it will match the link vector LV of its own optical paths LP6 and LP8 with the ALV. The LV of n15 is shown in Table 8:

Table 8

According to the matching rule of step 4e.3 of the MD-PLVM algorithm, for OALP, if there is a common link between its LV and ALV, set the corresponding binary bit in BV to 1, otherwise set it to 0, and set the OALP status Set to 0. At the same time, n15 will transmit the status of LP and the generated BV to ES, and the corresponding BV and LP status generated after matching are shown in Table 9:

Table 9

ES performs a logical "AND" operation on all BVs received in the LA range. If there is no "1" in the operation result, the LA range is expanded, and the neighbor nodes of the adjacent nodes of the ALV are added to the LA range. When n23 receives the ALV sent by ES, it will match the link vector LV of its own optical path LP4 with the ALV. The LV of n23 is shown in Table 10:

Table 10

Matching is performed according to the matching rules of step 4e.3 of the MD-PLVM algorithm, and then n23 will transmit the state of LP and the generated BV to ES. The corresponding BV and LP state generated after matching are shown in Table 11:

Table 11

So far, ES can determine that link {18-19} is the source of high-power crosstalk attack according to the BV transmitted by n23, and transmit the information to the PCE of D2. The PCE will broadcast an ATTACK_LOCATION message to the PCEs of D1 and D3, and the crosstalk attack is located. Finish.

Through the above analysis, it can be located that the high-power crosstalk attack sources of the multi-domain optical network are link {11-34} and link {18-19}. Therefore, the MD-PLVM crosstalk attack localization algorithm can achieve the goal of accurately locating the multipoint crosstalk attack source in the multi-domain optical network.

Example 3

This embodiment uses the VPI optical network simulation platform and Matlab simulation software to verify the reliability and effectiveness of the distributed PCE-based multi-domain optical network multi-point crosstalk attack detection and location method (DP-CADL).

(1) Multipoint crosstalk attack detection capability of DP-CADL

After the high-power crosstalk attack signal is injected, the destination nodes and boundary nodes of multiple optical paths connected to the monitoring module generate alarms. Collect statistics on the IDs of the OXCs at the alarm locations, and search for damaged LPs on the OXC ports where the alarms are located. The OXCs that need BER detection for the damaged LPs as the destination node are OXC15, OXC20, OXC21, OXC23, OXC25, OXC31, OXC32, OXC33. The actual detected BER values of all damaged LPs obtained after port detection are shown in Figure 3.

As can be seen from Figure 3, the BERs of LP1, LP4, LP5, LP7 and LP8 are all in a high range, and the BER of LP4 is the highest, indicating that LP4 must belong to OALP; the BERs of LP3 and LP10 are in a low range. The BER of LP10 is the lowest, but their BER is less than 1E-9, and they no longer have the ability of attack propagation, so LP3 and LP10 must belong to DALP.

The actual detection value of BER is compared with the benchmark BER corresponding to different ports of different OXCs, and the ALP is classified and classified according to the state information value _Snk output by the comparison. The final attack discrimination of ALP is shown in Figure 4. It can be concluded that the OALP set finally found includes LP1, LP4, LP5, LP7 and LP8, and the excluded interference alarms are LP3, LP6, LP9, LP10 and LP11, which is consistent with the result of the example analysis in 5.3.3. The experimental results show that DP-CADL has good attack detection ability, can achieve the purpose of accurately eliminating interference alarms in multi-domain optical networks, and has high reliability.

(2) DP-CADL's multipoint crosstalk attack location capability

This chapter divides the multi-point crosstalk attack problem of multi-domain optical network into seven different attack situations from A to G to analyze and discuss the simulation experiments. The seven attack situations are shown in Table 12.

Attack code attack content A There are only inter-domain multipoint crosstalk attacks B There are only intra-domain OALP multipoint crosstalk attacks C Multipoint Crosstalk Attacks Only Exist in Cross-Domain OALP D There are both inter-domain and intra-domain OALP multipoint crosstalk attacks E Multipoint crosstalk attack with simultaneous inter-domain and cross-domain OALP F There are both intra-domain OALP and cross-domain OALP multipoint crosstalk attacks G There are multipoint crosstalk attacks of inter-domain, intra-domain OALP and cross-domain OALP at the same time

Set different numbers of LP requests, observe the change of the attack positioning accuracy of DP-CADL, and analyze the changes of the maximum attack positioning delay and the average attack positioning delay of DP-CADL under different attack conditions of A~G.

Figure 5 shows the accuracy of attack location under different numbers of LP requests. It can be seen from the figure that when the number of LP requests is small, the accuracy of attack location is lower, but as the number of LP requests increases, the attack location increases. Accuracy increased rapidly and significantly. This is because as the number of LP requests increases, the number of valid LPs in the multi-domain optical network that can participate in the positioning and matching within the LA range also increases, which makes attack positioning easier and improves the accuracy of attack positioning. However, when the number of LP requests increases to a certain value, the number of valid LPs no longer changes significantly, that is, more LPs are no longer useful for the location of the attack link, so the accuracy of the attack location will tend to be stable.

Figures 6 and 7 respectively show the changes of the maximum attack location delay Tm and the average attack location delay Ta with the increase of the number of LP requests under different attack situations A to G. It can be seen from the figure that as the number of LP requests increases, Tm and Ta also increase. This is because when the number of LP requests increases, the OALP set output by the attack detection module will also become larger, which will increase the number of OALPs performed on all OALPs. The time required for the division of ERQi increases the total positioning delay of the multi-domain optical network. It is observed that the Tm and Ta of case C are significantly larger than those of case B, this is because in the multipoint crosstalk attack positioning of cross-domain OALP, in addition to the DN, the nodes defined as PES also increase in 2d/v ₀ time The egress BN that does not receive the correct "MS" and the egress border node that receives "GA", the increase in the number of PES nodes will increase the total positioning delay. We can also find that Tm and Ta in case F are smaller than those in case C, which indicates that the existence of intra-domain OALP will help to locate multi-point crosstalk attacks in cross-domain OALP to some extent.

Through the simulation experiment of A's attack situation, it is obtained that the maximum attack positioning delay Tm of A is 1.031e-4s, and the average attack positioning delay Ta is 6.9782e-5s. Therefore, the DP-CADL scheme can achieve the purpose of quickly locating the inter-domain multipoint crosstalk attack of the multi-domain optical network. It can be seen from Figure 5 that when the number of LP requests reaches 400, the attack location accuracy rate of the multi-domain optical network is close to 1, and the maximum attack location delay at this time is much smaller than the attack location time required by OSPF, which is 40ms. Therefore, the DP-CADL scheme can achieve the purpose of quickly locating the intra-domain multi-point crosstalk attack of the multi-domain optical network.

To sum up, the DP-CADL scheme can quickly locate the inter-domain and intra-domain multipoint crosstalk attacks of multi-domain optical networks, and has a high positioning accuracy.

Claims (3)

1. The multi-domain optical network multi-point crosstalk attack detection method based on the distributed PCE is characterized by comprising the following steps of:

step 1: acquiring BER information of all attack light paths at each alarm node, wherein the BER information of the attack light paths comprises detection BER values, reference BER values and threshold values of the attack light paths;

step 2: obtaining a state information set Z of the attack light path according to BER information of all attack light paths at each alarm node _n ＝{S _nk }；

Wherein,

Br _nk BER value, Bb, detected for the kth attack path of the nth alarm node _nk Reference BER, Bt of kth attack light path of nth alarm node _nk Threshold value, dBr, of the kth attack path representing the nth alarm node _nk ＝|Br _nk -Bb _nk |，Br _nk 、Bb _nk And Bt _nk The value ranges of (A) and (B) are (0, 1);

and step 3: and judging the attack light path with the state information of 2 at each alarm node as an original attack light path, and acquiring the original attack light paths at all the alarm nodes as an original attack light path set.

2. The multi-domain optical network multi-point crosstalk attack detection and positioning method based on the distributed PCE is characterized by comprising the following steps of:

step 1: taking a boundary node of each domain and a destination node of each optical path in a multi-domain optical network as alarm nodes, acquiring BER information of all attack optical paths at each alarm node, and obtaining an original attack optical path set according to the multi-domain optical network multi-point crosstalk attack detection method based on the distributed PCE as claimed in claim 1;

obtaining a DN set and a BN set according to the fact that each original attack light path in the original attack light path set comprises a destination node DN of the original attack light path and a domain boundary node BN of the original attack light path;

and 2, step: the DN set and the BN set are made to send signaling, and all crosstalk attack domains in the multi-domain optical network are obtained according to the receiving and sending signaling relation of the DN set and the BN set, and the method comprises the following substeps:

step 2.1: each DN in the DN set sends an intra-domain alarm signaling to an intra-domain PCE of a domain where the DN set is located and all nodes of the domain where the DN set is located, wherein the intra-domain alarm signaling comprises a domain ID (identity) and a node ID of a sending node and IDs and lengths of all attacked light paths passing through the node;

an inlet of each BN in the BN set sends an inter-domain alarm signaling to an intra-domain PCE of a domain where the BN set is located, all nodes in the domain, a PCE of an upstream domain and a BN of an upstream domain, and also sends monitoring signals to an upstream DN and the upstream BN, wherein the inter-domain alarm signaling comprises a domain ID of a sending node, a node ID and IDs and lengths of all attacked light paths passing through the node;

the outlet of each BN in the BN set sends an inter-domain alarm signaling to a PCE in the domain, all nodes in the domain, a PCE in a downstream domain and a BN in the downstream domain, and also sends monitoring signals to a downstream DN and the downstream BN;

step 2.2: acquiring signaling received by a border node which does not belong to the BN set in the multi-domain optical network, if any border node which does not belong to the BN set receives an inter-domain alarm signaling containing a domain ID of the domain, sending a control signaling to a downstream BN of any border node which does not belong to the BN set, wherein the control signaling contains a node ID of a sending node, and executing the step 2.3; otherwise, executing step 2.3;

step 2.3: acquiring the DN and the BN number in each domain and the signaling received by each BN in a BN set, and judging according to a judgment criterion to acquire all crosstalk attack domains in the multi-domain optical network, wherein the judgment criterion comprises the following steps:

if the domain only contains DN and no BN, the domain is judged as a crosstalk attack domain;

if no BN in any domain receives the control signaling and all DNs and BN receive the monitoring signals, judging that no crosstalk attack exists in the domain; otherwise, the domain is determined as a crosstalk attack domain;

if any BN receives an inter-domain alarm signaling of a domain ID which is not the local domain, an inter-domain link formed by the BN and a signaling sending node is added into a crosstalk attack domain;

and step 3: judging the quantity relation between DN and BN in the crosstalk attack domain, if only DN is contained and BN is not contained, then carrying out crosstalk attack location in the domain, and obtaining the intra-domain link attacked by crosstalk; otherwise, inter-domain crosstalk attack positioning is carried out, and inter-domain links under crosstalk attack are obtained.

3. The multi-domain optical network multi-point crosstalk attack detection and location method based on the distributed PCE of claim 2, wherein the crosstalk attack location method in step3 employs an MD-PLVM algorithm.

Images