JP2006025088A - Route detector, detecting method and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To distinguish a hijack route from a punching hole for automatic detection because there is no difference in features of BGP between the punching hole and the hijack route. <P>SOLUTION: After the route information of a monitor object AS (AS-B) is acquired from a route information processor belonging to an AS other than the monitor object AS by means of a route detector AS-A, a route having the AS number of a route information source AS different from that of the monitor object AS is extracted from that route information along with the AS number of the route information source AS. A decision is made whether the extracted route and the AS number of the source AS represent a hijack route or a punching hole by one of four methods, i.e. (1) a method utilizing only the information obtained from the route information processor 10, (2) a method utilizing a monitor object AS punching hole list 40, (3) a method utilizing IRR 70, or (4) a method utilizing the monitor object AS punching hole list 40 and the IRR 70. In the case of a hijack route, a set of a hijack route and the AS number of its source AS is informed from an informing section 60. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  According to the present invention, a route that should have a certain AS (Autonomous System) as a route information generation source AS is a route that has another AS that is not permitted as the route information generation source AS as a route information generation source AS. And a path detection apparatus and method for detecting the AS number of the non-permissible AS, and a program thereof.

  The Internet is an organic connection of 10,000 or more ASs operated by different organizations such as ISP (Internet Service Provider) and companies and universities. These ASs are connected by a dedicated line or IX (Internet eXchange), and route information is exchanged by BGP (Border Gateway Protocol).

In the Internet, IANA (Internet Assigned Number Authority) centrally manages the allocation and assignment of various identification numbers required for Internet operations, and the authority to delegate part of this responsibility to the IR (Internet Registry) is left to the discretion. Has been. Also, the network number and AS number, which are Internet resources, are entrusted to the IR. The IR is composed of a regional IR, a country-specific IR, and a local IR as a hierarchical structure, and manages Internet resources such as network numbers.
The route information includes a route and a subnet mask length of the route (hereinafter also referred to as a route length), and includes an AS path.

BGP is a path vector type routing protocol, and route information advertised by a certain AS propagates each AS on a hop-by-hop basis and spreads throughout the Internet. In the process of propagation, routing control based on each AS's own operation policy is performed by performing route filtering, operation of path attributes of route information, and the like.
However, while flexible route control based on the operation policy of each AS is possible, route information once advertised cannot be route controlled by the AS that advertised it and how it is manipulated by other ASs. There is an aspect that it is not possible to grasp whether or not. Therefore, when incorrect route information is advertised due to a setting error or malicious route control setting by an operator who performs route control, the incorrect route information is propagated to the entire Internet.

As an example of incorrect route control settings, a route that should be a route information generation source for a certain AS is advertised by another AS that is not originally permitted as a route information generation source other than that AS. A communication failure occurs in which communication is not performed on a path that should originally be reached.
This is because the route information processing apparatus performs forwarding control according to the longest match rule for any destination. The longest match rule is a rule for selecting a route having a longer route length when there are a plurality of matching routes in the route table held by the route control device.

  That is, as described above, once BGP performs a route advertisement, the advertisement source cannot grasp how the route advertised is controlled. Therefore, if a route that should not be the route information generation source AS due to an AS setting error is advertised with the AS as the route information generation source, the route (hijacking route) information is propagated to the Internet. . As a result, for example, problems such as the inability to communicate with the AS that should originally be the route information generation source AS of the route occur.

The hijack route is the same route as the route advertised by a certain AS in the output of the route information processing device, or a route included in the route, and in addition, the AS number of the route information generation source AS is There is a characteristic that it is different from the AS number of the AS.
In order to solve this problem, it is conceivable to use the output characteristics of the route information processing device. However, the route by the punching hole, which is a route advertisement method when performing multihoming, is hijacked for the route information processing device. There is a difference that the hijacking path cannot be detected because there is no difference with the path and only the output from the path information processing apparatus cannot identify whether the hijacking path is a punching hole path.

The punching hole is to allow the route information generation source AS of the monitoring target route to be an AS other than the monitoring target AS for the purpose of multihome connection.
Therefore, as an example of determining the hijacking route, for example, “Secure BGP Project (S-BGP)” [online], posting date unknown, BBN Technologies. [Search on June 2, 2004], Internet <http: // www. net-tech. bbn. com / sbgp / sbgp-index. html> (see Non-Patent Document 1). The method of Non-Patent Document 1 is to newly add a function to the BGP protocol and discriminate the hijack path.

“Secure BGP Project (S-BGP)” [online], unknown date, BBN Technologies. [Search on June 2, 2004], Internet <http: // www. net-tech. bbn. com / sbgp / sbgp-index. html>

As described in Non-Patent Document 1, adding a function to the BGP protocol is difficult to implement because it has a large effect on the system, such as a need to change the entire BGP currently in operation.
Here, in order to detect the hijacking path, it becomes a problem to distinguish the hijacking path from the punching hole.

(the purpose)
An object of the present invention is to provide a path detection apparatus and method for detecting a hijack path based on reachability to a path managed by an AS to which a path is allocated from an IR, and a program thereof. .
Another object of the present invention is to provide a path detection apparatus and method for determining a hijack path according to features other than BGP path information when performing the above hijack determination, and a program thereof. It is in.

  In the route detection method of the present invention, as a feature other than the output of the route information processing apparatus, the hijack route has a feature that a route advertisement is originally made from an AS that is not an AS that should perform route advertisement. Paying attention, a hijack route and a punching hole route are discriminated, and only a route discriminated as a hijack route is detected as a hijack route.

  The hijack path detection device of the present invention is installed in an AS other than the monitoring target AS, with a certain AS as a monitoring target AS, and a path that should be the AS as a route information generation source AS as a monitoring target path. Information on the monitoring target route output from the route information processing apparatus, and information on the IRR and punching hole list is selected from the acquired route information for the route information generation source AS number different from the monitoring target AS number. It is detected based on the above.

  The hijack path detection method according to the present invention can be executed by computer control, and the technical scope of the present invention extends to a computer control program for this purpose.

  According to the present invention, it becomes possible to take an early countermeasure against this route failure by automatically and early grasping a hijack route in which the route of the monitoring target AS is advertised from an AS other than the monitoring target AS. As a result, the communication interruption time to the route managed by the monitoring target AS is shortened, that is, the reachability is improved, and DoS attack, spam mail and the like that abuse the hijacking route are prevented, thereby improving the network security.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
FIG. 1 is a configuration diagram of a route detection apparatus according to an embodiment of the present invention.
Here, the route refers to a continuous bundle of IP addresses in the IP network. Specifically, for example, it is expressed as 192.168.100.0/25 (a bundle of IP addresses 192.168.100.1 to 192.168.100.127). Also, a route including another route is, for example, a relationship of 192.168.100.32/27, 192.168.100.96/28, and 192.168.100.0/25. 192.168.100.0/25 indicates that 192.168.100.32/27 and 192.168.100.96/28 are included.

In FIG. 1, an AS on the Internet showing an example of a target to which the route detection device AS-A is applied is extracted. The route detection device AS-A is connected to the Internet 70 via the route information processing device 10. In addition, AS-B is shown as the monitoring target AS.
The route detection apparatus according to the present embodiment includes a route information collection unit 20, a monitoring target AS route information list 30, a monitoring target AS punching hole list 40, and a determination processing unit 50, as shown in the enlarged view below AS-A. , A notification unit 60, and a cache IRR information file 80.
An IRR (Internet Routing Registry) 70 is installed on the Internet.
This route detection device AS-A is premised on being connected to a route information processing device (for example, a router) 10 belonging to an AS different from the monitoring target AS. The route information processing apparatus 10 is assumed to be connected to the route information processing apparatus existing on the Internet 70.

FIG. 2 is a diagram showing an example of the monitoring target AS route information list in FIG.
As shown in FIG. 2, the monitoring target AS route information list 30 includes at least the AS number of the monitoring target AS (hereinafter referred to as monitoring target AS number) and the route from which the monitoring target AS becomes the route information generation source (hereinafter referred to as monitoring target). Route) and a determination method.
There are the following four determination methods.
(1) A determination method using only information obtained from the route information processing apparatus.
(2) A determination method using the monitored AS punching hole list.
(3) A determination method using IRR.
(4) A determination method using the monitored AS punching hole list and the IRR.
In FIG. 2, the method (2) using the monitored AS punching hole list is used as the determination method. The monitoring target AS number: 1000 and the monitoring target route of the monitoring target AS 1000 are “100.0.0.0/8”, “192.168.0.0/16”, “10.0.0. 0/16 ”,“ 172.16.0.0/16 ”... Are shown.

FIG. 3 is a diagram showing an example of the monitoring target AS punching hole list in FIG.
In FIG. 2, the monitoring target AS punching hole list 40 indicates that the monitoring target AS allows the other AS other than the monitoring target AS among the monitoring target route or the route included in the route to be the route information generation source AS. The AS path number of the permitted AS and the allowed AS number are listed as one set. For example, 100.60.0.0/16, 100.60.127.0/24 included in the route of 100.0.0.0/8, and 172.16.0 which is the monitoring target route itself. As for the route information generation source AS, AS AS of the AS number 3000 is permitted by the monitoring target AS 1000.

FIG. 4 is a diagram illustrating an output example of the IRR in FIG.
In FIG. 1, IRR 70 refers to a database system in which route information on the entire Internet exchanged between routers using BGP is collected in one place.
FIG. 4 shows an example of information registered in the IRR 70 by the network administrator.
In FIG. 4, route is 100.60.0.0/16, and origin is AS1000, which is the route information generation source AS number of the route. Inside the broken line, information such as route and origin is shown for one record, and a plurality of these records are registered.

  The cache IRR information 80 illustrated in FIG. 1 is obtained by storing information collected when referring to the IRR 70 illustrated in FIG. 4 in the determination processing unit (path determination device) 50. The cache IRR information 80 is updated with reference to the IRR 70 at regular intervals or with reference to the IRR 70 without passing through the regular period.

FIG. 6 is a diagram illustrating an example of information on a correspondence relationship between a route acquired from the route information processing apparatus and the route information generation source AS number of the route in the present invention.
The route information collection unit 20 displays, for each route described in the monitoring target AS route information list 30, the correspondence with the route information generation source AS number for all routes that are equal to or included in the monitoring target route. Obtained from the processing apparatus 10, and passes the obtained correspondence information to the determination processing unit 50. The correspondence information at this time is the information shown in FIG.
In FIG. 6, information corresponding to the monitoring target route 100.0.0.0/8 is shown.
For example, 100.32.0.0/13 is a monitoring target route (100.0.0.0/18) or a route included in this route. The AS number 3000 on the rightmost side of the same column as 100.3.2.0.0 / 13 is the AS number of the route information generation source AS of the monitoring target route or the route included in the route.

  In addition, as an opportunity to acquire the correspondence information from the route information processing device 10, the route information collection unit 20 periodically issues a command to the route information processing device 10 and the monitoring target route is equivalent. Alternatively, there is a method of performing notification with a notification from the route information processing apparatus 10 when there is a change in the route information generation source AS number for all the routes included therein.

  The determination processing unit 50 compares the path information generation source AS number included in the correspondence information received from the path information collection unit 20 with the monitoring target AS number. As a result of the comparison, if the AS numbers are the same, the determination process for the corresponding route is terminated, and the process waits until the next correspondence information is passed from the route information collection unit 20. As a result of the comparison, if the AS numbers are different, the process proceeds to the next determination process according to the determination method described in the monitoring target AS route information list 30.

(Detection result of judgment processing unit)
7 to 10 are each an operation flowchart of the determination method performed by the determination processing unit 50.
7 shows a flow of a determination method using the monitored AS punching hole list 40, FIGS. 8A and 8B show a flow of a determination method using IRR, and FIG. 9 shows information obtained from the route information processing apparatus. FIG. 10 is a flow of a determination method using only the monitoring target AS punching hole list and the IRR.
Hereinafter, each determination method will be described according to the flowchart.
(1) In the case of a determination method that uses only information obtained from the route information processing apparatus 10 As shown in FIG. 9, the determination processing unit 50 includes route information included in the correspondence information received from the route information collection unit 20. The generation source AS number and the monitoring target AS number are compared (step 301), and it is determined as a result of the comparison whether the AS numbers are different (step 302). If the AS numbers are different, the detection result of the determination processing unit 50 is determined using the route and the route information generation source AS number. That is, it is determined that a route with a different AS number is a hijack route (step 303). In the case of the same AS number, it is determined that there is no hijacking route (step 304).

(2) In the case of a determination method using the monitoring target AS punching hole list 40 As shown in FIG. 7, the determination processing unit 50 includes a path information generation source AS number in the correspondence information received from the path information collection unit 20 and The monitoring target AS number is compared (step 101), and it is determined as a result of the comparison whether the AS number is different (step 102). If the AS numbers are different, the determination processing unit 50 refers to the monitoring target AS punching hole list 40 for the pair of the route and the route information generation source AS number, as shown in FIG. A pair corresponding to one of (a) and (b) and a path information generation source AS number is detected. That is,
(A) As a result of step 102, the route that is different from the AS number and the route information generation source AS number pair that matches or includes the route is the monitored AS punching hole list 40. (Step 103). If none exists (step 104), the nonexistent route is determined as a hijack route (step 108). If it exists, it proceeds to the next (b).
(B) As a result of step 102, a route matching the route or a route including the route out of the pair of the route and the route information generation source AS number when the AS numbers are different is the monitored AS punching hole list 40. The route information generation source AS number of the route, the route that matches the route in the monitored AS punching hole list 40, and / or the route information generation source AS number of the route that includes the route, Are compared (step 105). If none of the comparison results in a match (step 106), the mismatched route is determined as a hijack route (step 108).
On the other hand, if the determination in step 102 is No or if the determination in step 106 is Yes, it is determined that there is no hijacking route (step 107).

(3) Case of determination method using IRR The processing of this determination method will be described with reference to FIGS.
(Step 1): The determination processing unit 50 compares the route information generation source AS number in the correspondence information received from the route information collection unit 20 with the monitoring target AS number (step 201), and as a result of the comparison, a different AS number is obtained. It is determined whether or not (step 202). When the AS numbers are different, the determination processing unit 50 refers to the cache IRR information 80 for the pair of the route and the route information generation source AS number, as shown in FIG. A pair corresponding to one of (c) and (d) and a path information generation source AS number are detected.
(C) As a result of step 202, the cache IRR information 80 includes a path that matches the path or a path that includes the path in the pair of the path and the path information generation source AS number when the AS numbers are different. Whether or not (step 203). If none exist (step 204), the process proceeds to step 207. If it exists, it proceeds to the next (d).
(D) As a result of step 202, one of the pairs of routes and route information generation source AS numbers that have different AS numbers matches the route or includes the route in the cache IRR information 80. If the route information generation source AS number exists, the route information generation source AS number of the route is compared with the route matching the route in the cache IRR information 80 and / or the route information generation source AS number of the route including the route (step 205). ). If none of the comparison results in a match (step 206), the process proceeds to step 207. If even one matches (step 206), it is determined that there is no hijack path (step 211).

(Step 2): The determination processing unit 50, among the pair of the route detected at Step 1 and the route information generation source AS number, the route and the route information generation source AS number corresponding to one of the following (e) and (f): Are detected (step 207). That is,
(E) It is detected whether a route that matches the route or a route that includes the route is present in the IRR 70 from the pair of the route detected in Step 1 and the route information generation source AS number (Step 207). . If none exists (step 208), it is determined that the route is a hijack route (step 212). If it exists, it proceeds to the next (f).
(F) Of the pair of the path detected at Step 1 and the path information generation source AS number, if there is one or more paths in the IRR 70 that match the path or include the path, the path information of the path The generation AS number is compared with the path information generation AS number of the path that matches the path in the IRR 70 and / or the path that includes the path (step 209). As a result of the comparison, if no match is found (step 210), the route is determined as a hijack route (step 212). If even one matches (step 210), it is determined that the route is not a hijack route (step 211).

As a determination method using IRR, Step 2 is directly applied to a pair of a route and a route information generation source AS number in the case of different AS numbers as a result of Step 202 without passing through Step 1, and the determination processing unit 50 There is also a method for obtaining the detection result.
In the case of applying this method, in FIG. 8A, starting from step 213, processing is performed up to steps 225 and 226 in FIG. 8B.

(4) Case of determination method using monitoring target AS punching hole list 40 and IRR 70 This determination method will be described with reference to FIG.
The determination processing unit 50 performs the above-described (2) “in the case of the determination method using the monitored AS punching hole list 40” (step 401) and (3) “in the case of the determination method using IRR” (step 402). Both determinations are performed, and in both determination results, the pair of the path and the path information generation source AS number detected simultaneously (the path in the correspondence information received from the path information collection unit 20) is determined by the determination processing unit 50. The detection result is set (step 404).
That is, as shown in FIG. 10, if there is a path determined to be hijacking based on the determination result (401) in FIG. 7 and the determination result (402) in FIGS. The determination result (404) is obtained.

  The determination processing unit 50 follows the determination method described in the monitoring target AS route information list 30 and the route and route information detected by any one of the methods (1), (2), (3), and (4). When there is a pair of generation source AS numbers, the information of this pair is passed to the notification unit 60.

FIG. 5 is a diagram illustrating an example of notification from the notification unit according to the present invention.
As shown in FIG. 5, the notification unit 60 receives the route passed from the determination processing unit 50 and the AS number set of the route information generation source AS, and notifies the monitored AS by e-mail as the hijack route. To do. For example, as shown in FIG. 5, the route of the monitoring target AS is 100.0.0.0/8, the detection route is 100.60.0.0/16, and the route information generation source AS number of the detection route information As 5000 is notified.

  If the flowchart of the route determination method shown in FIGS. 7 and 8 is programmed and the generated program is recorded on a recording medium such as a CD-ROM, the recording medium is mounted on the computer of the route detection device on the Internet. The present invention can be easily realized by installing the program on a computer and causing the computer to execute the program, and the program can also be spread by being widely downloaded via the Internet.

  Although the route detection method of the present invention has been described in detail with reference to the embodiments, the present invention is not limited to these embodiments, and various improvements and modifications can be made without departing from the spirit of the present invention. Needless to say.

1 is a system configuration diagram of a route detection apparatus according to an embodiment of the present invention. It is a figure which shows the monitoring object AS route information list example in FIG. It is a figure which shows the monitoring object AS punching hole list example in FIG. It is a figure which shows the example of an output of IRR in FIG. It is a figure which shows the example of a notification from the notification part in this invention. In this invention, it is a figure which shows the information example of the correspondence of the path | route acquired from a path | route information processing apparatus, and the path | route information generation source AS number of this path | route. It is an operation | movement flowchart of the determination method using the monitoring object AS punching hole list | wrist in this invention. It is an operation | movement flowchart (a) of the determination method using IRR in this invention. It is an operation | movement flowchart (b) of the determination method using IRR in this invention. It is an operation | movement flowchart of the determination method using only the information obtained from the path | route information processing apparatus in this invention. It is an operation | movement flowchart of the determination method using the monitoring object AS punching hole list | wrist and IRR in this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 ... Route information processing apparatus, 20 ... Route information collection part, 30 ... Monitoring object AS route information list,
40 ... Monitoring target AS punching hole list, 50 ... Determination processing unit, 60 ... Notification unit,
70 ... IRR, 80 ... Cashier IRR information, AS-A ... Route detection device,
AS-B: AS to be monitored.

Claims (19)

Route information holding means for holding information that associates the AS number of the monitoring target AS with the route of the monitoring target AS;
Route information collection means for acquiring route information related to the route of the monitoring target AS advertised on the Internet from the route information processing device that creates and holds all the route information on the Internet by receiving route advertisement on the Internet by BGP;
A route detection apparatus comprising: a determination processing unit that detects a route in which the monitoring target AS is not the route information generation source AS from the route information acquired by the route information collection unit. The route detection device according to claim 1,
Among the routes detected by the determination processing unit, the monitoring target AS includes a route that does not allow another AS as a route information generation source AS and a unit that detects an AS number of the route information generation source AS. A characteristic route detection device. The route detection device according to claim 2,
As a means for detecting a route that the monitoring target AS does not allow other ASs as a route information generation source AS and an AS number of the route information generation source AS,
Among the routes of the monitoring target AS, the route advertised with the AS other than the monitoring target AS as the route information generation source AS is the correspondence between the route output from the IRR and the AS to be the route information generation source of the route A route detection device comprising means for detecting using information. The route detection device according to claim 2,
As a means for detecting a route that the monitoring target AS does not allow other ASs as a route information generation source AS and an AS number of the route information generation source AS,
Among the routes of the monitoring target AS, a route that is advertised with an AS other than the monitoring target AS as the route information generation source AS is the route of the punching hole and the AS number of the AS permitted as the route information generation source of the route. A route detection apparatus comprising means for detecting using a monitoring target AS punching hole list describing a set. The route detection device according to claim 2,
As a means for detecting a route that the monitoring target AS does not allow other ASs as a route information generation source AS and an AS number of the route information generation source AS,
Among the routes of the monitoring target AS, the route advertised with the AS other than the monitoring target AS as the route information generation source AS is the correspondence between the route output from the IRR and the AS to be the route information generation source of the route A path detecting apparatus comprising: a monitoring target AS punching hole list in which a set of information and a path by a punching hole and an AS AS number permitted as a path information generation source of the path is described. In the route detection device according to any one of claims 1 to 5,
A route detection device that performs detection by periodically inquiring of the route information processing device about route information related to a monitoring target route and acquiring the route information. In the route detection device according to any one of claims 1 to 5,
A route detection device that performs detection triggered by notification of route information related to a monitoring target route from the route information processing device. In the route detection device according to claim 3,
The means for detecting using the correspondence information between the route output from the IRR and the AS to be the route information generation source of the route,
A set of a route including the route of the monitoring target AS detected by the means for detecting a route that does not have the monitoring target AS as the route information generation source AS from the acquired route information, and the route information generation source AS of the route is obtained from the IRR. Means for detecting a route that is not included in the route information generation source AS among the routes of the monitoring target AS by being not included as a set of AS described in the output route and the origin item of the route A path detection apparatus comprising: The route detection device according to claim 4,
Means for detecting using a monitoring target AS punching hole list describing a set of a route by the punching hole and a route information generation source AS number of the route,
The combination of the route including the monitoring target route and the route information generation source AS of the route is not included in the list describing the combination of the route by the punching hole and the AS number of the AS permitted as the route information generation source of the route. Accordingly, a route detection apparatus comprising means for detecting a route that does not use the monitoring target AS as a route information generation source AS among the routes of the monitoring target AS. The route detection device according to claim 5,
Monitoring that describes the correspondence information between the route output from the IRR and the AS that should be the route information generation source of the route, and the combination of the AS by the punching hole and the AS number of the AS permitted as the route information generation source of the route The means for detecting using the target AS punching hole list is:
A set including a route including the monitoring target AS and the route information generation source AS of the route is not included in the route output from the IRR and the AS that should be the route information generation source of the route, and includes the monitoring target AS The combination of the route to be generated and the route information generation source AS of the route is not included in the list describing the combination of the route by the punching hole and the AS number of the AS permitted as the route information generation source of the route. A route detection apparatus comprising means for detecting a route that does not use the monitoring target AS as a route information generation source AS among AS routes. In the route detection device according to any one of claims 1 to 10,
A route detection device comprising means for using information output from a route information processing device belonging to an AS other than the monitoring target AS. In the path | route detection apparatus in any one of Claims 1-11,
A route detection apparatus comprising: means for notifying a manager of a monitoring target AS of a set of the detected route and the route information generation source AS. The route detection device according to claim 12,
The notification means includes a means for notifying the administrator of the monitoring target AS of a set of the route of the monitoring target AS and the route information generation source AS of the route using an electronic mail. . Route detection in which a route that should have a certain AS as a route information generation source AS detects a route that has another AS that is not permitted as the route information generation source AS and the AS number of the non-permitted AS A method,
The determination processing means refers to the cache IRR information whose contents are updated based on the IRR,
Of the route and the route information generation source AS number in the correspondence information received from the route information collection unit, for the pair of the route and the route information generation source AS number whose monitoring target AS number is not the route information generation source AS (A) A route that matches the route or a route that includes the route does not exist in the cache IRR information, or (b) a route that matches the route or the route in the cache IRR information. There is one or more routes including the route information generation source AS number of the route, the route information generation source AS number of the route containing the cache IRR information that matches the route or the route including the route Next, the determination processing means detects, for the detected path and path information generation AS number pair, (c) a path that matches the path or the path. There is no route that is included in the IRR, or (d) there is one or more routes that match the route or include the route in the IRR. The original AS number is detected by the IRR possessed by the route that matches the route or the route information generation source AS number of the route that includes the route,
A route detection method, wherein the detected route and the route information generation source AS number of the route are used as the detection result of the determination processing means. Route detection in which a route that should have a certain AS as a route information generation source AS detects a route that has another AS that is not permitted as the route information generation source AS and the AS number of the non-permitted AS A method,
The determination processing unit refers to the monitoring target AS punching hole list, and the monitoring target AS number becomes the route information generation source AS among the route and the path information generation source AS number in the correspondence information received from the route information collection unit. (A) a route that matches the route or a route that includes the route does not exist in the monitored AS punching hole list, or (A) There is one or more routes that match or include the route in the monitored AS punching hole list, and the route information generation source AS number of the route is the monitored AS punching hole. Detects a list-owned route that matches the route or that does not match at least one route information generation AS number of a route that includes the route,
A route detection method, wherein the detected route and the route information generation source AS number of the route are used as the detection result of the determination processing means. Route detection in which a route that should have a certain AS as a route information generation source AS detects a route that has another AS that is not permitted as the route information generation source AS and the AS number of the non-permitted AS A method,
The processing of both the detection method according to claim 14 and the detection method according to claim 15 is carried out, and in any determination result, the pair of the detected route and the route information generation source AS number is detected by the determination processing means. A route detection method characterized by having a result. Route detection in which a route that should have a certain AS as a route information generation source AS detects a route that has another AS that is not permitted as the route information generation source AS and the AS number of the non-permitted AS A program for
The procedure of referring to the cache IRR information whose contents are updated based on the IRR to the computer of the determination processing means, the monitoring target AS out of the path and the path information generation source AS number in the correspondence information received from the path information collecting means For a pair of a path whose number is not the path information generation source AS and the path information generation source AS number, (a) there is at least one path matching the path or including the path in the cache IRR information. There is one that does not exist, or (a) one or more routes that match or include the route in the cache IRR information, but the route information generation AS number of the route is the cache IRR A procedure for detecting a route having information that does not match at least one route information generation AS number of a route that matches or includes the route For a pair of a route and a route information generation source AS number, (c) a route that matches the route or a route that includes the route does not exist in the IRR, or (d) the route is included in the IRR. There is one or more routes that match the route or include the route, but the route information generation AS number of the route has the IRR, and the route matches the route or the route that includes the route A path detection program for executing a procedure for detecting an information generation source AS number that does not match at all. Route detection in which a route that should have a certain AS as a route information generation source AS detects a route that has another AS that is not permitted as the route information generation source AS and the AS number of the non-permitted AS A program for
The procedure of referring to the monitoring target AS punching hole list in the computer of the determination processing means, and the monitoring target AS number is the path information generation source among the paths and the path information generation source AS number in the correspondence information received from the path information collection means. For a pair of a route that is not an AS and a route information generation source AS number, (a) a route that matches the route or a route that includes the route does not exist in the monitored AS punching hole list Or (a) The monitored AS punching hole list includes one or more routes that match or include the route, and the route information generation source AS number of the route is the monitored object None of the AS information of the route information generation source AS number of the route that matches or includes the AS punching hole list The procedure of detecting the path detection program for executing, respectively. Route detection in which a route that should have a certain AS as a route information generation source AS detects a route that has another AS that is not permitted as the route information generation source AS and the AS number of the non-permitted AS A program for
The computer of the determination processing means executes both the procedure according to claim 17 and the procedure according to claim 18, and in any determination result, the pair of the detected route and the route information generation AS number is determined. A route detection program characterized by being a detection result of means.

Images