WO2021147320A1 - Routing abnormity detection method, apparatus and system, and computer storage medium - Google Patents

Abstract

The present application relates to the field of network technologies, and provides a routing abnormity detection method, apparatus and system, and a computer storage medium. After receiving a BGP update message, a network device determines a BGP routing feature corresponding to the BGP update message. Then the network device sends target routing information to an analysis device. The target routing information comprises the BGP routing feature and/or the routing abnormity detection result. The routing abnormity detection result is obtained based on the BGP routing feature, and the routing abnormity detection result is used for indicating that the BGP update message is normal or abnormal. Compared with BGP update message, the BGP routing feature and the routing abnormity detection result are smaller in data volume, and therefore, the data transmission amount between the network device and the analysis device is reduced, thereby reducing network overhead.

Description

Routing abnormality detection method, device and system, and computer storage medium

This application claims the priority of a Chinese patent application filed on January 21, 2020 with the application number 202010069782.X and the invention title "Routing anomaly detection method, device and system, computer storage medium", the entire content of which is incorporated by reference In this application.

Technical field

This application relates to the field of network technology, and in particular to a method, device and system for detecting routing abnormalities, and computer storage media.

Background technique

With the rapid development of the Internet, the number of autonomous system (AS) nodes in the Border Gateway Protocol (BGP) network continues to increase, and the network topology becomes more and more complex, resulting in frequent abnormal events in the BGP network. Common abnormal events in BGP networks include route hijacking and route leakage. Route hijacking, which can also be called prefix hijacking, is a type of network attack in which the attacker illegally declares Internet Protocol (IP) prefixes, causing traffic to the original AS to be redirected to the AS where the attacker is located, causing route hijacking. Route leaks are usually caused by misconfigurations, leading to a route forwarding strategy that violates the business relationship between ASs. For example, a consumer AS erroneously forwards a BGP update (English: update) message of one provider AS to another provider AS, resulting in route leakage. Among them, the BGP update message is used to advertise routes.

Currently, anomaly detection is usually performed on the routes running in the BGP network in cloud services. The routing database of the cloud service stores the global IP prefixes in the BGP network. The cloud service collects, stores, and parses the BGP update messages collected by network devices in real time to track the running status of the routing in the BGP network and the status of the IP prefixes, and perform routing anomaly detection based on the negotiation consistency of the routing database.

However, because the current cloud service needs to collect the BGP update message collected by each network device in the BGP network in real time, that is, whenever a network device receives a new BGP update message, it needs to send the BGP update message to the cloud service. The cloud service and network equipment The amount of data transmission between them is large, resulting in large network overhead.

Summary of the invention

The present application provides a routing anomaly detection method, device and system, and computer storage medium, which can solve the problem of high network overhead in the current routing anomaly detection process.

In the first aspect, a routing anomaly detection method is provided. The method includes: the network device receives the BGP update message. The network device determines the BGP routing characteristics corresponding to the BGP update message. The network device sends target routing information to the analysis device. The target routing information includes BGP routing characteristics and/or routing abnormality detection results. The route anomaly detection result is obtained based on the BGP routing feature, and the route anomaly detection result is used to indicate whether the BGP update message is normal or abnormal.

In this application, after receiving the BGP routing information, the network device determines the BGP routing feature corresponding to the BGP routing information, and sends the BGP routing feature and/or routing abnormality detection result to the analysis device. Because the BGP routing feature and the routing abnormality detection result are different from Compared with the BGP update message, the data volume is smaller, so the data transmission volume between the network device and the analysis device is reduced, thereby reducing the network overhead. In addition, performing feature extraction and/or routing abnormality detection on the BGP update message on the network device side reduces the calculation amount of the analysis device and saves the calculation resources of the analysis device.

Optionally, the process for the network device to determine the BGP routing feature corresponding to the BGP update message includes: the network device obtains the target routing prefix and the target AS path according to the BGP update message, where the target routing prefix is the target source AS that advertises the BGP update message Announced IP prefix, the target AS path is the AS path from the target source AS to the AS where the network device is located. The network device obtains the historical BGP update message carrying the target route prefix. The network device obtains the historical AS path according to the historical BGP update message. The network equipment determines the BGP routing characteristics according to the target AS path and the historical AS path.

The BGP update message received by the network device includes the IP prefix announced by the source AS that issued the BGP update message, and the AS path from the source AS to the AS where the network device is located. Therefore, the network device can retrieve the BGP update message from the received BGP update message. Obtain the target AS path, and obtain the historical AS path from the historical BGP update message.

The network device may obtain one or more historical BGP update messages that carry the target route prefix from the historical BGP update messages stored by the network device. The number of historical BGP update messages carrying the target routing prefix obtained by the network device may be determined according to the message analysis configuration parameters sent by the analysis device. Alternatively, the network device may also obtain all historical BGP update messages stored in the network device that carry the target route prefix.

Optionally, BGP routing features include one or more of the following:

The path similarity between the target AS path and the historical AS path; the hegemony similarity between the target AS path and the historical AS path, which is based on the centrality of each AS on the target AS path and each AS on the historical AS path The centrality of the target AS path is determined; the rarity of the AS on the target AS path, the rarity of the AS is equal to the ratio of the number of occurrences of the AS in the historical AS path to the number of historical AS paths; the rarity of the target AS path, the target AS path The rarity of is equal to the rarity of the target AS. The target AS is the AS with the least rarity on the path of the target AS; the number of source ASs that are different from the target source AS on the historical AS path; the occurrence probability value of the target source AS, the occurrence probability value It is equal to the ratio of the number of occurrences of the target source AS in the historical AS path to the number of historical AS paths; and, the stability of the target source AS, the stability of the target source AS and the historical AS path is different from the source AS of the target source AS The number is negatively correlated, and is negatively correlated with the number of neighboring ASs on the historical AS path of the AS where the network device is located is different from the number of neighboring ASs on the target AS path of the AS where the network device is located. Among them, the neighbor AS on the AS path where the network device is located refers to the previous AS on the AS path where the network device is located.

Among them, the path similarity between the target AS path and the historical AS path, the hegemonic similarity between the target AS path and the historical AS path, the rarity of the AS on the target AS path, and the rarity of the target AS path are mainly used to determine whether route leakage occurs. ; The number of source ASs that are different from the target source AS on the historical AS path, the occurrence probability of the target source AS, and the stability of the target source AS are mainly used to determine whether route hijacking occurs. Of course, BGP routing features may also include other related features that can reflect route leakage, route hijacking, and/or route forgery, which is not limited in this application.

Optionally, the BGP routing feature includes the hegemonic similarity between the target AS path and the historical AS path, and the network device determines the BGP routing feature according to the target AS path and the historical AS path, including:

The network device obtains the first centrality vector corresponding to the target AS path, and the first centrality vector includes the centrality of each AS on the target AS path; the network device obtains the second centrality vector corresponding to the historical AS path, and the second centrality vector The degree vector includes the centrality of each AS on the historical AS path; the network device uses the similarity between the first centrality vector and the second centrality vector as the hegemonic similarity between the target AS path and the historical AS path.

Optionally, before the network device determines the BGP routing characteristics according to the target AS path and the historical AS path, the network device also receives the AS centrality list sent by the analysis device, and the centrality list includes the centrality of each AS in the network. The process for the network device to obtain the first centrality vector corresponding to the target AS path includes: the network device obtains the centrality of each AS on the target AS path from the AS centrality list according to the identification of each AS on the target AS path, and generates the first The centrality vector. The process for the network device to obtain the second centrality vector corresponding to the historical AS path includes: the network device obtains the centrality of each AS on the historical AS path from the AS centrality list according to the identification of each AS on the historical AS path, and generates the second The centrality vector.

Optionally, the BGP routing feature includes the rarity of the AS on the target AS path. Before the network device determines the BGP routing feature according to the target AS path and the historical AS path, the network device also receives the AS identification list sent by the analysis device. The identifier list includes the identifier of the operator AS. The network equipment determines the BGP routing characteristics according to the target AS path and the historical AS path, including: the network equipment determines the rarity of other ASs on the target AS path except the operator AS, and the rarity of the AS on the target AS path is equal to this The ratio of the number of AS occurrences in historical AS paths to the number of historical AS paths.

Optionally, the target routing information includes a routing anomaly detection result. After the network device determines the BGP routing feature corresponding to the BGP update message, the network device determines the routing anomaly detection result according to the BGP routing feature.

In this application, the network device generates a routing anomaly detection result according to the BGP routing characteristics, and then sends the routing anomaly detection result to the analysis device, which can further reduce the calculation amount of the analysis device.

Optionally, the network device may receive the routing anomaly detection model sent by the analysis device. The process of the network device generating the routing anomaly detection result according to the BGP routing feature includes: the network device inputs the BGP routing feature to the routing anomaly detection model to obtain the routing anomaly detection result output by the routing anomaly detection model.

Optionally, when the BGP update message is abnormal, the route anomaly detection result is also used to indicate the route abnormality type of the BGP update message.

Optionally, the route abnormality type includes one or more of route leakage, route hijacking, or route forgery. Of course, the routing exception type may also be other exception types, which is not limited in this application.

In the second aspect, a routing anomaly detection method is provided. The method includes: analyzing the target routing information sent by the network device received by the analyzing device, and the target routing information includes the BGP routing feature and/or the routing anomaly detection result corresponding to the BGP update message received by the network device, and the routing anomaly detection result is based on the BGP routing The characteristic is obtained, the route anomaly detection result is used to indicate that the BGP update message is normal or abnormal. The analysis device performs abnormal analysis on the BGP update message according to the target routing information.

Optionally, the target routing information includes BGP routing characteristics, and the process of analyzing the abnormality of the BGP update message by the analyzing device according to the target routing information includes: the analyzing device determines the routing abnormality detection result according to the BGP routing characteristics; the analyzing device according to the abnormality of the routing The detection result analyzes the abnormality of the BGP update message.

Optionally, after the analysis device performs abnormal analysis on the BGP update message according to the target routing information, when the analysis device determines that the BGP update message is abnormal, the analysis device outputs the type of abnormal routing of the BGP update message.

Optionally, the route abnormality type includes one or more of route leakage, route hijacking, or route forgery.

In this application, by analyzing the routing abnormality type of the BGP update message output by the device, it can be viewed by the operation and maintenance personnel, so that the operation and maintenance personnel can quickly determine and maintain the abnormal routing event in the communication network, thereby ensuring the operational safety and reliability of the communication network sex.

Optionally, the analysis device may also send one or more of network-level BGP information, routing anomaly detection model, and message analysis configuration parameters to the network device. The network-level BGP information includes an AS centrality list and/or an AS identification list. The AS centrality list includes the centrality of each AS in the network, and the AS identification list includes the identity of the operator AS. The routing anomaly detection model is used to output routing anomaly detection results based on the input BGP routing characteristics. The message analysis configuration parameters include the size of the BGP update message analysis window.

In the third aspect, a routing abnormality detection device is provided. The device includes a plurality of functional modules, and the plurality of functional modules interact to implement the above-mentioned first aspect and the methods in various embodiments thereof. The multiple functional modules can be implemented based on software, hardware, or a combination of software and hardware, and the multiple functional modules can be combined or divided arbitrarily based on specific implementations.

In a fourth aspect, a routing abnormality detection device is provided. The device includes a plurality of functional modules, and the plurality of functional modules interact to implement the above-mentioned second aspect and the methods in various embodiments thereof. The multiple functional modules can be implemented based on software, hardware, or a combination of software and hardware, and the multiple functional modules can be combined or divided arbitrarily based on specific implementations.

In a fifth aspect, a routing anomaly detection system is provided, including: network equipment and analysis equipment;

The network equipment includes the routing abnormality detection device according to the third aspect, and the analysis equipment includes the routing abnormality detection device according to the fourth aspect.

In a sixth aspect, a network device is provided, including: a processor and a memory;

The memory is used to store a computer program, and the computer program includes program instructions;

The processor is configured to call the computer program to implement the routing abnormality detection method according to any one of the first aspect.

In a seventh aspect, an analysis device is provided, including: a processor and a memory;

The memory is used to store a computer program, and the computer program includes program instructions;

The processor is configured to call the computer program to implement the routing abnormality detection method according to any one of the second aspect.

In an eighth aspect, a computer storage medium is provided, the computer storage medium stores instructions, and when the instructions are executed by a processor of a network device, the routing anomaly detection method according to any one of the first aspects is implemented; When the instructions are executed by the processor of the analysis device, the routing abnormality detection method according to any one of the second aspect is implemented.

In a ninth aspect, a chip is provided. The chip includes a programmable logic circuit and/or program instructions. When the chip is running, the method in the first aspect and its embodiments or the method in the second aspect and its embodiments are implemented when the chip is running. Methods.

The beneficial effects brought about by the technical solution provided by this application include at least:

After receiving the BGP routing information, the network device determines the BGP routing feature corresponding to the BGP routing information, and sends the BGP routing feature and/or routing anomaly detection result to the analysis device. Because the BGP routing feature and the routing anomaly detection result are the same as the BGP update message Compared with, the amount of data is smaller, so the amount of data transmission between the network device and the analysis device is reduced, thereby reducing the network overhead. In addition, performing feature extraction and/or routing abnormality detection on the BGP update message on the network device side reduces the calculation amount of the analysis device and saves the calculation resources of the analysis device. Among them, the network device generates the routing anomaly detection result according to the BGP routing characteristics, and then sends the routing anomaly detection result to the analysis device, which can further reduce the calculation amount of the analysis device. In addition, by analyzing the routing abnormality type of the BGP update message output by the device, it can be viewed by the operation and maintenance personnel, so that the operation and maintenance personnel can quickly determine and maintain the abnormal routing event in the communication network, thereby ensuring the operational safety and reliability of the communication network.

Description of the drawings

FIG. 1 is a schematic structural diagram of a routing anomaly detection system provided by an embodiment of the present application;

FIG. 2 is a schematic flowchart of a routing anomaly detection method provided by an embodiment of the present application;

FIG. 3 is a flowchart of a method for network equipment to determine BGP routing characteristics according to an embodiment of the present application;

FIG. 4 is a schematic structural diagram of a routing anomaly detection device provided by an embodiment of the present application;

FIG. 5 is a schematic structural diagram of a routing anomaly detection device provided by another embodiment of the present application;

6 is a schematic structural diagram of another routing abnormality detection device provided by another embodiment of the present application;

FIG. 7 is a schematic structural diagram of yet another routing anomaly detection device provided by another embodiment of the present application;

Fig. 8 is a block diagram of a routing anomaly detection device provided by an embodiment of the present application.

Detailed ways

In order to make the purpose, technical solutions, and advantages of the present application clearer, the following further describes the embodiments of the present application in detail with reference to the accompanying drawings.

Fig. 1 is a schematic structural diagram of a routing anomaly detection system provided by an embodiment of the present application. As shown in Figure 1, the system includes an analysis device 101 and network devices 102a-102f (collectively referred to as network devices 102) in a communication network. Among them, the network device 102a belongs to AS1, the network device 102b and the network device 102c belong to AS2, the network device 102d belongs to AS3, the network device 102e belongs to AS4, and the network device 102f belongs to AS5. The number of network devices and the division method of ASs in FIG. 1 are only for illustration, and not as a limitation on the communication network provided in the embodiment of the present application.

Optionally, the analysis device 101 may be a server, or a server cluster composed of several servers, or a cloud computing service center. The network device 102 may be a router, a switch, or the like. The analysis device 101 and the network device 102 are connected through a wired network or a wireless network.

All network devices in the same AS are connected to each other, run the same routing protocol, and are assigned the same autonomous system number. The link between ASs uses an external routing protocol. For example, the communication network provided in the embodiment of the present application can run BGP, and the routes between ASs can be reached through BGP. The communication network running BGP can also be referred to as a BGP network. Optionally, the communication network may be a data center network (DCN), a metropolitan area network, a wide area network, a campus network, a virtual local area network (VLAN), or a virtual extended local area network (virtual extensive local area network). , VXLAN), etc. The embodiments of this application do not limit the type of communication network.

FIG. 2 is a schematic flowchart of a method for detecting routing anomaly according to an embodiment of the present application. This method can be applied to the routing anomaly detection system shown in Figure 1. As shown in Figure 2, the method includes:

Step 201: The analysis device sends one or more of network-level BGP information, routing anomaly detection model, and message analysis configuration parameters to the network device.

The network-level BGP information includes an AS centrality list and/or an AS identification list. The AS centrality list includes the centrality of each AS in the network. The centrality of an AS is used to reflect the importance of the AS in the communication network. The greater the centrality of the AS, the more important the position of the AS in the communication network. The AS identifier list includes the identifier of the operator AS. For example, the AS identification list includes the AS identification list of the Tier1 operator and/or the AS identification list of the Tier2 operator. Tier1 and Tier2 are data center infrastructure tiered certification standards defined in the data center telecommunication infrastructure standard (Telecommunications Infrastructure Standard for Data Centers), which will not be repeated in this embodiment of the application.

Illustratively, Table 1 shows an AS centrality list, and the AS centrality list includes the centralities of AS1-AS5 in the routing anomaly detection system shown in FIG. 1.

Table 1

AS logo

Centrality

AS1	0.1
AS2	0.3
AS3	0.4
AS4	0.2
AS5	0.1

Among them, the AS identifier may be an AS number (ASN), which is usually a globally unique 16-digit number.

The routing anomaly detection model is used to output routing anomaly detection results based on the input BGP routing characteristics. Optionally, the routing anomaly detection model is generated based on a decision tree algorithm, a gradient boosting decision tree (Gradient Boosting Decision Tree, GBDT) algorithm, and/or an extreme gradient boosting (eXtreme Gradient Boosting, XGBoost) algorithm.

For example, the analysis device uses a decision tree algorithm to generate a routing anomaly detection model. A decision tree is a tree structure, such as a binary tree or a non-binary tree, where each non-leaf node represents a test on a feature attribute, and each branch represents the test output of a feature attribute on a certain value range. Each leaf node stores a category. The process of using a decision tree to make a decision includes: starting from the root node, testing the corresponding feature attributes in the items to be classified, and selecting the output branch according to its value until reaching the leaf node, and using the category stored in the leaf node as the decision result. The items to be classified in the decision tree used to generate the routing anomaly detection model include BGP routing characteristics. The decision tree may include four leaf nodes, and the categories stored in the four leaf nodes are route normal, route leakage, route hijacking, and route forgery. The routing anomaly detection model can output four possible routing anomaly detection results according to the input BGP routing characteristics, including normal routing, routing leakage, routing hijacking, or routing forgery. Among them, route hijacking can also be called prefix hijacking. Alternatively, the decision tree may also include two leaf nodes, and the categories stored in the two leaf nodes are normal routing and abnormal routing. Then the routing anomaly detection model can output two possible routing anomaly detection results according to the input BGP routing characteristics, including normal routing or abnormal routing.

The message analysis configuration parameters include the size of the BGP update message analysis window. The size of the BGP update message analysis window is a positive integer. For example, the size of the BGP update message analysis window may be 5.

Optionally, the analysis device periodically sends one or more of network-level BGP information, routing anomaly detection model, and message analysis configuration parameters to the network device. Or, when the network-level BGP information is updated, the analysis device sends the updated network-level BGP information to the network device; when the routing anomaly detection model is updated, the analysis device sends the updated routing anomaly detection model to the network device; When the analysis configuration parameter is updated, the analysis device sends the updated message to the network device to analyze the configuration parameter.

Step 202: The network device receives the BGP update message.

BGP update messages are used to advertise routes. Optionally, the BGP update message includes the IP prefix announced by the target source AS that publishes the BGP update message, and the AS path from the target source AS to the AS where the network device is located. The IP prefix announced by the source AS is usually the network segment address.

For example, referring to the routing anomaly detection system shown in Figure 1, suppose the network device is a network device 102f belonging to AS5, the target source AS is AS1, the IP prefix announced by AS1 is 1.1.1.0/24, and the BGP update issued by AS1 After the message passes through AS2, AS3, and AS4 in turn, it reaches the network device 102f in AS5. The IP prefix carried in the BGP update message received by the network device 102f is 1.1.1.0/24, and the AS path is: AS1-AS2-AS3-AS4 -AS5.

Optionally, every time a network device receives a BGP update message, the BGP update message may be stored in the network device so as to be used for subsequent routing anomaly detection. By setting the upper limit value M in the network device, the network device can store up to M historical BGP update messages. For example, a queue of length M can be used to store historical BGP update messages. M is a positive integer greater than 1, such as M The value can be 100, which can avoid occupying too much memory resources. When the network device receives a new BGP update message, it can delete the oldest historical BGP update message that has been stored, and store the new BGP update message.

Step 203: The network device determines the BGP routing feature corresponding to the BGP update message.

Optionally, FIG. 3 is a flowchart of a method for a network device to determine BGP routing characteristics according to an embodiment of the present application. As shown in Figure 3, the method includes the following steps 2031 to 2034:

Step 2031. The network device obtains the target routing prefix and the target AS path according to the BGP update message.

The target routing prefix is the IP prefix announced by the target source AS that advertises the BGP update message, and the target AS path is the AS path from the target source AS to the AS where the network device is located.

For example, referring to the example in step 202, the foregoing target routing prefix is 1.1.1.0/24, and the target AS path is: AS1-AS2-AS3-AS4-AS5.

Step 2032. The network device obtains the historical BGP update message carrying the target routing prefix.

Optionally, the network device obtains one or more historical BGP update messages that carry the target route prefix from the historical BGP update messages stored by the network device. The number of historical BGP update messages carrying the target route prefix obtained by the network device can be determined according to the message analysis configuration parameters sent by the analysis device. For example, if the size of the BGP update message analysis window in the message analysis configuration parameter is 5, the network device obtains 5 Historical BGP update messages that carry the target route prefix. Alternatively, the network device may also obtain all historical BGP update messages stored in the network device that carry the target route prefix. The embodiment of the present application does not limit the number of historical BGP update messages that the network device obtains and carries the target routing prefix.

For example, referring to the example in step 2031, it is assumed that the network device obtains five historical BGP update messages carrying an IP prefix of 1.1.1.0/24. The AS paths carried in the 5 historical BGP update messages are: AS1-AS2-AS3-AS5, AS1-AS2-AS3-AS4-AS5, AS2-AS3-AS4-AS5, AS1-AS2-AS4-AS5 and AS2 -AS3-AS5.

Step 2033: The network device obtains the historical AS path according to the historical BGP update message.

The historical BGP update message includes the historical AS path from the source AS to the AS where the network device is located. In step 2033, that is, the network device obtains the historical AS path carried in the historical BGP update message. The historical AS path and the aforementioned target AS path may be referred to as the same prefix AS path.

For example, referring to the example in step 2032, the network device obtains 5 historical AS paths respectively according to 5 historical BGP update messages carrying the IP prefix of 1.1.1.0/24, including: AS1-AS2-AS3-AS5, AS1 -AS2-AS3-AS4-AS5, AS2-AS3-AS4-AS5, AS1-AS2-AS4-AS5 and AS2-AS3-AS5.

Step 2034: The network device determines the BGP routing characteristics according to the target AS path and the historical AS path.

Optionally, BGP routing features include one or more of the following: path similarity between the target AS path and the historical AS path, hegemonic similarity between the target AS path and the historical AS path, the rarity of the AS on the target AS path, and the target AS The rarity of the path, the number of source ASs that are different from the target source AS on the historical AS path, the occurrence probability of the target source AS, and the stability of the target source AS. The hegemonic similarity between the target AS path and the historical AS path is determined based on the centrality of each AS on the target AS path and the centrality of each AS on the historical AS path. The rarity of an AS is equal to the ratio of the number of occurrences of the AS in the historical AS path to the number of historical AS paths. The rarity of the target AS path is equal to the rarity of the target AS, and the target AS is the AS with the least rarity on the target AS path. The occurrence probability value of the target source AS is equal to the ratio of the number of occurrences of the target source AS in the historical AS path to the number of historical AS paths. The stability of the target source AS is negatively related to the number of source ASs that are different from the target source AS on the historical AS path, and is related to the neighbor AS of the AS where the network device is located on the historical AS path is different from the AS where the network device is located on the target AS path. The number of neighbor ASs is negatively correlated.

Among them, the path similarity between the target AS path and the historical AS path, the hegemonic similarity between the target AS path and the historical AS path, the rarity of the AS on the target AS path, and the rarity of the target AS path are mainly used to determine whether route leakage occurs. ; The number of source ASs that are different from the target source AS on the historical AS path, the occurrence probability of the target source AS, and the stability of the target source AS are mainly used to determine whether route hijacking occurs. Of course, the BGP routing feature may also include other related features that can reflect route leakage, route hijacking, and/or route forgery, which is not limited in the embodiment of the present application.

The following embodiments of the present application respectively illustrate the acquisition methods of the various BGP routing features described above.

In the first implementation manner, the BGP routing feature includes the path similarity between the target AS path and the historical AS path.

Optionally, the network device may separately calculate the path similarity between the target AS path and each acquired historical AS path (same prefix), or the network device may calculate the target AS path and the acquired last historical AS path (same prefix) The similarity of the path. Both the target AS path and the historical AS path can be represented by path vectors.

For example, referring to the example in step 2031 to step 2033, the path vector of the target AS path can be expressed as [AS1, AS2, AS3, AS4, AS5], and the path vector of the historical AS path AS2-AS3-AS5 can be expressed as [AS2 , AS3, AS5], in the embodiment of the present application, the similarity between the path vector of the target AS path and the path vector of the historical AS path is taken as the path similarity between the target AS path and the historical AS path.

In the second implementation manner, the BGP routing characteristics include the hegemonic similarity between the target AS path and the historical AS path.

Optionally, the network device may separately calculate the hegemonic similarity between the target AS path and each acquired historical AS path (same prefix), or the network device may calculate the target AS path and the acquired last historical AS path (same prefix) Similarity of the hegemony. The implementation process of step 2034 includes step S11 to step S13:

In step S11, the network device obtains a first centrality vector corresponding to the target AS path, where the first centrality vector includes the centrality of each AS on the target AS path.

Optionally, the network device obtains the centrality of each AS on the target AS path from the AS centrality list sent by the analysis device according to the identification of each AS on the target AS path, and generates the first centrality vector.

For example, referring to Table 1 and the examples in steps 2031 to 2033, the network device can obtain the centrality of AS1 on the target AS path as 0.1, the centrality of AS2 as 0.3, the centrality of AS3 as 0.4, and the centrality of AS4 as 0.2, the centrality of AS5 is 0.1, and the first centrality vector corresponding to the target AS path can be expressed as [0.1, 0.3, 0.4, 0.2, 0.1].

In step S12, the network device obtains a second centrality vector corresponding to the historical AS path, where the second centrality vector includes the centrality of each AS on the historical AS path.

Optionally, the network device obtains the centrality of each AS on the historical AS path from the AS centrality list sent by the analysis device according to the identifier of each AS on the historical AS path, and generates the second centrality vector.

For example, referring to Table 1 and the examples in steps 2031 to 2033, the network device can obtain the historical AS path AS2-AS3-AS5 where the centrality of AS2 is 0.3, the centrality of AS3 is 0.4, and the centrality of AS5 is 0.1. The second centrality vector corresponding to the historical AS path can be expressed as [0.3, 0.4, 0.1].

In step S13, the network device uses the similarity between the first centrality vector and the second centrality vector as the hegemonic similarity between the target AS path and the historical AS path.

For example, referring to the examples in step S11 and step S12, the hegemonic similarity between the target AS path and the historical AS path AS2-AS3-AS5 is the first centrality vector [0.1, 0.3, 0.4, 0.2, 0.1] and the second center The similarity of the degree vector [0.3, 0.4, 0.1].

In the third implementation, BGP routing characteristics include the rarity of ASs on the target AS path. The implementation process of step 2034 includes: the network device performs a rarity calculation process on the AS on the target AS path. The rarity calculation process includes: the network device determines the number of occurrences of the AS on the target AS path in the historical AS path; The ratio of the number of occurrences to the number of historical AS paths is taken as the rarity of the AS.

For example, referring to the example in step 2031 to step 2033, the network device obtains a total of 5 historical BGP update messages. The rarity of AS1 on the target AS path is equal to 3/5; the rarity of AS2 on the target AS path is equal to 1; the rarity of AS3 on the target AS path is equal to 4/5; the rarity of AS4 on the target AS path is equal to 3/5; the rarity of AS5 on the target AS path is equal to 1.

Optionally, when the network device receives the AS identifier list containing the identifier of the operator AS sent by the analysis device, the network device may execute the rarity calculation process on all the ASs on the target AS path except the operator AS. That is, the network device does not need to calculate the rarity of the operator AS in the target AS path. Optionally, the network device may set the rarity of the operator AS to 1.

In the fourth implementation, the BGP routing characteristics include the rarity of the target AS path. The implementation process of step 2034 includes: the network device regards the rarity of the target AS as the rarity of the target AS path, and the target AS is the AS with the least rarity on the target AS path.

Optionally, the network device first calculates the rarity of each AS on the target AS path, and then uses the rarity of the target AS with the smallest rarity as the rarity of the target AS path. For the calculation method of the rarity of each AS on the target AS path, reference may be made to the above-mentioned third implementation method, which will not be repeated in this embodiment of the application.

Illustratively, referring to the example in the third implementation manner above, the rarity of the target AS path is equal to 3/5.

In the fifth implementation manner, the BGP routing characteristics include the number of source ASs that are different from the target source AS on the historical AS path.

For example, referring to the example in step 2031 to step 2033, the network device obtains a total of 5 historical AS paths. The source AS of the 5 historical AS paths are AS1, AS1, AS2, AS1, and AS2, and the target source AS is AS1. The source AS on the 5 historical AS paths that are different from the target source AS only includes AS2, so the 5 historical AS paths The number of source ASs that differ from the target source AS on the historical AS path is 1.

In the sixth implementation manner, the BGP routing feature includes the occurrence probability value of the target source AS. The implementation process of step 2034 includes: the network device determines the number of occurrences of the target source AS in the historical AS path; the network device uses the ratio of the number of occurrences to the number of historical AS paths as the occurrence probability value of the target source AS.

For example, referring to the example in step 2031 to step 2033, the network device obtains a total of 5 historical AS paths. The number of occurrences of the target source AS in the 5 historical AS paths is 3, so the occurrence probability value of the target source AS is equal to 3/5.

In the seventh implementation, BGP routing features include the stability of the target source AS. The implementation process of step 2034 includes: the network device obtains the number of source ASs on the historical AS path that are different from the target source AS (abbreviated as: the first number); the network device obtains the neighbor AS on the historical AS path of the AS where the network device is located is different The number of neighbor ASs on the path of the target AS where the network device is located (abbreviated as the second number); the network device determines the stability of the target source AS according to the first number and the second number. Among them, the neighbor AS on the AS path where the network device is located refers to the previous AS on the AS path where the network device is located. For the process of obtaining the first quantity by the network device, reference may be made to the above-mentioned fifth implementation manner, and details are not described in the embodiment of the present application.

For example, referring to the example in step 2031 to step 2033, the network device obtains a total of 5 historical AS paths, the AS where the network device is located is AS5, and the neighbor ASs of the 5 historical AS paths where the network device is located are AS3 and AS4 respectively. , AS4, AS4, and AS3, the neighbor AS of the AS where the network device is located on the target AS path is AS4, and the neighbor AS of the AS where the network device is located on the 5 historical AS paths is different from the AS where the network device is located on the target AS path The neighbor AS only includes AS3, so the second number mentioned above is 1.

Step 204: The network device sends target routing information to the analysis device.

The target routing information includes BGP routing characteristics and/or routing anomaly detection results. The route anomaly detection result is obtained based on BGP routing characteristics, and the route anomaly detection result is used to indicate whether the BGP update message is normal or abnormal.

Optionally, the routing anomaly detection result may be represented by an identification value. For example, when the route anomaly detection result is 0, it means that the BGP update message is normal; when the route anomaly detection result is 1, it means that the BGP update message is abnormal. Of course, the routing abnormality detection result can also be represented by other numbers, letters, or character strings, which is not limited in the embodiment of the present application.

In the embodiment of the present application, after receiving the BGP routing information, the network device determines the BGP routing feature corresponding to the BGP routing information, and sends the BGP routing feature and/or the routing anomaly detection result to the analysis device, due to the BGP routing feature and routing anomaly detection As a result, compared with the BGP update message, the amount of data is smaller, so the amount of data transmission between the network device and the analysis device is reduced, thereby reducing the network overhead. In addition, performing feature extraction and/or routing abnormality detection on the BGP update message on the network device side reduces the calculation amount of the analysis device and saves the calculation resources of the analysis device.

Optionally, when the BGP update message is abnormal, the route anomaly detection result is also used to indicate the route anomaly type of the BGP update message. The route anomaly type includes one or more of route leakage, route hijacking, and route forgery. The abnormality type may also be other abnormality types, which are not limited in the embodiment of the present application. For example, when the route anomaly detection result is 1, it means the BGP update message is abnormal, and the route anomaly type is route leakage; when the route anomaly detection result is 2, it means the BGP update message is abnormal, and the route anomaly type is route hijacking; When the routing anomaly detection result is 3, it means the BGP update message is abnormal, and the routing anomaly type is route forgery; when the routing anomaly detection result is 4, it means the BGP update message is abnormal, and the routing anomaly type is route leakage and route hijacking; etc. .

Optionally, when the target routing information sent by the network device to the analysis device includes the route anomaly detection result, after determining the BGP routing feature corresponding to the BGP update message, the network device needs to first determine the routing anomaly detection result according to the BGP routing feature. The network device can determine the BGP update based on the path similarity between the target AS path and the historical AS path, the hegemonic similarity between the target AS path and the historical AS path, the rarity of the AS on the target AS path, and/or the rarity of the target AS path Whether the message has route leakage; the network device can also determine whether the BGP update message is routed according to the number of source ASs that are different from the target source AS on the historical AS path, the occurrence probability of the target source AS, and/or the stability of the target source AS hijack. For example, when the path similarity between the target AS path and the historical AS path is less than the path similarity threshold, the hegemonic similarity between the target AS path and the historical AS path is less than the hegemonic similarity threshold, and the rare degree of AS on the target AS path is lower than the AS When the rarity threshold and/or the rarity of the target AS path is lower than the AS path rarity threshold, the network device determines that the BGP update message is abnormal, and the route abnormality type of the BGP update message is route leakage. When the number of source ASs on the historical AS path that are different from the target source AS is greater than the target value, the occurrence probability of the target source AS is less than the probability threshold, and/or the stability of the target source AS is lower than the stability threshold, the network device determines the BGP The update message is abnormal, and the abnormal route type of the BGP update message is route hijacking.

Optionally, the network device adopts a decision tree algorithm, a GBDT algorithm, and/or an XGBoost algorithm to determine the routing anomaly detection result according to the above-mentioned BGP routing characteristics.

Optionally, when the network device receives the routing anomaly detection model sent by the analysis device, the process in which the network device generates routing anomaly detection results according to the BGP routing feature includes: the network device inputs the BGP routing feature to the routing anomaly detection model to obtain the route The routing anomaly detection result output by the anomaly detection model.

In the embodiment of the present application, the network device generates the routing anomaly detection result according to the BGP routing characteristics, and then sends the routing anomaly detection result to the analysis device, which can further reduce the calculation amount of the analysis device.

Optionally, the routing anomaly detection result also includes the IP prefix carried in the BGP update message.

Step 205: The analysis device performs abnormal analysis on the BGP update message according to the target routing information.

Optionally, when the target routing information includes the BGP routing feature, the implementation process of step 205 includes: the analysis device determines the routing abnormality detection result according to the BGP routing feature; the analysis device performs abnormal analysis on the BGP update message according to the routing abnormality detection result. The implementation process of the analysis device determining the route anomaly detection result according to the BGP routing feature can refer to the implementation process of the network device determining the routing anomaly detection result according to the BGP routing feature in step 204, which will not be repeated in this embodiment of the application.

For example, when the route anomaly detection result indicates that the BGP update message is abnormal, and the type of the route anomaly is route hijacking, the analysis device determines whether the target source AS has normally advertised the target route prefix based on the BGP database. If the target source AS has advertised the target routing prefix normally, the analysis device determines that the BGP update message is normal; if the target source AS has not advertised the target routing prefix normally, the analysis device determines that the BGP update message is abnormal, and the routing exception type is route hijacking .

Optionally, the BGP database of the analysis device includes one or more of an AS centrality list, an AS identification list, and received historical target routing information.

In the embodiment of the present application, when the routing abnormality detection result indicates that the BGP update message is abnormal, the analysis device can also perform fault location based on the BGP database and based on the target routing information.

Step 206: When the analysis device determines that the BGP update message is abnormal, the analysis device outputs the route abnormality type of the BGP update message.

Optionally, when the analysis device determines that the BGP update message is abnormal, the analysis device outputs the routing exception type of the BGP update message to the operations support system (OSS) or other terminal devices connected to the analysis device for the OSS or terminal Device display. Of course, if the analysis device itself has a display function, the analysis device can also directly display the routing exception type of the BGP update message on its display interface.

In the embodiment of the application, the abnormal routing type of the BGP update message output by the device is analyzed for the operation and maintenance personnel to view, so that the operation and maintenance personnel can quickly determine and maintain the abnormal routing event in the communication network, thereby ensuring the operational safety of the communication network And reliability.

The sequence of steps in the method for locating the root cause of the fault provided in the embodiment of the present application can be appropriately adjusted, and the steps can also be increased or decreased accordingly according to the situation, for example, step 201 may not be executed. Any person familiar with the technical field can easily think of a method of change within the technical scope disclosed in this application, which should be covered by the protection scope of this application, and therefore will not be repeated.

In summary, in the routing anomaly detection method provided by the embodiment of the present application, after receiving the BGP routing information, the network device determines the BGP routing characteristics corresponding to the BGP routing information, and sends the BGP routing characteristics and/or routes to the analysis device Anomaly detection results. Compared with BGP update messages, the data volume of BGP routing characteristics and routing anomaly detection results is smaller, which reduces the amount of data transmission between network equipment and analysis equipment, thereby reducing network overhead. In addition, performing feature extraction and/or routing abnormality detection on the BGP update message on the network device side reduces the calculation amount of the analysis device and saves the calculation resources of the analysis device. Among them, the network device generates the routing anomaly detection result according to the BGP routing characteristics, and then sends the routing anomaly detection result to the analysis device, which can further reduce the calculation amount of the analysis device. In addition, by analyzing the routing abnormality type of the BGP update message output by the device, it can be viewed by the operation and maintenance personnel, so that the operation and maintenance personnel can quickly determine and maintain the abnormal routing event in the communication network, thereby ensuring the operational safety and reliability of the communication network.

Fig. 4 is a schematic structural diagram of a routing abnormality detection device provided by an embodiment of the present application. The device can be applied to the network equipment 102 in the routing anomaly detection system shown in FIG. 1. As shown in Fig. 4, the device 40 includes:

The receiving module 401 is used to receive BGP update messages.

The processing module 402 is used to determine the BGP routing feature corresponding to the BGP update message.

The sending module 403 is used to send target routing information to the analysis device. The target routing information includes BGP routing features and/or routing anomaly detection results. The routing anomaly detection results are obtained based on the BGP routing features, and the routing anomaly detection results are used to indicate BGP update messages Normal or abnormal.

In summary, in the routing anomaly detection device provided by the embodiment of the present application, after receiving the BGP routing information through the receiving module, the network device determines the BGP routing characteristics corresponding to the BGP routing information through the processing module, and sends the BGP routing information to the analysis device through the sending module. Sending BGP routing characteristics and/or routing anomaly detection results. Compared with BGP update messages, BGP routing characteristics and routing anomaly detection results have a smaller amount of data, which reduces the amount of data transmission between network equipment and analysis equipment, thereby reducing Network overhead. In addition, performing feature extraction and/or routing abnormality detection on the BGP update message on the network device side reduces the calculation amount of the analysis device and saves the calculation resources of the analysis device.

Optionally, a processing module for:

According to the BGP update message, obtain the target routing prefix and the target AS path. The target routing prefix is the Internet Protocol IP prefix announced by the target source AS that advertises the BGP update message. The target AS path is the AS path from the target source AS to the AS where the network device is located. . Obtain historical BGP update messages that carry the target route prefix. Obtain historical AS paths according to historical BGP update messages. Determine BGP routing characteristics based on the target AS path and historical AS path.

Optionally, BGP routing features include one or more of the following:

The path similarity between the target AS path and the historical AS path; the hegemonic similarity between the target AS path and the historical AS path. The hegemonic similarity is determined based on the centrality of each AS on the target AS path and the centrality of each AS on the historical AS path; The rarity of the AS on the AS path, the rarity of the AS is equal to the ratio of the number of AS occurrences in the historical AS path to the number of historical AS paths; the rarity of the target AS path, the rarity of the target AS path is equal to the rarity of the target AS The target AS is the least rare AS on the target AS path; the number of source ASs that are different from the target source AS on the historical AS path; the occurrence probability value of the target source AS, the occurrence probability value is equal to the target source AS in the historical AS path The ratio of the number of occurrences to the number of historical AS paths; and the stability of the target source AS. The stability is negatively related to the number of source ASs on the historical AS path that are different from the target source AS, and is related to the AS where the network device is located in the historical AS path The number of neighbor ASs on the target AS path is negatively related to the number of neighbor ASs on the path where the network device is located.

Optionally, the BGP routing feature includes the hegemonic similarity between the target AS path and the historical AS path, and the processing module is configured to: obtain a first centrality vector corresponding to the target AS path, and the first centrality vector includes each of the target AS paths. The centrality of the AS; obtain the second centrality vector corresponding to the historical AS path, the second centrality vector includes the centrality of each AS on the historical AS path; the similarity between the first centrality vector and the second centrality vector Degree as the degree of hegemony similarity.

Optionally, the receiving module is also used to receive the AS centrality list sent by the analysis device, and the centrality list includes the centrality of each AS in the network; the processing module is also used to determine from the identity of each AS on the target AS path Obtain the centrality of each AS on the target AS path from the AS centrality list to generate the first centrality vector; the processing module is also used to obtain the historical AS path from the AS centrality list according to the identification of each AS on the historical AS path The centrality of each AS generates a second centrality vector.

Optionally, the BGP routing feature includes the rarity of the AS on the target AS path; the receiving module is also used to receive the AS identification list sent by the analysis device, and the AS identification list includes the operator's AS identification; the processing module is also used to Determine the rarity of other ASs on the target AS path except for the operator AS. The rarity of the AS on the target AS path is equal to the ratio of the number of AS occurrences in the historical AS path to the number of historical AS paths.

Optionally, the target routing information includes a routing anomaly detection result; the processing module is also used to determine the routing anomaly detection result according to the BGP routing characteristics.

Optionally, the receiving module is also used to receive the routing anomaly detection model sent by the analysis device; the processing module is also used to input BGP routing features to the routing anomaly detection model to obtain the routing anomaly detection result output by the routing anomaly detection model.

Optionally, when the BGP update message is abnormal, the route anomaly detection result is also used to indicate the route abnormality type of the BGP update message.

Optionally, the route abnormality type includes one or more of route leakage, route hijacking, or route forgery.

In summary, in the routing anomaly detection device provided by the embodiment of the present application, after receiving the BGP routing information through the receiving module, the network device determines the BGP routing characteristics corresponding to the BGP routing information through the processing module, and sends the BGP routing information to the analysis device through the sending module. Sending BGP routing characteristics and/or routing anomaly detection results. Compared with BGP update messages, BGP routing characteristics and routing anomaly detection results have a smaller amount of data, which reduces the amount of data transmission between network equipment and analysis equipment, thereby reducing Network overhead. In addition, performing feature extraction and/or routing abnormality detection on the BGP update message on the network device side reduces the calculation amount of the analysis device and saves the calculation resources of the analysis device. Among them, the network device generates the routing anomaly detection result according to the BGP routing characteristics, and then sends the routing anomaly detection result to the analysis device, which can further reduce the calculation amount of the analysis device.

Fig. 5 is a schematic structural diagram of a routing abnormality detection device provided by another embodiment of the present application. This device can be applied to the analysis device 101 in the routing anomaly detection system shown in FIG. 1. As shown in Fig. 5, the device 50 includes:

The receiving module 501 is configured to receive target routing information sent by a network device. The target routing information includes BGP routing characteristics and/or routing anomaly detection results corresponding to BGP update messages received by the network device. The routing anomaly detection results are obtained based on the BGP routing characteristics , The route anomaly detection result is used to indicate whether the BGP update message is normal or abnormal.

The processing module 502 is configured to perform abnormal analysis on the BGP update message according to the target routing information.

In summary, in the routing anomaly detection apparatus provided by the embodiment of the present application, after receiving the target routing information sent by the network device through the receiving module, the analysis device performs anomaly analysis on the BGP update message according to the target routing information through the processing module. Compared with the BGP update message, the data volume of the BGP routing feature and/or the abnormal routing detection result in the target routing information is smaller, so the data transmission volume between the network device and the analysis device is reduced, thereby reducing the network overhead. In addition, performing feature extraction and/or routing abnormality detection on the BGP update message on the network device side reduces the calculation amount of the analysis device and saves the calculation resources of the analysis device.

Optionally, the processing module is further configured to: determine the routing anomaly detection result according to the BGP routing characteristics; and perform an abnormal analysis on the BGP update message according to the routing anomaly detection result.

Optionally, as shown in FIG. 6, the apparatus 50 further includes:

The output module 503 is used for outputting the abnormal routing type of the BGP update message when the analysis device determines that the BGP update message is abnormal.

Optionally, the route abnormality type includes one or more of route leakage, route hijacking, or route forgery.

Optionally, as shown in FIG. 7, the apparatus 50 further includes:

The sending module 504 is used to send one or more of network-level BGP information, routing anomaly detection model, and message analysis configuration parameters to the network device. The network-level BGP information includes an AS centrality list and/or an AS identification list, and AS centrality The list includes the centrality of each AS in the network, the AS identification list includes the operator's AS identification, the routing anomaly detection model is used to output routing anomaly detection results based on the input BGP routing characteristics, and the message analysis configuration parameters include the BGP update message analysis window the size of.

In summary, in the routing anomaly detection apparatus provided by the embodiment of the present application, after receiving the target routing information sent by the network device through the receiving module, the analysis device performs anomaly analysis on the BGP update message according to the target routing information through the processing module. Compared with the BGP update message, the data volume of the BGP routing feature and/or the abnormal routing detection result in the target routing information is smaller, so the data transmission volume between the network device and the analysis device is reduced, thereby reducing the network overhead. In addition, performing feature extraction and/or routing abnormality detection on the BGP update message on the network device side reduces the calculation amount of the analysis device and saves the calculation resources of the analysis device. In addition, by analyzing the routing abnormality type of the BGP update message output by the device, it can be viewed by the operation and maintenance personnel, so that the operation and maintenance personnel can quickly determine and maintain the abnormal routing event in the communication network, thereby ensuring the operational safety and reliability of the communication network.

Regarding the device in the foregoing embodiment, the specific manner in which each module performs operation has been described in detail in the embodiment of the method, and detailed description will not be given here.

The embodiment of the present application also provides a routing anomaly detection system. Including: network equipment and analysis equipment. The network equipment includes the routing anomaly detection device as shown in FIG. 4, and the analysis equipment includes the routing anomaly detection device as shown in any one of FIGS. 5 to 7.

The embodiment of the present application provides a network device, including: a processor and a memory;

The memory is used to store a computer program, and the computer program includes program instructions;

The processor is configured to call the computer program to implement the steps executed by the network device in the above method embodiment.

The embodiment of the present application provides an analysis device, including: a processor and a memory;

The memory is used to store a computer program, and the computer program includes program instructions;

The processor is configured to call the computer program to implement the steps executed by the analysis device in the foregoing method embodiment.

Illustratively, FIG. 8 is a block diagram of a routing abnormality detection device provided by an embodiment of the present application. The routing abnormality detection device may be a network device or an analysis device. As shown in FIG. 8, the device 80 includes: a processor 801 and a memory 802.

The memory 802 is configured to store a computer program, where the computer program includes program instructions;

The processor 801 is configured to call the computer program to implement the steps performed by the network device or the steps performed by the analysis device in the foregoing method embodiments.

Optionally, the device 80 further includes a communication bus 803 and a communication interface 804.

The processor 801 includes one or more processing cores, and the processor 801 executes various functional applications and data processing by running a computer program.

The memory 802 can be used to store computer programs. Optionally, the memory may store an operating system and at least one application program unit required by the function. The operating system can be a real-time operating system (Real Time eXecutive, RTX), LINUX, UNIX, WINDOWS, or OS X.

There may be multiple communication interfaces 804, and the communication interface 804 is used to communicate with other storage devices or network devices. For example, in the embodiment of the present application, the communication interface 804 of the network device may be used to communicate with the analysis device. Optionally, the communication network may be a software defined network (software defined network, SDN) or a virtual extended local area network (virtual extensive local area network, VXLAN), etc. The network device can be a switch or router. The analysis device can be a server or cloud service.

The memory 802 and the communication interface 804 are respectively connected to the processor 801 through a communication bus 803.

The embodiment of the present application also provides a computer storage medium with instructions stored on the computer storage medium. When the instructions are executed by the processor of the network device, the steps performed by the network device in the above method embodiment are implemented; When the instructions are executed by the processor of the analysis device, the steps executed by the analysis device in the foregoing method embodiment are implemented.

A person of ordinary skill in the art can understand that all or part of the steps in the above embodiments can be implemented by hardware, or by a program to instruct relevant hardware. The program can be stored in a computer-readable storage medium. The storage medium mentioned can be a read-only memory, a magnetic disk or an optical disk, etc.

In the embodiments of the present application, the terms "first", "second" and "third" are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance.

The term "and/or" in this application is merely an association relationship describing associated objects, which means that there can be three types of relationships. For example, A and/or B can mean that there is A alone, and both A and B exist. There are three cases of B. In addition, the character "/" in this text generally indicates that the associated objects before and after are in an "or" relationship.

The above are only optional embodiments of this application and are not intended to limit this application. Any modification, equivalent replacement, improvement, etc. made within the concept and principle of this application shall be included in the protection of this application. Within range.

Claims (34)

1. A routing anomaly detection method, characterized in that the method includes:

   The network device receives the Border Gateway Protocol BGP update message;

   Determining, by the network device, the BGP routing feature corresponding to the BGP update message;

   The network device sends target routing information to the analysis device, the target routing information includes the BGP routing feature and/or routing anomaly detection result, the routing anomaly detection result is obtained based on the BGP routing feature, the routing anomaly The detection result is used to indicate that the BGP update message is normal or abnormal.
2. The method according to claim 1, wherein the determining, by the network device, the BGP routing feature corresponding to the BGP update message comprises:

   The network device obtains a target routing prefix and a target autonomous system AS path according to the BGP update message, the target routing prefix is the Internet Protocol IP prefix announced by the target source AS that advertises the BGP update message, and the target AS path is the slave The AS path from the target source AS to the AS where the network device is located;

   Acquiring, by the network device, a historical BGP update message carrying the target routing prefix;

   The network device obtains the historical AS path according to the historical BGP update message;

   The network device determines the BGP routing feature according to the target AS path and the historical AS path.
3. The method according to claim 2, wherein the BGP routing feature includes one or more of the following:

   The path similarity between the target AS path and the historical AS path;

   Hegemonic similarity between the target AS path and the historical AS path, where the hegemonic similarity is determined based on the centrality of each AS on the target AS path and the centrality of each AS on the historical AS path;

   The rarity of the AS on the target AS path, where the rarity of the AS is equal to the ratio of the number of occurrences of the AS in the historical AS path to the number of the historical AS path;

   The rarity of the target AS path, the rarity of the target AS path is equal to the rarity of the target AS, and the target AS is the AS with the least rarity on the target AS path;

   The number of source ASs that are different from the target source AS on the historical AS path;

   The occurrence probability value of the target source AS, where the occurrence probability value is equal to the ratio of the number of occurrences of the target source AS in the historical AS path to the number of the historical AS paths;

   And the stability of the target source AS, the stability is negatively related to the number of source ASs on the historical AS path that are different from the target source AS, and is related to the AS where the network device is located on the historical AS path The number of neighbor ASs on the path of the target AS that is different from the AS where the network device is located is negatively correlated.
4. The method according to claim 2 or 3, wherein the BGP routing feature includes the hegemonic similarity between the target AS path and the historical AS path, and the network device is based on the target AS path and the historical AS path. The historical AS path to determine the BGP routing characteristics includes:

   Acquiring, by the network device, a first centrality vector corresponding to the target AS path, where the first centrality vector includes the centrality of each AS on the target AS path;

   Acquiring, by the network device, a second centrality vector corresponding to the historical AS path, where the second centrality vector includes the centrality of each AS on the historical AS path;

   The network device uses the similarity between the first centrality vector and the second centrality vector as the hegemonic similarity.
5. The method according to claim 4, characterized in that, before the network device determines the BGP routing characteristics according to the target AS path and the historical AS path, the method further comprises:

   The network device receives the AS centrality list sent by the analysis device, where the centrality list includes the centrality of each AS in the network;

   The acquiring, by the network device, the first centrality vector corresponding to the target AS path includes:

   The network device obtains the centrality of each AS on the target AS path from the AS centrality list according to the identifier of each AS on the target AS path, and generates the first centrality vector;

   The acquiring, by the network device, the second centrality vector corresponding to the historical AS path includes:

   The network device obtains the centrality of each AS on the historical AS path from the AS centrality list according to the identifier of each AS on the historical AS path, and generates the second centrality vector.
6. The method according to any one of claims 2 to 5, wherein the BGP routing feature includes the rarity of the AS on the target AS path, and the network device is based on the target AS path and the history Before determining the AS path, the method further includes:

   The network device receives the AS identification list sent by the analysis device, and the AS identification list includes the operator AS identification;

   The network device determining the BGP routing feature according to the target AS path and the historical AS path includes:

   The network device determines the rarity of other ASs on the target AS path except the operator AS, and the rarity of the AS on the target AS path is equal to the number of occurrences of the AS in the historical AS path The ratio to the number of historical AS paths.
7. The method according to any one of claims 1 to 6, wherein the target routing information includes the routing anomaly detection result, and after the network device determines the BGP routing feature corresponding to the BGP update message, The method also includes:

   The network device determines the route anomaly detection result according to the BGP route characteristic.
8. The method according to claim 7, wherein the method further comprises:

   Receiving, by the network device, a routing anomaly detection model sent by the analysis device;

   The network device generating the routing anomaly detection result according to the BGP routing feature includes:

   The network device inputs the BGP routing feature to the routing anomaly detection model to obtain the routing anomaly detection result output by the routing anomaly detection model.
9. The method according to any one of claims 1 to 8, wherein when the BGP update message is abnormal, the route anomaly detection result is further used to indicate the route abnormality type of the BGP update message.
10. The method according to claim 9, wherein the type of abnormal routing includes one or more of routing leakage, routing hijacking, or routing forgery.
11. A routing anomaly detection method, characterized in that the method includes:

    The analysis device receives the target routing information sent by the network device, where the target routing information includes the BGP routing characteristics and/or the routing anomaly detection result corresponding to the Border Gateway Protocol BGP update message received by the network device, and the routing anomaly detection result Obtained based on the BGP routing feature, the routing anomaly detection result is used to indicate that the BGP update message is normal or abnormal;

    The analysis device performs abnormal analysis on the BGP update message according to the target routing information.
12. The method according to claim 11, wherein the target routing information includes the BGP routing feature, and the analysis device performs abnormal analysis on the BGP update message according to the target routing information, comprising:

    The analysis device determines the route anomaly detection result according to the BGP route characteristic;

    The analysis device performs abnormal analysis on the BGP update message according to the routing abnormality detection result.
13. The method according to claim 11 or 12, wherein after the analysis device performs an abnormal analysis on the BGP update message according to the target routing information, the method further comprises:

    When the analysis device determines that the BGP update message is abnormal, the analysis device outputs the route abnormality type of the BGP update message.
14. The method according to any one of claims 11 to 13, wherein the type of route abnormality includes one or more of route leakage, route hijacking, or route forgery.
15. The method according to any one of claims 11 to 14, wherein the method further comprises:

    The analysis device sends one or more of network-level BGP information, a routing anomaly detection model, and message analysis configuration parameters to the network device, and the network-level BGP information includes an autonomous system AS centrality list and/or an AS identification list The AS centrality list includes the centrality of each AS in the network, the AS identification list includes the identifier of the operator AS, and the routing anomaly detection model is used to output routing anomaly detection results based on the input BGP routing characteristics, The message analysis configuration parameter includes the size of the BGP update message analysis window.
16. A routing abnormality detection device, which is characterized in that it is used in network equipment, and the device includes:

    The receiving module is used to receive the Border Gateway Protocol BGP update message;

    A processing module, configured to determine the BGP routing feature corresponding to the BGP update message;

    The sending module is configured to send target routing information to the analysis device, where the target routing information includes the BGP routing feature and/or routing anomaly detection result, the routing anomaly detection result is obtained based on the BGP routing feature, the routing The abnormality detection result is used to indicate that the BGP update message is normal or abnormal.
17. The device according to claim 16, wherein the processing module is configured to:

    According to the BGP update message, a target routing prefix and a target autonomous system AS path are obtained. The target routing prefix is the Internet Protocol IP prefix announced by the target source AS that advertises the BGP update message, and the target AS path is from the target source AS path from the AS to the AS where the network device is located;

    Acquiring historical BGP update messages carrying the target routing prefix;

    Obtaining the historical AS path according to the historical BGP update message;

    The BGP routing feature is determined according to the target AS path and the historical AS path.
18. The apparatus according to claim 17, wherein the BGP routing feature comprises one or more of the following:

    The path similarity between the target AS path and the historical AS path;

    Hegemonic similarity between the target AS path and the historical AS path, where the hegemonic similarity is determined based on the centrality of each AS on the target AS path and the centrality of each AS on the historical AS path;

    The rarity of the AS on the target AS path, where the rarity of the AS is equal to the ratio of the number of occurrences of the AS in the historical AS path to the number of the historical AS path;

    The rarity of the target AS path, the rarity of the target AS path is equal to the rarity of the target AS, and the target AS is the AS with the least rarity on the target AS path;

    The number of source ASs that are different from the target source AS on the historical AS path;

    The occurrence probability value of the target source AS, where the occurrence probability value is equal to the ratio of the number of occurrences of the target source AS in the historical AS path to the number of the historical AS paths;

    And the stability of the target source AS, the stability is negatively related to the number of source ASs on the historical AS path that are different from the target source AS, and is related to the AS where the network device is located on the historical AS path The number of neighbor ASs on the path of the target AS that is different from the AS where the network device is located is negatively correlated.
19. The device according to claim 17 or 18, wherein the BGP routing feature includes hegemonic similarity between the target AS path and the historical AS path, and the processing module is configured to:

    Acquiring a first centrality vector corresponding to the target AS path, where the first centrality vector includes the centrality of each AS on the target AS path;

    Acquiring a second centrality vector corresponding to the historical AS path, where the second centrality vector includes the centrality of each AS on the historical AS path;

    The similarity between the first centrality vector and the second centrality vector is used as the hegemonic similarity.
20. The device of claim 19, wherein:

    The receiving module is further configured to receive an AS centrality list sent by the analysis device, where the centrality list includes the centrality of each AS in the network;

    The processing module is further configured to obtain the centrality of each AS on the target AS path from the AS centrality list according to the identifier of each AS on the target AS path, and generate the first centrality vector;

    The processing module is further configured to obtain the centrality of each AS on the historical AS path from the AS centrality list according to the identifier of each AS on the historical AS path, and generate the second centrality vector.
21. The apparatus according to any one of claims 17 to 20, wherein the BGP routing characteristic comprises the rarity of the AS on the path of the target AS;

    The receiving module is further configured to receive an AS identification list sent by the analysis device, where the AS identification list includes an operator's AS identification;

    The processing module is further configured to determine the rarity of other ASs on the target AS path except the operator AS, and the rarity of the AS on the target AS path is equal to the AS’s in the historical AS path The ratio of the number of occurrences in to the number of historical AS paths.
22. The device according to any one of claims 16 to 21, wherein the target routing information includes the routing anomaly detection result;

    The processing module is further configured to determine the routing anomaly detection result according to the BGP routing feature.
23. The device of claim 22, wherein:

    The receiving module is further configured to receive the routing anomaly detection model sent by the analysis device;

    The processing module is further configured to input the BGP routing feature to the routing anomaly detection model to obtain the routing anomaly detection result output by the routing anomaly detection model.
24. The apparatus according to any one of claims 16 to 23, wherein when the BGP update message is abnormal, the route anomaly detection result is further used to indicate the route abnormality type of the BGP update message.
25. The device according to claim 24, wherein the type of abnormal routing includes one or more of routing leakage, routing hijacking, or routing forgery.
26. A routing abnormality detection device, which is characterized in that it is used for analyzing equipment, and the device includes:

    The receiving module is configured to receive target routing information sent by a network device, where the target routing information includes the BGP routing characteristics and/or routing abnormality detection results corresponding to the Border Gateway Protocol BGP update message received by the network device, the routing An anomaly detection result is obtained based on the BGP routing feature, and the routing anomaly detection result is used to indicate that the BGP update message is normal or abnormal;

    The processing module is configured to perform abnormal analysis on the BGP update message according to the target routing information.
27. The device according to claim 26, wherein the target routing information includes the BGP routing feature, and the processing module is further configured to:

    Determine the routing anomaly detection result according to the BGP routing feature;

    Perform abnormal analysis on the BGP update message according to the routing abnormality detection result.
28. The device according to claim 26 or 27, wherein the device further comprises:

    The output module is configured to output the abnormal route type of the BGP update message when the analysis device determines that the BGP update message is abnormal.
29. The device according to any one of claims 26 to 28, wherein the type of route abnormality includes one or more of route leakage, route hijacking, or route forgery.
30. The device according to any one of claims 26 to 29, wherein the device further comprises:

    The sending module is used to send one or more of network-level BGP information, routing anomaly detection model, and message analysis configuration parameters to the network device, where the network-level BGP information includes an autonomous system AS centrality list and/or AS identification List, the AS centrality list includes the centrality of each AS in the network, the AS identification list includes the operator AS identification, and the routing anomaly detection model is used to output routing anomaly detection results based on the input BGP routing characteristics , The message analysis configuration parameter includes the size of the BGP update message analysis window.
31. A routing anomaly detection system, which is characterized by comprising: network equipment and analysis equipment;

    The network equipment includes the routing abnormality detection device according to any one of claims 16 to 25, and the analysis equipment includes the routing abnormality detection device according to any one of claims 26 to 30.
32. A network device, characterized by comprising: a processor and a memory;

    The memory is used to store a computer program, and the computer program includes program instructions;

    The processor is configured to call the computer program to implement the routing abnormality detection method according to any one of claims 1 to 10.
33. An analysis device, characterized by comprising: a processor and a memory;

    The memory is used to store a computer program, and the computer program includes program instructions;

    The processor is configured to call the computer program to implement the routing abnormality detection method according to any one of claims 11 to 15.
34. A computer storage medium, characterized in that instructions are stored on the computer storage medium, and when the instructions are executed by a processor of a network device, the routing abnormality detection method according to any one of claims 1 to 10 is implemented; When the instructions are executed by the processor of the analysis device, the routing abnormality detection method according to any one of claims 11 to 15 is realized.

Images