IP network routing security rapid detection method and routing analysis server

Abstract

The present invention relates to a method for fast detection of IP network routing security and a routing analysis server. The method includes: the routing analysis server counts the number of routes originating from each source AS in the BGP routing table of the entire network in real time, and calculates the number of routes according to the calculated number of routes and the pre-calculated Calculate the class variance of the number of routes originating from each source AS based on the historical statistical average value of the number of routes in each source AS; respectively compare the class variance of the number of routes in each source AS with the preset threshold, and judge each source according to the comparison result Whether there is abnormal fluctuation in the route sent by the AS, and determine the source AS of the abnormal route fluctuation. The present invention analyzes the abnormal fluctuations of routes by calculating the class variance of the number of routes originating from each source AS, not only can quickly and accurately locate the source of route fluctuations, but also has a high accuracy rate of analysis results due to relatively obvious statistical characteristics, making up for existing The analysis ability of the detection method in terms of accurate positioning and statistical characteristics is insufficient.

Description

technical field [0001] The invention relates to the field of network security, in particular to a fast detection method for IP network routing security and a routing analysis server. Background technique [0002] In an IP network, various factors such as line instability, routing attacks, routing interface hardware problems, and human operations may cause abnormal routing fluctuations in the network. Such fluctuations will cause network instability and lead to A large number of routers need to recalculate routes, resulting in a large waste of bandwidth and CPU resources. [0003] In order to avoid and reduce the impact of abnormal routing fluctuations, it is necessary to detect abnormal routing fluctuations in the network. Existing routing anomaly fluctuation detection methods are judged by recording the curve changes of Internet routing entries, see figure 1 As shown, it specifically includes the following steps: [0004] Step 101, learning to receive Internet routes; ...

AI Technical Summary

Problems solved by technology

[0009] In the above method for detecting abnormal routing fluctuations, the Internet routing entries are not obvious as a statistical feature, and cannot accurately reflect the routing fluctuations, and it is difficult to accurately locate the source of abnormal routing fluctuations

Images