Border gateway protocol anomaly detection method and device and computer equipment

Abstract

The invention relates to the technical field of border gateway protocol anomaly detection, and discloses a border gateway protocol anomaly detection method and device and computer device.According to the border gateway protocol anomaly detection method and device, to-be-detected BGP data are obtained, the to-be-detected BGP data are each type of data in multiple types of BGP data, and the to-be-detected BGP data are formed through preprocessing; extracting the to-be-tested BGP data from the to-be-tested BGP data, and fusing the to-be-tested BGP data of the plurality of BGP data; inputting the fused to-be-detected BGP data into a BGP time convolutional network for detection, and obtaining an anomaly detection result of the to-be-detected BGP data; finally, according to the embodiment of the invention, the long-time sequence characteristics of the BGP data can be processed, and the long-term dependency relationship of the BGP data can be captured, so that the accuracy of BGP data anomaly detection is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of border gateway protocol anomaly detection, and in particular to a border gateway protocol anomaly detection method, device and computer equipment. Background Art

[0002] Network security is an important pillar to ensure the security of cyberspace, and the security of network infrastructure is the basis for ensuring the reliable operation of the network. In order to ensure the safe conduct of various activities in the network, various network security detection measures provide secure communication guarantees. In cyberspace, routing systems and domain name systems are important network infrastructures. Their safe and reliable operation is the basis and prerequisite for ensuring the safe conduct of various network activities.

[0003] The Border Gateway Protocol (BGP) is a distance vector routing protocol that makes routes between autonomous systems (AS) reachable and selects the best route. According to the consequences of the event, BGP anomalies can be divided into data flow hijacking anomalies and update message surge anomalies. Data flow hijacking anomalies will cause the redirection of the victim network data flow, forming a traffic black hole, etc., which will destroy the reachability of the victim network. The update message surge anomaly will cause a large number of BGP update messages to be generated in a very short time, destroying the stability of the global Internet. Therefore, it is very important to detect anomalies in BGP.

[0004] In the related technology, the method of using traditional neural network structures to detect anomalies in BGP data, for example, using recurrent neural networks, long short-term memory networks, and naive Bayesian networks, is used to detect anomalies in BGP data. However, since these networks cannot process long time series data and capture long-term dependencies of data, there are certain limitations in the anomaly detection of BGP data. Summary of the invention

[0005] In view of this, the present invention provides a border gateway protocol anomaly detection method, apparatus and computer equipment to solve the problem that anomaly detection of BGP data has certain limitations.

[0006] According to a first aspect, an embodiment of the present disclosure provides a border gateway protocol anomaly detection method, the method comprising:

[0007] Acquire the BGP data to be tested, wherein the BGP data to be tested is each type of data among the multiple types of BGP data, and the BGP data to be tested is pre-processed;

[0008] Extract the BGP data to be tested from the BGP data to be tested, and merge the BGP data to be tested of multiple BGP data;

[0009] The fused BGP data to be tested is input into the BGP time convolution network for detection to obtain the anomaly detection result of the BGP data to be tested; wherein, the BGP time convolution network is pre-trained, and after the BGP data to be tested is transmitted to the input layer, a convolution operation is performed on the time dimension through multiple time series convolution layers to capture the time series pattern in the time series data and the BGP data to be tested, and a self-attention layer is added after each time series convolution layer to perform weighted summation on the output of the time series convolution layer, and multiple time series convolution layers and a jump connection form a residual structure, and the residual structure includes multiple residual blocks. The jump connection directly adds the input to the output of the residual structure to transfer the dependency relationship of the BGP data to be tested, and the output of the residual structure is subjected to global average pooling or a fully connected layer to obtain the anomaly detection result of the BGP data to be tested.

[0010] By executing the above implementation methods in the disclosed embodiment, the disclosed embodiment can ultimately process the long time series characteristics of BGP data and capture the long-term dependencies of BGP data, thereby improving the accuracy of BGP data anomaly detection.

[0011] In some optional implementations, the various BGP data include: network traffic data, log data, and system call data.

[0012] In some optional implementations, extracting the BGP data to be tested from the BGP data to be tested includes:

[0013] If the BGP data to be tested is network traffic data, at least one of the following features is extracted from the network traffic data: average traffic and peak traffic.

[0014] In some optional implementations, extracting the BGP data to be tested from the BGP data to be tested includes:

[0015] If the BGP data to be tested is log data, at least one of the following features is extracted from the log data: a keyword and an event occurrence frequency.

[0016] In some optional implementations, extracting the BGP data to be tested from the BGP data to be tested includes:

[0017] If the BGP data to be tested is system call data, at least one of the following features is extracted from the system call data: call frequency and common call sequence.

[0018] In some optional implementations, before obtaining the BGP data to be tested, the method includes:

[0019] Obtain the historical training dataset, historical validation dataset, and historical test dataset for training the BGP temporal convolutional network.

[0020] According to a second aspect, an embodiment of the present disclosure provides a border gateway protocol anomaly detection device, the device comprising:

[0021] An acquisition module is used to acquire BGP data to be tested, wherein the BGP data to be tested is each type of data among the multiple types of BGP data, and the BGP data to be tested is obtained through pre-processing;

[0022] An extraction module is used to extract the BGP data to be tested from the BGP data to be tested, and to fuse the BGP data to be tested of multiple BGP data;

[0023] The detection module is used to input the fused BGP data to be tested into the BGP time convolution network for detection, and obtain the abnormal detection result of the BGP data to be tested; wherein, the BGP time convolution network is pre-trained, and after the BGP data to be tested is transmitted to the input layer, a convolution operation is performed on the time dimension through multiple time series convolution layers to capture the time series pattern and the BGP data to be tested in the time series data, and a self-attention layer is added after each time series convolution layer to perform weighted summation on the output of the time series convolution layer, and multiple time series convolution layers and a jump connection form a residual structure, and the residual structure includes multiple residual blocks. The jump connection directly adds the input to the output of the residual structure to transfer the dependency relationship of the BGP data to be tested. After the output of the residual structure passes through the global average pooling or the fully connected layer, the abnormal detection result of the BGP data to be tested is obtained.

[0024] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the above-mentioned first aspect or any corresponding embodiment thereof in some optional embodiments by executing the computer instructions.

[0025] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the border gateway protocol anomaly detection method of the first aspect or any corresponding embodiment thereof.

[0026] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions for causing a computer to execute the border gateway protocol anomaly detection method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0028] Figure 1 is a flow chart of a border gateway protocol anomaly detection method according to an embodiment of the present invention;

[0029] Figure 2 is a structural block diagram of a BGP time convolution network according to an embodiment of the present invention;

[0030] Figure 3 is a structural diagram of online detection and offline training of a BGP temporal convolutional network according to an embodiment of the present invention;

[0031] Figure 4 is a structural block diagram of a border gateway protocol anomaly detection device according to an embodiment of the present invention;

[0032] Figure 5 Schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0034] According to an embodiment of the present invention, an embodiment of a border gateway protocol anomaly detection method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0035] Border Gateway Protocol (BGP) is a distance vector routing protocol that implements reachable routes between autonomous systems (AS) and selects the best route. BGP uses TCP as the transport layer protocol (port number is 179). The working principle of BGP is to establish and maintain the routing table by exchanging routing information. Each autonomous system is equipped with one or more BGP routers, which exchange routing information through TCP connections. BGP routers pass the routing information they know to adjacent BGP routers and receive routing information from adjacent routers. By comparing the attributes and policies of each routing information, BGP routers select the best routing path and add it to their own routing table. The global Internet is composed of interconnected networks of different regions and sizes. For a long time, networks have established network interconnection relationships by announcing route reachability information through the Border Gateway Protocol (BGP). However, with the high degree of interconnection between networks, the impact of the lack of a trusted routing authentication mechanism in the BGP protocol has become increasingly obvious. Therefore, routers are exposed to a variety of network attacks, resulting in abnormal events in BGP data, which in turn affects the connectivity and security of the network.

[0036] In the related art, the method of using traditional neural network structures to detect anomalies in BGP data, for example, using recurrent neural networks, long short-term memory networks, and naive Bayesian networks, is used to detect anomalies in BGP data. However, since these networks cannot process long time series data and capture long-term dependencies of data, there are certain limitations in the anomaly detection of BGP data.

[0037] In view of this, this embodiment provides a border gateway protocol anomaly detection method, which can be used for computer devices, such as mobile phones, tablet computers, desktop computers, portable notebooks, servers, etc. Figure 1 As shown, the process includes the following steps:

[0038] Step S101, obtaining BGP data to be tested, wherein the BGP data to be tested is each type of data among multiple types of BGP data, and the BGP data to be tested is pre-processed.

[0039] In a specific example, the various BGP data include: network traffic data, log data, and system call data.

[0040] Specifically, network traffic data includes: network traffic data packet data, average routing path length, longest routing path length, number of gateway protocol data packets, source IP address, and destination IP address. Log data includes: system events, error messages, and user login information. System call data includes: application request data for the operating system, file operation data, and process management data.

[0041] Here, it is equivalent to collecting multimodal data of the border gateway from the network layer. Among them, network traffic data refers to the traffic data related to traffic collected from the network layer, log data refers to the data recording the event status, and system call data refers to the data calling the application.

[0042] Step S102, extracting the BGP data to be tested from the BGP data to be tested, and fusing the BGP data to be tested of the multiple BGP data.

[0043] In some optional implementations, extracting the BGP data to be tested from the BGP data to be tested includes:

[0044] Extracting the BGP data to be tested from the BGP data to be tested includes: if the BGP data to be tested is network flow data, extracting at least one of the following features from the network flow data: average flow, peak flow. Extracting the BGP data to be tested from the BGP data to be tested includes: if the BGP data to be tested is log data, extracting at least one of the following features from the log data: keywords, event occurrence frequency.

[0045] In some optional implementations, extracting the BGP data to be tested from the BGP data to be tested includes: if the BGP data to be tested is system call data, extracting at least one of the following features from the system call data: call frequency, common call sequence.

[0046] Step S103, input the fused BGP data to be tested into the BGP time convolution network for detection, and obtain the anomaly detection result of the BGP data to be tested; wherein, the BGP time convolution network is pre-trained, and after the BGP data to be tested is transmitted to the input layer, a convolution operation is performed on the time dimension through multiple time series convolution layers to capture the time series pattern and the BGP data to be tested in the time series data, and a self-attention layer is added after each time series convolution layer to perform weighted summation on the output of the time series convolution layer, and multiple time series convolution layers and a jump connection form a residual structure, and the residual structure includes multiple residual blocks. The jump connection directly adds the input to the output of the residual structure to transfer the dependency relationship of the BGP data to be tested. After the output of the residual structure passes through the global average pooling or the fully connected layer, the anomaly detection result of the BGP data to be tested is obtained.

[0047] like Figure 2As shown, it is a schematic diagram of the structure of the BGP time convolution network in the embodiment of the present disclosure. In Figure 2, the input layer receives time series data as input. The time series convolution layer is the core part of the BGP time convolution network, which consists of multiple time series convolution layers, each of which contains a one-dimensional convolution layer and a nonlinear activation function. The function of the time series convolution layer is to perform convolution operations in the time dimension to capture the time series patterns and features in the time series data. The self-attention layer is added after each convolution layer of the BGP time convolution network. The self-attention layer performs weighted summation on the output of the convolution layer according to the importance of the input sequence, highlighting important BGP messages. The residual block is to enhance the depth and feature expression ability of the BGP time convolution network. The BGP time convolution network introduces residual connections. Each residual block consists of multiple time series convolution layers and a jump connection. The jump connection directly adds the input to the output of the residual block, so that the BGP time convolution network can better transfer gradients and learn long-term dependencies. In the output layer, the output of the last residual block is processed by global average pooling or a fully connected layer to obtain the final prediction result.

[0048] The disclosed embodiment mainly uses various software (such as wireshark, Netflow, log collection tools, etc.) to collect BGP data to be tested from the network layer. The network layer data refers to data closely related to specific network activities. The commonly used BGP data to be tested refers to network traffic data, log data, and system call data. The BGP data to be tested is further feature extracted. For example, multiple features such as source IP, destination IP, average routing path length, longest routing path length, and number of gateway protocol packets (number of IGP packets) are extracted from the network traffic data packet data of the BGP data to be tested. In addition, the time series characteristics of the BGP data to be tested and the randomness of the network traffic are further considered, and these features are converted into time series data for subsequent anomaly detection. The disclosed embodiment builds a BGP time convolutional network including multiple BGP time convolutional networks and a self-attention layer. The self-attention layer performs weighted summation on the outputs of multiple time series convolutional layers according to the importance of the input sequence, thereby highlighting important BGP messages, and then capturing long-term dependencies and abnormal patterns in the time series. In addition, the BGP time convolutional network performs multiple iterative learning on a large amount of data, and continuously optimizes the network parameters of the neural network by minimizing the loss function value, thereby improving the accuracy of the BGP time convolutional network in detecting the BGP data to be tested. Using the trained BGP time convolutional network, anomaly detection is performed on the BGP data to be tested to determine whether there are any anomalies in the BGP data to be tested, and finally, according to the anomaly detection results, corresponding alarms are generated or corresponding measures are taken to deal with them.

[0049] Therefore, the border gateway protocol anomaly detection method in the embodiment of the present invention obtains BGP data to be tested, wherein the BGP data to be tested is each type of data in a plurality of BGP data, and the BGP data to be tested is pre-processed; the BGP data to be tested is extracted from the BGP data to be tested, and the BGP data to be tested of the plurality of BGP data are fused; the fused BGP data to be tested is input into the BGP time convolution network for detection, and an anomaly detection result of the BGP data to be tested is obtained; finally, the embodiment of the present invention can process the long time series characteristics of the BGP data and capture the long-term dependency of the BGP data, thereby improving the accuracy of BGP data anomaly detection.

[0050] In some optional implementations, the pre-processing process of the BGP data to be tested includes: removing abnormal values ​​or missing values, or compression, or filtering.

[0051] For example, when the network traffic is large during peak hours, data compression and fragmentation technology can be introduced to compress and fragment the traffic data, reduce the amount of data transmitted over the network and the delay time, and improve the data processing speed and efficiency. At the same time, the compressed data can be decompressed and reorganized to restore the original data stream and ensure data integrity and accuracy. In addition, when facing large-scale DDoS attacks, traffic speed limiting and filtering technology can be introduced to limit and filter the traffic, filter out abnormal traffic, and ensure the transmission and processing of normal traffic. At the same time, the abnormal traffic can be deeply analyzed and processed to prevent further attacks by attackers.

[0052] In some optional implementations, the method further includes: before obtaining the BGP data to be tested, further including:

[0053] Obtain the historical training dataset, historical validation dataset, and historical test dataset for training the BGP temporal convolutional network.

[0054] The BGP temporal convolutional network is trained through the following process;

[0055] The first step is data collection;

[0056] Collect multimodal data from the border gateway, including network traffic data, log data, and system call data. Log data can include system events, error messages, user login information, etc. System call data can include application requests to the operating system, file operations, process management, etc. Perform preprocessing on different types of data, such as removing outliers, processing missing values, and extracting features. Statistical features such as average traffic and peak traffic can be extracted from network traffic data; keywords and event occurrence frequency can be extracted from log data; and call frequency and common call sequences can be extracted from system call data.

[0057] The second step is to perform multimodal data fusion;

[0058] Different types of data can be fused. For example, the features of different types of data can be spliced ​​together to form a unified multimodal feature vector. Alternatively, the features of different types of data can be fused in series, where they are extracted through a neural network and then fused in series. Another approach is to use an attention mechanism for weighted fusion, which dynamically adjusts the weights of different modal data according to the importance of the data to obtain a more comprehensive multimodal data representation.

[0059] The third step is data division;

[0060] The fused multimodal dataset is divided into training set, validation set and test set. Cross-validation or holdout method is usually used for division. Cross-validation can make better use of data and reduce fluctuations caused by different sample divisions; the holdout method is simple and direct and is suitable for situations with large amounts of data.

[0061] The fourth step is model building;

[0062] Attention mechanism temporal convolutional network model based on multimodal fusion. The model structure should include multiple branches for processing different types of data, such as one branch for processing network traffic data, one branch for processing log data, and one branch for processing system call data. These branches can adopt different neural network structures, such as convolutional neural network, recurrent neural network, etc. The attention mechanism is used to dynamically adjust the weights of different modal data so that the model can adaptively focus on information of different modalities. Temporal convolutional networks are used to capture time series features. For time series data such as network traffic and system call data, temporal convolutional networks can effectively extract time-related features.

[0063] Step 5: Loss function selection

[0064] Choose an appropriate loss function. For anomaly detection problems, you can choose a suitable loss function, such as mean square error, cross entropy loss, etc.

[0065] Step 6: Verify and adjust the model

[0066] Use the validation set to verify the trained model and adjust the model's hyperparameters, such as learning rate, regularization parameters, etc., to improve the generalization ability of the model. Methods such as cross-validation can be used to tune the parameters.

[0067] Step 7: Evaluate the model

[0068] Use the test set to evaluate the trained model and calculate the model's performance indicators, such as accuracy, recall, precision, F1 value, etc., to evaluate the model's detection performance.

[0069] Step 8: Deploy the model

[0070] Deploy the trained model to the actual environment to perform border gateway protocol anomaly detection, monitor network traffic, and promptly detect and handle anomalies.

[0071] Step 9: Continue to optimize the model

[0072] According to the actual application situation, the model is continuously optimized, including updating the data set, adjusting the model structure and other operations to improve the detection performance and stability of the model. Online learning and other methods can be used to continuously optimize the model.

[0073] In order to enhance the computational efficiency of BGP temporal convolutional network anomaly detection, the BGP temporal convolutional network can be distributed to multiple computing nodes for parallel computing to improve computing efficiency and processing speed. At the same time, GPU acceleration and other technologies can be introduced to speed up the computing speed by using hardware acceleration.

[0074] Since the traditional BGP time convolutional network cannot adapt well to different types of protocol traffic, the embodiment of the present disclosure performs anomaly detection by fusing features of different modalities to improve the adaptability and accuracy of different protocols.

[0075] When facing adversarial attacks, traditional temporal convolutional networks may be interfered by attackers, resulting in a decrease in the accuracy of anomaly detection.

[0076] Therefore, the embodiment of the present disclosure uses historical training data sets and historical test data sets to train the BGP temporal convolutional network to improve the robustness and reliability of anomaly detection.

[0077] like Figure 3 As shown, it is a structural diagram of the BGP time convolution network in the embodiment of the present disclosure. The BGP time convolution network includes an offline network and an online network. In the offline network, a labeled routing data set is first obtained, then BGP data is extracted, and finally model training is performed. In the online model, the BGP data to be tested is first obtained, then BGP features are extracted, and finally BGP data classification is performed to finally obtain normal detection results and abnormal detection results.

[0078] According to an embodiment of the present disclosure, a border gateway protocol anomaly detection device is provided, such as Figure 4 As shown, the device comprises:

[0079] An acquisition module 41 is used to acquire BGP data to be tested, wherein the BGP data to be tested is each type of data among the multiple types of BGP data, and the BGP data to be tested is obtained by pre-processing;

[0080] An extraction module 42, used for extracting the BGP data to be tested from the BGP data to be tested, and fusing the BGP data to be tested of multiple BGP data;

[0081] The detection module 43 is used to input the fused BGP data to be tested into the BGP time convolution network for detection to obtain the abnormal detection result of the BGP data to be tested; wherein, the BGP time convolution network is pre-trained, and after the BGP data to be tested is transmitted to the input layer, a convolution operation is performed on the time dimension through multiple time series convolution layers to capture the time series pattern and the BGP data to be tested in the time series data, and a self-attention layer is added after each time series convolution layer to perform weighted summation on the output of the time series convolution layer, and multiple time series convolution layers and a jump connection form a residual structure, and the residual structure includes multiple residual blocks. The jump connection directly adds the input to the output of the residual structure to transfer the dependency relationship of the BGP data to be tested. After the output of the residual structure passes through the global average pooling or the fully connected layer, the abnormal detection result of the BGP data to be tested is obtained.

[0082] In some optional implementations, the various BGP data include: network traffic data, log data, and system call data.

[0083] In some optional implementations, extracting the BGP data to be tested from the BGP data to be tested includes:

[0084] In some optional implementations, the extraction module 42 includes:

[0085] The first extraction submodule is used to extract at least one of the following features from the network flow data if the BGP data to be tested is network flow data: average flow and peak flow.

[0086] In some optional implementations, the extraction module 42 includes:

[0087] The second extraction submodule is used to extract at least one of the following features from the log data if the BGP data to be tested is log data: keywords and event occurrence frequency.

[0088] In some optional implementations, the extraction module 42 includes:

[0089] The third extraction submodule is used to extract at least one of the following features from the system call data if the BGP data to be tested is system call data: call frequency and common call sequence.

[0090] In some optional implementations, the acquisition module 41 includes:

[0091] The sample training data acquisition module is used to obtain historical training data sets, historical verification data sets and historical test data sets for training the BGP time convolutional network.

[0092] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0093] The border gateway protocol anomaly detection device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0094] An embodiment of the present invention further provides a computer device having the above-mentioned border gateway protocol anomaly detection device.

[0095] See also Figure 5 , Figure 5 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 5 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 5 A processor 10 is taken as an example.

[0096] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0097] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0098] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0099] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0100] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0101] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0102] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0103] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A border gateway protocol anomaly detection method, characterized in that: The method comprises: Acquire BGP data to be tested, wherein the BGP data to be tested is each type of data among the multiple types of BGP data, and the BGP data to be tested is pre-processed; Extracting the BGP data to be tested from the BGP data to be tested, and fusing the BGP data to be tested of multiple BGP data; The fused BGP data to be tested is input into the BGP time convolution network for detection to obtain anomaly detection results of the BGP data to be tested; wherein the BGP time convolution network is pre-trained, and after the BGP data to be tested is transmitted to the input layer, a convolution operation is performed on the time dimension through multiple time series convolution layers to capture the time series pattern and the BGP data to be tested in the time series data, and a self-attention layer is added after each time series convolution layer to perform weighted summation on the output of the time series convolution layer, and the multiple time series convolution layers and a jump connection form a residual structure, and the residual structure includes multiple residual blocks, and the jump connection directly adds the input to the output of the residual structure to transfer the dependency relationship of the BGP data to be tested, and the output of the residual structure is subjected to global average pooling or a fully connected layer to obtain the anomaly detection results of the BGP data to be tested.

2. The method according to claim 1, characterized in that The various BGP data include: network traffic data, log data, and system call data.

3. The method according to claim 2, characterized in that Extracting the BGP data to be tested from the BGP data to be tested includes: If the BGP data to be tested is the network traffic data, at least one of the following features is extracted from the network traffic data: average traffic and peak traffic.

4. The method according to claim 2, characterized in that: Extracting the BGP data to be tested from the BGP data to be tested includes: If the BGP data to be tested is the log data, at least one of the following features is extracted from the log data: a keyword, and an event occurrence frequency.

5. The method according to claim 2, characterized in that: Extracting the BGP data to be tested from the BGP data to be tested includes: If the BGP data to be tested is system call data, at least one of the following features is extracted from the system call data: call frequency, common call sequence.

6. The method according to claim 1, characterized in that Before obtaining the BGP data to be tested, the method includes: Obtain the historical training dataset, historical validation dataset, and historical test dataset for training the BGP temporal convolutional network.

7. A border gateway protocol anomaly detection device, characterized in that: The device comprises: An acquisition module, used for acquiring BGP data to be tested, wherein the BGP data to be tested is each type of data among multiple types of BGP data, and the BGP data to be tested is obtained through pre-processing; An extraction module, used for extracting the BGP data to be tested from the BGP data to be tested, and fusing the BGP data to be tested of multiple BGP data; A detection module is used to input the fused BGP data to be tested into a BGP time convolution network for detection to obtain an abnormal detection result of the BGP data to be tested; wherein the BGP time convolution network is pre-trained, and after the BGP data to be tested is transmitted to the input layer, a convolution operation is performed on the time dimension through multiple time series convolution layers to capture the time series pattern and the BGP data to be tested in the time series data, and a self-attention layer is added after each time series convolution layer to perform weighted summation on the output of the time series convolution layer, and the multiple time series convolution layers and a jump connection form a residual structure, and the residual structure includes multiple residual blocks, and the jump connection directly adds the input to the output of the residual structure to transfer the dependency relationship of the BGP data to be tested. After the output of the residual structure passes through the global average pooling or the fully connected layer, the abnormal detection result of the BGP data to be tested is obtained.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the border gateway protocol anomaly detection method according to any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the border gateway protocol anomaly detection method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises computer instructions, wherein the computer instructions are used to enable a computer to execute the border gateway protocol anomaly detection method according to any one of claims 1 to 6.

Images