Local area network boundary interruption detection method and device, electronic equipment and storage medium

Abstract

The invention provides a regional network boundary, a device, electronic equipment and a storage medium, and the method comprises the steps: determining a target region and autonomous systems in the target region, screening the autonomous systems in the target region, and determining a target autonomous system set; performing data acquisition on a routing message collector according to the target autonomous system set, and determining a local area network connection relation data set and a local area network prefix path data set; performing data acquisition on a routing message collector according to the target autonomous system set, determining a routing update dump file, and determining a peer number time sequence according to the routing update dump file, the local area network connection relation data set and the local area network prefix path data set; and inputting the peer number time sequence into a pre-trained anomaly detection model, and determining an interruption detection result.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, electronic device and storage medium for detecting regional network boundary interruption. Background Art

[0002] The Internet is composed of thousands of independent and autonomous systems. An autonomous system is a small unit that has the right to independently decide which routing protocol should be used in the system. When end-to-end hosts transmit traffic, they may cross multiple autonomous systems. In terms of distribution, autonomous systems belong to different organizations and to different regions or countries. The inter-domain routing protocol BGP is the infrastructure of the current cyberspace. It provides a communication mechanism between autonomous systems, controls the direction of inter-domain traffic forwarding, and plays an important role in the operation of the Internet. However, when the inter-domain routing protocol encounters emergencies such as network equipment failure, network attacks or natural disasters, it may cause routing interruptions between the regional network and the external network. Such events are called regional network border routing interruption events. Major regional network border routing interruption events will seriously endanger the normal operation of the inter-domain network infrastructure, and may even cause the network connection between the country's Internet and the global Internet to be interrupted. Therefore, detecting the interruption of the regional network border routing is an important prerequisite for ensuring the normal operation of the regional network.

[0003] However, the conventional detection method of sending a large number of detection messages to the network to be detected has a detection blind spot and increases the network burden and the consumption of equipment resources. Summary of the invention

[0004] In view of this, the purpose of the present application is to propose a method, device, electronic device and storage medium for detecting regional network boundary interruption.

[0005] Based on the above purpose, the present application provides a method for detecting regional network boundary interruption, including:

[0006] Determine the target area and the autonomous systems in the target area, screen the autonomous systems in the target area, and determine the target autonomous system set;

[0007] Collecting data from a routing message collector according to the target autonomous system set to determine a regional network connection relationship data set and a regional network prefix path data set;

[0008] Performing data collection on a routing message collector according to the target autonomous system set, determining a routing update dump file, and determining a time series of the number of peers according to the routing update dump file, the regional network connection relationship data set, and the regional network prefix path data set;

[0009] The peer quantity time series is input into a pre-trained anomaly detection model to determine an interruption detection result.

[0010] Optionally, screening the autonomous systems in the target area to determine the target autonomous system includes:

[0011] Determine routing information of the autonomous system in a target area, and determine multiple target autonomous systems according to the routing information;

[0012] The target autonomous system set is determined according to the multiple target autonomous systems.

[0013] Optionally, the routing information includes current routing information and initial routing information;

[0014] Determining the target autonomous system according to the routing information includes:

[0015] In response to determining that the current routing information of the autonomous system is the same as the initial routing information, determining the autonomous system as the target autonomous system;

[0016] In response to determining that the current routing information and the initial routing information of the autonomous system are not the same, the autonomous system is ignored.

[0017] Optionally, collecting data from a routing message collector according to the target autonomous system set to determine a regional network connection relationship data set and a regional network prefix path data set includes:

[0018] Collecting data from a routing message collector according to the target autonomous system set to determine a current routing snapshot dump file of the target area;

[0019] According to the current routing snapshot dump file, a regional network connection relationship data set and a regional network prefix path data set are determined.

[0020] Optionally, the routing update dump file includes a routing withdrawal file and a routing announcement file;

[0021] Determining the time series of the number of peers according to the routing update dump file, the regional network connection relationship data set and the regional network prefix path data set includes:

[0022] In response to determining that the routing update dump file is the routing fallback file, determining the peer quantity time series according to the routing fallback file, the regional network connection relationship data set, and the regional network prefix path data set;

[0023] In response to determining that the routing update dump file is the routing announcement file, the peer quantity time series is determined according to the routing announcement file, the regional network connection relationship data set, and the regional network prefix path data set.

[0024] Optionally, the anomaly detection model is a long short-term memory network;

[0025] The step of inputting the peer quantity time series into a pre-trained anomaly detection model to determine an interruption detection result includes:

[0026] The peer quantity time series is input into the long short-term memory network to determine the interruption detection result.

[0027] Optionally, the method further includes:

[0028] Determine when the disruption event occurred;

[0029] Determine a connection relationship data set, and determine the network connection relationship before the interruption and the network connection relationship at the time of the interruption according to the occurrence time and the connection relationship data set;

[0030] The network connection relationship before the interruption is compared with the network connection relationship during the interruption to determine the autonomous system where the interruption occurs.

[0031] Based on the same inventive concept, the embodiment of the present application further provides a regional network boundary interruption detection device, including:

[0032] A screening module is configured to determine a target area and autonomous systems in the target area, screen the autonomous systems in the target area, and determine a target autonomous system set;

[0033] A first data collection module is configured to collect data from a routing message collector according to the target autonomous system set to determine a regional network connection relationship data set and a regional network prefix path data set;

[0034] A second data collection module is configured to collect data from a routing message collector according to the target autonomous system set, determine a routing update dump file, and determine a peer quantity time series according to the routing update dump file, the regional network connection relationship data set, and the regional network prefix path data set;

[0035] The detection module is configured to input the peer quantity time series into a pre-trained anomaly detection model to determine an interruption detection result.

[0036] Based on the same inventive concept, an embodiment of the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method for detecting a regional network boundary interruption as described in any one of the above is implemented.

[0037] Based on the same inventive concept, an embodiment of the present application further provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute any of the above-mentioned regional network boundary interruption detection methods.

[0038] Based on the same inventive concept, an embodiment of the present application further provides a computer program product, including computer program instructions. When the computer program instructions are executed on a computer, the computer executes any of the above-mentioned regional network boundary interruption detection methods.

[0039] As can be seen from the above, the present application provides a method, device, electronic device and storage medium for detecting regional network boundary interruptions, which accurately divides regional network boundaries and determines key target autonomous systems by combining network active topology measurement and routing message data analysis. By collecting data from these target autonomous systems, a regional network connection relationship and prefix path data set are constructed, and a routing update dump file is generated to further extract the time series of the number of peers. The time series is input into a pre-trained anomaly detection model to identify interruption events. It effectively solves the problem that the method of detecting by sending a large number of detection messages to the network to be detected in the prior art has a detection blind spot, and increases the network burden and equipment resource consumption, as well as the gradient vanishing and gradient explosion problems faced by traditional recurrent neural networks when processing long time series. It significantly improves the accuracy of detecting routing interruption events at the regional network boundary, and provides a strong guarantee for network stability and reliability. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the present application or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0041] Figure 1 A schematic diagram of a flow chart of a method for detecting a regional network boundary interruption according to an embodiment of the present application;

[0042] Figure 2 A schematic diagram of an application scenario of a method for detecting a regional network border routing interruption event according to an embodiment of the present application;

[0043] Figure 3 A schematic diagram of the execution sequence of the method for detecting a regional network border routing interruption event according to an embodiment of the present application;

[0044] Figure 4 A schematic diagram of the process of constructing a time feature sequence of a regional network border routing interruption event according to an embodiment of the present application;

[0045] Figure 5 A schematic diagram of a regional network boundary interruption detection device according to an embodiment of the present application;

[0046] Figure 6 A schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the objectives, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0048] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should be the usual meanings understood by people with ordinary skills in the field to which the present application belongs. The "first", "second" and similar words used in the embodiments of the present application do not represent any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing in front of the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0049] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0050] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0051] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0052] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0053] In order to facilitate understanding of the technical solutions of the present disclosure, some technical terms involved in the present disclosure are introduced below.

[0054] AS: Autonomous System (AS for short). The Internet is made up of thousands of independent and autonomous systems. Each autonomous system is a collection of Internet Protocol routing prefixes connected under the control of one or more organizations representing a single management entity or domain. The management entity or domain provides a common, well-defined routing policy. Usually, each AS is operated by a single large organization, such as an Internet Service Provider (ISP), a Content Delivery Network (CDN), a large enterprise technology company, a university, or a government agency. Each organization can manage and operate multiple ASs. When end-to-end hosts transmit traffic, it may span multiple autonomous systems. In terms of distribution, autonomous systems belong to different organizations and to different countries upwards.

[0055] BGP: Border Gateway Protocol (BGP) is the standard inter-domain routing protocol of the Internet. The main function of BGP is to guide the flow of data packets in the Internet by exchanging routing information and reachability information between edge routers. Routers running the BGP routing protocol are called BGP speakers. The connection between peers is realized through manual configuration. They create sessions through TCP port 179 to exchange routing data. There are two types of BGP sessions: Interior Border Gateway Protocol (IBGP) and External Border Gateway Protocol (EBGP). When two BGP routers belong to the same autonomous system, an IBGP session is formed.

[0056] Routing interruption event: A routing anomaly event in which the BGP protocol causes the BGP session to be interrupted or the routing prefix to be withdrawn when experiencing an emergency situation that cannot be prevented. There are many reasons for routing interruption, such as incorrect configuration of BGP routers, network attacks, equipment failures, etc. When configuring routers or switches, network administrators may enter incorrect routing policies or misconfigure the BGP protocol, which will cause the network prefix to be withdrawn or unreachable, making the network prefix inaccessible from the outside, thereby causing routing interruption. Network attackers may destroy the normal routing mechanism of the network through malicious network attacks, causing the network prefix of a specific target to be inaccessible. Some non-human factors may also cause device link failures and thus routing interruption, such as network link damage caused by natural disasters, hardware failures of network equipment itself, etc. Routing interruption will cause the routing prefix to be inaccessible, making it impossible for Internet users to use the network services carried by the prefix. Destructive routing interruption events will cause the network services in key industries and important infrastructure in the country to be unavailable, causing serious impacts on social economy and people's lives. Regional network border routing interruption refers to a routing failure or interruption at the border AS with routing connection between a regional network and the outside world, resulting in a large-scale interruption of the regional network's Internet connection with the outside world. The regional network described in the present invention refers to a geographical area with a certain organization and administrative management, and the regional network is composed of a certain number of interconnected autonomous systems, such as a national network or a specific political alliance network.

[0057] Autonomous System Number Allocation and Routing: Autonomous systems are assigned a globally unique number, which is called an Autonomous System Number (ASN). ASN is a globally unique number used to identify autonomous systems. The Internet Assigned Numbers Authority (IANA) is a standards organization responsible for overseeing global IP address allocation and autonomous system number allocation. The Internet Corporation for Assigned Names and Numbers (ICANN) is a non-profit international organization that performs the functions of IANA. Regional Internet Registries (RIRs) are organizations that manage the allocation and registration of Internet number resources in a certain region of the world. ICANN allocates a large number of Internet number resources (IPv4, IPv6, ASN) to five regional (five continents) Internet registries RIR: AFRINIC (Africa), APNIC (Asia Pacific), ARIN (North America), LACNIC (Latin America) and RIPE NCC (Europe).

[0058] ASNs are allocated to RIRs by ICANN in blocks. The appropriate RIR then allocates ASNs from the allocated blocks to entities within its designated region. This region can be a country or a regional political union. Network entities that wish to obtain an ASN must complete the application process of their RIR, LIR (Regional Network Registry) or upstream service provider. Autonomous domain number resources reflect the network structure and interconnection capabilities of a region or even an organization to a certain extent. The major RIRs manage the detailed information of the autonomous system number resources in their respective service areas. IANA is responsible for ensuring the uniqueness of the entire set of Internet number resources. The five major RIRs jointly maintain the Internet number resource database.

[0059] When a network entity (ISP, CDN, large enterprise technology company, university or government agency) obtains ASN and IP address resources, it can use BGP to exchange routing information and reachability information between edge routers to guide data packets to flow in the Internet through routing equipment networking. When BGP announces the reachability information of the destination network, the announcement includes the autonomous system propagation path, that is, the list of ASs that need to be passed when going to the destination network, so that other networks can understand the path information to the destination network. Each AS can announce one or more IP routing prefixes.

[0060] Due to the existence of multinational corporations and some international businesses, there may be inconsistencies between the country of registration of ASN number resources obtained by some network entities and the country where the actual operating network is located. This phenomenon is called inconsistency between the ASN number registration location and the operating location.

[0061] Route announcement data collection: BGP messages contain rich path information and status information, which can be used to build global network topology and monitor route status changes, and are the basis for route security analysis. The most direct way to obtain route messages is to log in to the router through the command line to view the status information of the route information table. There are many such open routers in the world, but the amount of route message information obtained in this way is small, and it is not possible to obtain massive route message data continuously for a long time. At present, the systematic route message collection methods mainly include passive route message collection. Passive route message collection is mainly achieved by building a route message collector, which simulates a router (for example, using the route simulation software Quagga) and establishes a BGP peer session with one or more real routers (Vantage Point, referred to as VP). A collector will establish a BGP session link with multiple VPs, thereby receiving the route reachability information sent by each VP and parsing and summarizing it. The route update phase is essentially the process of BGP protocol operation, and the result is that the route collector obtains the path information from the VP point to all visible route prefixes in the world. For each VP, the collector maintains a session state and route snapshot. The collector periodically dumps snapshots of inter-domain routing information, including the maintained routing snapshot dump and the update messages and status update dumps received from all VPs since the last dump. The routing snapshot dump provides an effective summary of BGP routing table changes, with a coarse time granularity of 2 hours to 8 hours. In contrast, the update dump contains a large amount of information about routing changes, providing a complete view of observable routing dynamics, thereby supporting other types of analysis and near-real-time monitoring applications, with a time granularity of 5 minutes. Among them, the readable format of the routing snapshot dump has fields such as protocol type, timestamp, entry type, peer IP address, VP AS number, prefix, AS path, message origin, and next hop. The peer IP address is the IP port address of the BGP router that establishes a peer relationship with the routing collector, the peer AS number is the AS number of the BGP router that establishes a peer relationship with the routing collector, and the AS path is the list of AS numbers that need to be passed to reach the prefix. The possible values ​​of the origin field are IGP and EGP, where IGP indicates that the message originates from within the AS and EGP indicates that the message originates from an external AS. The messages in the routing update dump can be divided into withdrawal messages and announcement messages. The withdrawal message indicates that the routing collector has received a withdrawal message from a peer for a certain prefix, and the announcement message indicates that the routing collector has received an announcement message from a peer for a certain prefix.

[0062] In order to make the technical solution of the present disclosure clearer and easier to understand, the regional network boundary interruption detection method provided by the embodiment of the present disclosure is described in detail below with reference to the accompanying drawings.

[0063] As described in the background technology section, the Internet is composed of thousands of independent and autonomous systems. An autonomous system is a small unit that has the right to independently decide which routing protocol should be used in the system. When an end-to-end host transmits traffic, it may cross multiple autonomous systems, and the autonomous systems belong to different organizations in terms of distribution relations, and belong to different regions or countries upward. The inter-domain routing protocol BGP is the infrastructure of the current cyberspace. It provides a communication mechanism between autonomous systems, controls the direction of inter-domain traffic forwarding, and plays an important role in the operation of the Internet. When the inter-domain routing protocol encounters emergencies such as network equipment failure, network attacks or natural disasters, it may cause routing interruptions between the regional network and the external network. Such events are called regional network boundary routing interruption events. Major regional network boundary routing interruption events will seriously endanger the normal operation of the inter-domain network infrastructure, and may even cause the network connection between the country's Internet and the global Internet to be interrupted. Therefore, detecting the interruption of the border routing of the regional network is an important prerequisite for ensuring the normal operation of the regional network.

[0064] However, the conventional detection method of sending a large number of detection messages to the network to be detected has a detection blind spot and increases the network burden and the consumption of equipment resources.

[0065] In view of this, the embodiments of the present application provide a method, device, electronic device and storage medium for detecting regional network boundary interruptions. By combining network active topology measurement with routing message data analysis, the regional network boundaries are accurately divided and the key target autonomous systems are determined. By collecting data from these target autonomous systems, a regional network connection relationship and prefix path data set are constructed, and a routing update dump file is generated to further extract the time series of the number of peers. The time series is input into a pre-trained anomaly detection model to identify interruption events. It effectively solves the problem that the method of detecting by sending a large number of detection messages to the network to be detected in the prior art has a detection blind spot, and increases the network burden and equipment resource consumption, as well as the gradient vanishing and gradient explosion problems faced by traditional recurrent neural networks when processing long time series. It significantly improves the accuracy of detecting regional network boundary routing interruption events, and provides a strong guarantee for network stability and reliability.

[0066] like Figure 1 As shown, the regional network boundary interruption detection method includes:

[0067] Step S102: determine the target area and the autonomous systems in the target area, screen the autonomous systems in the target area, and determine a target autonomous system set;

[0068] Step S104: collecting data from the routing message collector according to the target autonomous system set to determine a regional network connection relationship data set and a regional network prefix path data set;

[0069] Step S106: collecting data from a routing message collector according to the target autonomous system set, determining a routing update dump file, and determining a time series of the number of peers according to the routing update dump file, the regional network connection relationship data set, and the regional network prefix path data set;

[0070] Step S108: input the peer quantity time series into a pre-trained anomaly detection model to determine an interruption detection result.

[0071] In step S102, the Autonomous System (AS) is the basic unit of the network and is the key to achieving efficient and reliable data transmission. Each autonomous system has its own unique Autonomous System Number (ASN), which is managed and allocated by the Internet Assigned Numbers Authority (IANA) and Regional Internet Registries (RIRs) such as APNIC, ARIN, RIPENCC, LACNIC, AFRINIC, etc. Figure 2 As shown in Figure 1, autonomous systems exchange routing information through the Border Gateway Protocol (BGP) to build an interconnected global network. In order to better understand and manage the operation of the network in a specific geographical area, we need to perform a series of steps to determine the actual set of autonomous systems operating in the area.

[0072] In some implementations, the target autonomous system is determined by the following steps:

[0073] (1) Based on the defined target area, that is, a geographical area with a certain organization and administrative management, such as a specific country or political alliance, we need to identify all autonomous system number resources allocated to the area. By querying the relevant "IP Address Assignment Authority", we can obtain all autonomous system numbers allocated to the geographical area. This includes not only local autonomous systems directly located in the area, but also autonomous systems that are not registered in the area but do have network resources in the area. Therefore, we must ensure that the collected data is comprehensive and accurate to reduce the computing power required for computing data and further reduce the computing power required for computing.

[0074] (2) Extract the routing prefix announced by each autonomous system in its network from the routing announcement data. Routing announcements are messages published by routers in the network, which contain the network segments connected to the routers, the cost of the paths, and other related information. Routing announcements refer to the routing information that a router announces in the network, including the network segments connected to it, the corresponding overhead (i.e., the cost of the paths), and other related parameters. In addition, all autonomous system numbers allocated for the geographic area can be obtained by querying the relevant "IP address allocation agencies" (such as IANA, RIRs).

[0075] In some implementations, in order to obtain the most accurate data, the routing announcement data is obtained through the Route Views Project, RIPE RIS (Routing Information Service) or other similar BGP routing data sources.

[0076] (3) For each routing prefix of each autonomous system, a random IP address is selected and various geolocation services are used to query the city and country to which the IP address belongs. Geolocation services can be based on commercial databases (such as MaxMind, DB-IP) or public APIs (such as GeoLite2, IP-API), which can provide mappings from IP addresses to geographic locations. It should be noted that since a single autonomous system may cover multiple cities or even cross national borders, such queries need to be performed separately for each routing prefix to ensure that the location information is as accurate as possible.

[0077] Furthermore, a route prefix refers to an IP address range, usually expressed in CIDR (Classless Inter-Domain Routing) notation. It consists of a base IP address and a mask length, such as 192.0.2.0 / 24. This notation illustrates the dividing line between the network part (prefix) and the host part. Among them, 192.0.2.0 is the network part, and / 24 means using 24 bits as the network identifier and the remaining 8 bits for the host identifier. Therefore, the prefix 192.0.2.0 / 24 covers all IP addresses from 192.0.2.0 to 192.0.2.255.

[0078] (4) Aggregation and screening: summarize and analyze the cities and countries to which the routing prefixes of each autonomous system in the target area belong. If it is found that the cities and countries to which all the routing prefixes of an autonomous system belong are within the area we defined, then the registration place and the actual operation place of this autonomous system are consistent. Therefore, the main services and infrastructure of the autonomous system are located in this area, thus meeting our standards. On the contrary, if there is any routing prefix that belongs outside the area, it means that the autonomous system is not fully operated in this area and therefore does not meet the conditions. Finally, the autonomous system that meets the conditions is used as the target autonomous system, and the target autonomous system is stored in the "set of autonomous systems actually operating in this area" to determine the target autonomous system set.

[0079] In some optional implementations, there are multiple types of routing, and the acquisition methods of routing announcement data of different types of routing are also significantly different. ① Direct routing: For directly connected networks, the router will automatically add routing information to the network. This method does not require additional configuration or protocol support and is the most basic way for routers to obtain routing information. ② Static routing: Static routing is routing information manually added to the router by the administrator. The administrator manually sets the routing table items, including the target network, mask, next hop address, etc. according to the network topology and requirements. Static routing will not change with changes in the network topology, so it needs to be manually updated and maintained by the administrator. ③ Dynamic routing: Dynamic routing, also known as adaptive routing, is a network connected between routers, using routing protocols to dynamically exchange routing information with each other, thereby automatically updating and maintaining the routing table. In the dynamic routing protocol, the router will exchange routing information with other routers regularly or on demand, including network segments, costs, metrics, etc. With this information, the router can calculate the optimal path to any destination.

[0080] OSPF (Open Shortest Path First) is a common dynamic routing protocol. In OSPF, a router will announce the network segment it is connected to and the corresponding cost, and share this information with other routers. Through the OSPF protocol, the router can build and maintain a complete link state database to calculate the optimal path.

[0081] In step S104, the regional network connection relationship data set is the initial regional network boundary AS connection relationship data dictionary, which is a database or data structure used to store and describe the connection relationship between each autonomous system (AS) in the network. The AS connection relationship data dictionary contains information such as the AS number (ASN), the AS name, and the connection relationship between ASs (such as neighbor AS, connection type, etc.). The regional network prefix path data set is a prefix path dictionary, which is a database or data structure used to store and describe the relationship between IP prefixes and paths in the network. The prefix path dictionary includes: IP prefix, path to the prefix (including AS, routers, etc. passed through), and path attributes (such as path length, next hop address, etc.) and other information.

[0082] In some embodiments, according to the previously determined set of target autonomous systems, a routing message collector is configured to ensure that all routing update information related to these autonomous systems can be captured. It should be noted that a routing message collector is a device or service specifically used to monitor and record BGP (Border Gateway Protocol) messages, and is usually located at key nodes of the network, such as major Internet exchange points (IXPs), core routers of large ISPs, etc. The routing message collector is used to continuously monitor BGP sessions and save the received routing update information as a routing snapshot dump file. The routing snapshot dump file contains rich routing information and is the basis for subsequent data analysis.

[0083] In some embodiments, the routing snapshot dump file is composed of message records, and the format of each message record is <protocol type, timestamp, entry type, peer IP address, VP AS number, prefix, AS path, message origin and next hop fields>, where the VP AS number is the VP observation point AS number, the prefix is ​​the target routing prefix, and the AS path is the list of ASs passed from the VP observation point AS to the target prefix.

[0084] Furthermore, the protocol type is used to identify the routing protocol used, usually BGP. The timestamp is used to record the specific time when the routing update occurs. The entry type is used to indicate whether this is new, deleted or updated routing information. The peer IP address is used to indicate the IP address of the peer router that sent the routing update. The VP AS number is the number of the autonomous system where the observation point is located, that is, the VP (View Point) AS number. VP refers to the location or node used to monitor and collect data in the network, which can be a router, server or other device that can capture network traffic and BGP updates. It provides important insights into the state of the network. The prefix is ​​the target routing prefix, that is, the IP address range involved in the routing update. The AS path is the list of ASs passed from the VP observation point AS to the target prefix. The message origin indicates the source of the routing information, such as IGP (Interior Gateway Protocol), EGP (Exterior Gateway Protocol) or incompletely determined. The next hop is used to indicate the IP address of the next hop router, that is, the next router to which the data packet should be sent. The target routing prefix is ​​used to guide the transmission path selection of the data packet from the source address to the destination address, for example, 192.0.2.0 / 24 represents the IP address range from 192.0.2.0 to 192.0.2.255.

[0085] Furthermore, the current message record is read, and the prefix, VP AS number, and AS path are stored in the prefix path two-dimensional dictionary. The prefix is ​​the key of the first dimension of the two-dimensional dictionary, the VP AS number is the key of the second dimension of the two-dimensional dictionary, and the value corresponding to the key of the second dimension is the AS path. The prefix path two-dimensional dictionary can realize efficient storage and query of the routing path of a specific prefix under different observation points.

[0086] In some implementations, two adjacent AS numbers in the AS path in the current message record are taken out from left to right to form a path pair.<ASleft,ASRight> . In this way, the direct connection relationship between ASs and the connection across different regions can be identified. Each pair of adjacent AS numbers is checked one by one to build a network topology diagram to determine the interconnection between autonomous systems.

[0087] Further, such as Figure 3As shown, for each path pair<ASleft,ASRight> , respectively calculate the regions to which the two ASs belong. If ASleft and ASRight belong to the same region, continue to process the next pair of adjacent AS numbers; otherwise, further check whether ASleft is in the set of autonomous systems actually operating in the region. If ASleft is indeed in the set, ASleft, VP AS number and ASRight are stored in another two-dimensional dictionary called "regional network boundary AS connection relationship". In this dictionary, ASleft is used as the key of the first dimension, VP AS number is used as the key of the second dimension, and the value corresponding to the key of the second dimension is ASRight. The purpose of this dictionary is to record all cross-regional boundary connections, so that we can clearly see which autonomous systems have established direct connections with other regions at the edge of the region. If ASleft is not in the set of autonomous systems actually operating in the region, skip this pair of ASs and continue to process the next pair. Among them, "region" refers to a geographical area with a certain organization and administrative management, such as a specific country or political alliance. Determining whether ASs belong to the same region can help us identify cross-regional boundary connections, which is very useful for understanding the global distribution and traffic patterns of networks.

[0088] In addition, if the current path is<ASleft,ASRight> If the AS numbers are the last two in the AS path, the next message record in the routing snapshot dump file is read, and the prefix, VP AS number, and AS path of the next message record are stored in the prefix path two-dimensional dictionary. The next cycle is performed until all message records are processed. Once completed, the initial regional network boundary AS connection relationship data dictionary and prefix path dictionary are successfully constructed. The AS connection relationship data dictionary and prefix path dictionary contain rich routing information and provide tools for in-depth analysis of regional network structure and behavior. Through further mining of these data, network performance bottlenecks, potential security threats, and methods for optimizing routing strategies can be further identified.

[0089] In step S106, the routing update dump file is a record file generated when the router performs firmware upgrades, configuration updates, or routing protocol updates. It contains information such as configuration differences before and after the update, routing table changes, interface status updates, etc. The routing update dump file is composed of message records, and the message types are divided into two types: routing withdrawal messages and routing announcement messages. Among them, the routing withdrawal message is used to notify the peer that certain routes have become unreachable and should therefore be removed from the routing table. The routing announcement message is a message in which the router announces the routing information it owns in the network. It is used to notify peers of new reachable routes or update existing routing information. It contains path information to a specific destination network (i.e., the target routing prefix).

[0090] In some implementations, the record format of the route withdrawal message is <protocol type, timestamp, entry type, peer IP address, VP AS number, prefix>; the record format of the route announcement message is <protocol type, timestamp, entry type, peer IP address, VP AS number, prefix, AS path, AS path, message origin and next hop fields>. Among them, the VP AS number is the VP observation point AS number, the prefix is ​​the target route prefix, and the AS path is the AS list passed from the VP observation point AS to the target prefix (i.e., the autonomous system passed to reach the target router).

[0091] The destination route prefix consists of two parts: the network address and the prefix length (or network mask). The network address specifies the destination network, while the prefix length (or network mask) defines the size or range of the network.

[0092] In some implementations, data is collected from a routing message collector according to the target autonomous system set, a routing update dump file is determined, and a time series of the number of peers is determined according to the routing update dump file, the regional network connection relationship data set, and the regional network prefix path data set, including the following steps: Figure 4 As shown, step S1061, set a fixed loading interval T and start timing;

[0093] Step S1062, determine whether the time interval T has been reached, if so, jump to step S1065, otherwise continue to read the message record in the file, determine the entry type of the current message, if it is a route withdrawal message, jump to step S1063, if it is a route announcement message, jump to step S1064. If the record is the last record in the file, load the latest route update dump file after processing, and enter step S1062;

[0094] Step S1063: Query the prefix path dictionary based on the prefix and VP AS number in the message. If it is not in the prefix path dictionary, read the next record of the routing update dump file and go to Step S1062. If it is in the prefix path dictionary, query the AS path corresponding to the prefix and VP AS number. Take two adjacent AS numbers of the AS path from left to right to form a path pair <ASleft, ASRight>. Check if there is a two-dimensional key-value pair <ASleft, VP AS number> in the first layer key of the regional network boundary AS connection relationship data dictionary and the corresponding value is ASRight. If it exists, delete the key VP AS number and the key value ASRight. After traversing the AS path, update the prefix path dictionary, and delete the key of the VP AS number corresponding to the prefix and the corresponding AS path in the dictionary. If the two AS numbers of the path pair <ASleft, ASRight> are the last two AS numbers in the AS path, jump to Step S1062.

[0095] Step S1064: Query the prefix path dictionary based on the prefix and VP AS number in the message. If there is no corresponding data in the dictionary, store the prefix, VP AS number, and AS path into the prefix path dictionary, where the prefix is the key of the first dimension of the two-dimensional dictionary, the VP AS number is the key of the second dimension of the two-dimensional dictionary, and the value corresponding to the key of the second dimension is the AS path; then enter Step S1064-1;

[0096] Step S1064-1: Take two adjacent AS numbers of the AS path from left to right to form a path pair <ASleft, ASRight>;

[0097] Step S1064-2: Calculate the regions to which ASleft and ASRight belong respectively. If ASleft and ASRight belong to the same region, jump to Step S1064-1; otherwise, enter Step S1064-3;

[0098] Step S1064-3: If ASleft is in the set of autonomous systems actually operating in the region, store ASleft, VP AS number, and ASRight into the regional network boundary AS connection relationship dictionary, where ASleft is the key of the first dimension of the two-dimensional dictionary, the VP AS number is the key of the second dimension of the two-dimensional dictionary, and the value corresponding to the key of the second dimension is ASRight; if ASleft is not in the set of autonomous systems actually operating in the region, jump to Step S1064-1; if the two AS numbers of the path pair <ASleft, ASRight> are the last two AS numbers in the AS path, jump to Step S1064-2;

[0099] When the set time interval T is reached, the process proceeds to step S1065, which includes: calculating the number of regional border autonomous system peers in the current time interval. The specific steps are as follows:

[0100] Traverse the regional network border AS connection relationship dictionary and count the number of all VP AS number keys. Each VP AS number key represents an observation point, under which the peers connected to the regional border AS are recorded. Therefore, the number of VP AS number keys reflects the number of peers in the regional border autonomous system, and further based on the number of peers, the time series of the number of peers in the regional border autonomous system is determined.

[0101] In some implementations, the peer number time series is input into the long short-term memory network to determine an interruption detection result, thereby determining whether a border routing interruption event occurs in the target area.

[0102] In some optional implementations, the long short-term memory network used for interruption detection is determined by training the time series of the number of peers in the border autonomous system.

[0103] In some embodiments, when it is determined that an interruption event is detected, the interruption time of the regional boundary routing interruption event is obtained, and the regional network boundary AS connection relationship data dictionary at a certain time before the interruption of the detected area and a certain time during the interruption is obtained respectively.

[0104] Furthermore, the boundary ASs in the regional network boundary AS connection relationship data dictionary before and after the interruption are compared one by one, and the difference in the number of peers corresponding to the boundary AS before and after the interruption is calculated. The regional boundary AS with a difference greater than zero is the root AS that caused the regional boundary routing interruption event.

[0105] From the above, it can be seen that by combining network active topology measurement with routing message data analysis, the regional network boundaries are accurately divided and the key target autonomous systems are determined. By collecting data from these target autonomous systems, the regional network connection relationship and prefix path data set are constructed, and a routing update dump file is generated to further extract the time series of the number of peers. The time series is input into the pre-trained anomaly detection model to identify interruption events. It effectively solves the problem that the method of sending a large number of detection messages to the network to be detected in the prior art has a detection blind spot, and increases the network burden and equipment resource consumption, as well as the gradient vanishing and gradient explosion problems faced by traditional recurrent neural networks when processing long time series. It significantly improves the accuracy of regional network boundary routing interruption event detection, provides a strong guarantee for network stability and reliability, and has important application value for the security protection of cyberspace routing infrastructure.

[0106] It should be noted that the method of the embodiment of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present application, and the multiple devices will interact with each other to complete the described method.

[0107] It should be noted that the above describes some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0108] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides an interruption detection device.

[0109] refer to Figure 5 , the regional network boundary interruption detection device comprises:

[0110] A screening module 502 is configured to determine a target area and autonomous systems in the target area, screen the autonomous systems in the target area, and determine a target autonomous system set;

[0111] The first data collection module 504 is configured to collect data from the routing message collector according to the target autonomous system set to determine a regional network connection relationship data set and a regional network prefix path data set;

[0112] The second data collection module 506 is configured to collect data from the routing message collector according to the target autonomous system set, determine a routing update dump file, and determine a peer quantity time series according to the routing update dump file, the regional network connection relationship data set, and the regional network prefix path data set;

[0113] The detection module 508 is configured to input the peer quantity time series into a pre-trained anomaly detection model to determine an interruption detection result.

[0114] For the convenience of description, the above device is described in terms of functions divided into various modules. Of course, when implementing the present application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0115] The device of the above embodiment is used to implement the corresponding regional network boundary interruption detection method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0116] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method for detecting a regional network boundary interruption described in any of the above embodiments is implemented.

[0117] Figure 6 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 in the device.

[0118] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0119] The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0120] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0121] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0122] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0123] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0124] The electronic device of the above embodiment is used to implement the corresponding regional network boundary interruption detection method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0125] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the regional network boundary interruption detection method described in any of the above embodiments.

[0126] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0127] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute the regional network boundary interruption detection method described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0128] Based on the same inventive concept, corresponding to the regional network boundary interruption detection method described in any of the above embodiments, the present disclosure also provides a computer program product, which includes computer program instructions. In some embodiments, the computer program instructions can be executed by one or more processors of a computer so that the computer and / or the processor execute the regional network boundary interruption detection method. Corresponding to the execution subject corresponding to each step in each embodiment of the regional network boundary interruption detection method, the processor that executes the corresponding step can belong to the corresponding execution subject.

[0129] The computer program product of the above embodiment is used to enable the computer and / or the processor to execute the regional network boundary interruption detection method described in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0130] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application (including the claims) is limited to these examples. In line with the concept of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0131] In addition, to simplify the description and discussion, and in order not to make the embodiments of the present application difficult to understand, the known power supply / ground connection with the integrated circuit (IC) chip and other components may or may not be shown in the provided drawings. In addition, the device can be shown in the form of a block diagram to avoid making the embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform to be implemented in the embodiments of the present application (that is, these details should be fully within the scope of understanding of those skilled in the art). In the case of elaborating specific details (e.g., circuits) to describe exemplary embodiments of the present application, it is obvious to those skilled in the art that the embodiments of the present application can be implemented without these specific details or when these specific details are changed. Therefore, these descriptions should be considered to be illustrative rather than restrictive.

[0132] Although the present application has been described in conjunction with specific embodiments of the present application, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0133] The embodiments of the present application are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the scope of protection of the present application.

Claims

1. A method for detecting regional network boundary interruption, characterized in that: include: Determine the target area and the autonomous systems in the target area, screen the autonomous systems in the target area, and determine the target autonomous system set; Collecting data from a routing message collector according to the target autonomous system set to determine a regional network connection relationship data set and a regional network prefix path data set; Performing data collection on a routing message collector according to the target autonomous system set, determining a routing update dump file, and determining a time series of the number of peers according to the routing update dump file, the regional network connection relationship data set, and the regional network prefix path data set; The peer quantity time series is input into a pre-trained anomaly detection model to determine an interruption detection result.

2. The method according to claim 1, characterized in that The step of screening the autonomous systems in the target area to determine the target autonomous system includes: Determine routing information of the autonomous system in a target area, and determine multiple target autonomous systems according to the routing information; The target autonomous system set is determined according to the multiple target autonomous systems.

3. The method according to claim 2, characterized in that The routing information includes current routing information and initial routing information; Determining the target autonomous system according to the routing information includes: In response to determining that the current routing information of the autonomous system is the same as the initial routing information, determining the autonomous system as the target autonomous system; In response to determining that the current routing information and the initial routing information of the autonomous system are not the same, the autonomous system is ignored.

4. The method according to claim 1, characterized in that: The step of collecting data from a routing message collector according to the target autonomous system set to determine a regional network connection relationship data set and a regional network prefix path data set includes: Collecting data from a routing message collector according to the target autonomous system set to determine a current routing snapshot dump file of the target area; According to the current routing snapshot dump file, a regional network connection relationship data set and a regional network prefix path data set are determined.

5. The method according to claim 1, characterized in that The routing update dump file includes a routing withdrawal file and a routing announcement file; Determining the time series of the number of peers according to the routing update dump file, the regional network connection relationship data set and the regional network prefix path data set includes: In response to determining that the routing update dump file is the routing fallback file, determining the peer quantity time series according to the routing fallback file, the regional network connection relationship data set, and the regional network prefix path data set; In response to determining that the routing update dump file is the routing announcement file, the peer quantity time series is determined according to the routing announcement file, the regional network connection relationship data set, and the regional network prefix path data set.

6. The method according to claim 1, characterized in that The anomaly detection model is a long short-term memory network; The step of inputting the peer quantity time series into a pre-trained anomaly detection model to determine an interruption detection result includes: The peer quantity time series is input into the long short-term memory network to determine the interruption detection result.

7. The method according to claim 6, characterized in that The method further comprises: Determine when the disruption event occurred; Determine a connection relationship data set, and determine the network connection relationship before the interruption and the network connection relationship at the time of the interruption according to the occurrence time and the connection relationship data set; The network connection relationship before the interruption is compared with the network connection relationship during the interruption to determine the autonomous system where the interruption occurs.

8. A regional network boundary interruption detection device, characterized in that: include: A screening module is configured to determine a target area and autonomous systems in the target area, screen the autonomous systems in the target area, and determine a target autonomous system set; A first data collection module is configured to collect data from a routing message collector according to the target autonomous system set to determine a regional network connection relationship data set and a regional network prefix path data set; A second data collection module is configured to collect data from a routing message collector according to the target autonomous system set, determine a routing update dump file, and determine a peer quantity time series according to the routing update dump file, the regional network connection relationship data set, and the regional network prefix path data set; The detection module is configured to input the peer quantity time series into a pre-trained anomaly detection model to determine an interruption detection result.

9. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable by the processor, wherein the processor implements the method according to any one of claims 1 to 7 when executing the computer program. 10 . A non-transitory computer-readable storage medium storing computer instructions for causing a computer to execute the method according to claim 1 .

Images