Prefix hijacking detection method and system for uncertain information source

Abstract

The invention provides an uncertain information source-oriented prefix hijacking detection method and system. The method comprises the following steps of: acquiring a routing information base, a resource public key infrastructure and Internet routing registration center data in a border gateway protocol; prefix cloud droplets are constructed from time, space and data source dimensions based on a cloud model theory, and deterministic data and uncertain data are obtained according to the dispersion degree of a cloud model; performing space-time stability analysis on the deterministic data, dynamically scoring each prefix cloud droplet, and establishing a dynamic deterministic information base; for uncertain data, a self-defined dictionary tree is used for carrying out online detection on a route; and judging whether the routing is legal or not by utilizing prefix coverage and matching rules and combining a dual verification mechanism, so as to complete anomaly detection and online updating. The invention provides a prefix hijacking detection method based on a cloud model theory and a Trie tree so as to overcome the characteristics of dynamic change of a border gateway protocol, complex network, large scale, data uncertainty and the like.

Description

Technical Field

[0001] The present invention belongs to the field of inter-domain anomaly detection in inter-domain routing security, and more specifically, relates to a prefix hijacking detection method and system for uncertain data sources. Background Art

[0002] The Border Gateway Protocol (BGP), as the core protocol of Internet routing, is the basic guarantee for the interconnection of global autonomous systems. However, it lacks a security authentication mechanism in its initial design, resulting in frequent BGP anomalies. Among them, prefix hijacking events have occurred frequently in recent years and have a wide range of impacts, posing a huge threat to global inter-domain routing security.

[0003] BGP anomaly detection detects anomalies through actively and passively obtained routing data, and further locates suspicious routing information (prefixes, ASes, etc.) so that operation and maintenance personnel can quickly trace and mitigate anomalies. Existing BGP anomaly detection methods are mainly divided into methods based on active probing, machine learning, and routing logic. The method based on active probing detects the connectivity between ASes through active traffic probing. However, as the BGP topology becomes more complex, the overhead is huge, and it is impossible to perform full-scale detection and it does not have real-time performance; the method based on machine learning uses algorithms to model network traffic or routing data to identify abnormal patterns, but it depends on a large amount of labeled data, and the performance of the model is affected by data quality and feature engineering, and the black box effect of deep learning models makes it difficult to interpret the detection results; the method based on routing logic detects prefix hijacking by analyzing BGP routing information, which has real-time performance and interpretability, but it highly depends on data reliability and is prone to false positives or false negatives when facing inaccurate or incomplete data.

[0004] Existing methods cannot simultaneously meet the requirements of real-time performance and accuracy, and mainly face the following challenges: the collected data is uncertain, incomplete, and time-varying; the BGP routing behavior changes dynamically; the BGP network is a distributed system and has a large scale. Therefore, it is necessary to carry out research on more effective BGP anomaly detection and traceability mechanisms to ensure the security of the national inter-domain network. Summary of the Invention

[0005] In view of the technical problems existing in the prior art, the present invention provides a prefix hijacking detection method and system for uncertain data sources to overcome the characteristics of dynamic changes of BGP, complex and large-scale network, and uncertain data.

[0006] According to the first aspect of the present invention, there is provided a prefix hijacking detection method for uncertain data sources, including the following steps: S1. Obtain the routing information library, resource public key infrastructure, and Internet routing registry data in the Border Gateway Protocol; S2. Construct a cloud model, construct prefix cloud droplets from the dimensions of time, space, and data source based on cloud model theory, and classify data into deterministic data and uncertain data based on the discreteness of the cloud model; S3. Conduct spatio-temporal stability analysis on the deterministic data, dynamically score each prefix cloud droplet, and establish a dynamic deterministic information library; S4. For the uncertain data, use a custom trie to perform online detection on the routing; the trie includes an online prefix tree and an offline prefix tree. The online prefix tree stores and evaluates the certainty of all prefixes and their originating autonomous systems; the offline prefix tree stores the mapping relationship between the verified legal prefixes and autonomous systems; S5. Use prefix coverage and matching rules, combined with a dual verification mechanism, to determine whether the routing is legal, thereby completing anomaly detection and online update.

[0007] Based on the above technical solutions, the present invention can also be improved as follows.

[0008] Optionally, the obtaining of the routing information library, resource public key infrastructure, and Internet routing registry data in the Border Gateway Protocol includes: Collect the routing information library related to the Border Gateway Protocol, resource public key infrastructure, and Internet routing registry data, extract the prefixes, source AS numbers, time, and source information from the collected tripartite database, and insert the collected tripartite database into the IP prefix tree.

[0009] Optionally, the construction of the cloud model includes: Construct a cloud model of the prefix cloud droplet by using the expected value, entropy, and hyperentropy extracted from the prefix cloud droplet. The three features are time persistence, space consistency, and data source. Calculate the uncertainty of the cloud droplet by weighted calculation of the expected value, entropy, and hyperentropy.

[0010] Optionally, constructing prefix cloud droplets from the time dimension based on cloud model theory includes: Calculate the characteristic components of time persistence, including: define an observation matrix, calculate the continuous announcement time of the prefix cloud droplet through the time persistence vector. The newer the time when the prefix cloud droplet appears, the higher the credibility; the calculation method of the time persistence of the prefix cloud droplet is as follows:

[0011] Wherein, is the time persistence, indicating the degree of time persistence of the autonomous system's continuous announcement of the prefix cloud droplet; represents the persistence vector, d represents the size of the time window; represents the weight coefficient of time in the observation window.

[0012] Optionally, constructing prefix cloud droplets from the spatial dimension based on the cloud model theory includes: Calculating the number of times a prefix cloud droplet is observed by an observation point through a spatial consistency vector. The more frequently it is observed, the more stable the prefix cloud droplet is in space. The calculation method for the number of times a prefix cloud droplet is observed by an observation point is as follows:

[0013] Where, represents spatial consistency, indicating the number of times a prefix cloud droplet is observed by an observation point; represents the number of times a prefix cloud droplet is observed by an observation point, d represents the size of the time window; is the weight vector, indicating the reliability of the observation point.

[0014] Optionally, constructing prefix cloud droplets from the data source dimension based on the cloud model theory includes: Calculating the characteristic components of subordination, including: using a membership vector to represent the attribution of prefix cloud droplets from which information is extracted from different data sources. The calculation method for the characteristic components of subordination is as follows:

[0015] Where, is the data source, indicating prefix cloud droplets from which information is extracted from different data sources; represents the membership vector; is the weight vector, indicating the reliability of the data.

[0016] Optionally, the degree of dispersion based on the cloud model is divided into deterministic data and uncertain data, including: In the cloud model, a multi-dimensional cloud model is constructed using time persistence, spatial consistency, and membership relationship, and the reliability of prefix cloud droplets is calculated using the cloud droplet certainty degree. The calculation formula is:

[0017] Where, y represents the characteristic vector of a certain prefix cloud droplet is the certainty degree of belonging to the characteristic cloud, are respectively the characteristic cloud droplets belonging to the three characteristic components of time persistence, spatial consistency, and membership degree; is the interval is the random value of the normal function generated on, and both adopt the same calculation method; respectively represent the expected values of the three characteristic components of time persistence, spatial consistency, and membership degree.

[0018] Optionally, for the spatio-temporal stability analysis of deterministic data, dynamically score each prefix cloud droplet, and establish a dynamic deterministic information library, including: S31. Define the characteristic cloud of the prefix cloud droplet, represent the qualitative concept of the stability of the prefix cloud droplet with a cloud model, and represent several cloud droplets as , where the three elements s of the vector i t , s i s , s i m respectively represent the characteristic components of the time persistence, spatial consistency, and membership relationship of the cloud droplet ; S32. Calculate the cloud model parameters, and calculate the expectation, entropy, and hyper-entropy of the characteristic cloud of the prefix cloud droplet; the expectation is the typical sample value of the quantification of the qualitative concept, the entropy measures the dispersion degree of all cloud droplets, and the hyper-entropy is used to measure the uncertainty of the entropy; S33. Calculate the uncertainty of the prefix cloud droplet, and calculate the reliability of the prefix cloud droplet according to the membership degree of the cloud droplet.

[0019] Optionally, for the uncertain data, use a custom trie to perform online detection of the routing, including: S41. Use the prefix coverage and matching rules to evaluate the relationship between the incoming routing and the legal prefixes stored in the offline prefix tree, verify whether the uncertain data is a legal prefix, and determine whether the prefix matches the legal autonomous system number ASN; S42. In a dynamic network environment, when the newly added prefix cloud droplets exceed the threshold, update the offline prefix tree according to the IP prefix tree IPTrie.

[0020] According to the second aspect of the present invention, there is provided a prefix hijacking detection system for an uncertain information source, including: A data collection module, configured to obtain a routing information library in the Border Gateway Protocol, a resource public key infrastructure, and Internet routing registry data; A data confidence calculation module, configured to construct a cloud model, construct prefix cloud droplets from the time, space, and data source dimensions based on the cloud model theory, and classify them into deterministic data and uncertain data based on the dispersion degree of the cloud model; for the deterministic data, perform spatio-temporal stability analysis, dynamically score each prefix cloud droplet, and establish a dynamic deterministic information library; for the uncertain data, use a custom trie to perform online detection of the routing; the trie includes an online prefix tree and an offline prefix tree, the online prefix tree stores and evaluates the certainty of all prefixes and their originating autonomous systems; the offline prefix tree stores the mapping relationship between the verified legal prefixes and autonomous systems; Anomaly detection and localization module, which is used to utilize prefix coverage and matching rules, combined with a dual-verification mechanism, to determine whether a route is legal, thereby completing anomaly detection and online update.

[0021] Technical effects and advantages of the present invention: The present invention provides a prefix hijacking detection method and system for uncertain data sources. By comprehensively measuring relevant routing data of the Border Gateway Protocol, and considering characteristics such as data inconsistency, time-variation, and multi-origin, a more accurate data basis is provided for subsequent detection. An online routing credibility evaluation model designed based on the cloud model theory comprehensively considers three dimensions of time, space, and data source, effectively extracts a spatio-temporally stable mapping relationship, converts uncertain data into deterministic data, and improves the accuracy of detection. Using the Trie tree structure for efficient storage and retrieval of prefix and ASN information, combined with a dual-verification mechanism, can quickly and accurately detect prefix hijacking behaviors, achieve real-time online detection and traceability, and the detection results have good interpretability. Brief Description of the Drawings

[0022] Figure 1 It is a schematic flow chart of a prefix hijacking detection method for uncertain data sources provided by an embodiment of the present invention; Figure 2 It is a schematic diagram of the cloud droplet distribution of cloud model features provided by an embodiment of the present invention; Figure 3 It is a graph of the construction and detection speed of the Trie tree under different prefix lengths provided by an embodiment of the present invention. Detailed Embodiments

[0023] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0024] It can be understood that based on the defects in the background technology, an embodiment of the present invention proposes a prefix hijacking detection method for uncertain data sources, specifically as Figure 1 shown, including the following steps: S1. Obtain the routing information library, resource public key infrastructure, and Internet routing registry data in the Border Gateway Protocol; It should be noted that the Border Gateway Protocol (BGP) is an exterior gateway protocol used to exchange routing information between different networks. It runs on the border routers of Internet Service Providers (ISPs), enterprise networks, and other large networks, helping these networks connect to each other and enabling data communication.

[0025] In a computer network, the routing table is figuratively called the Routing Information Base (RIB). Each router is responsible for maintaining a global routing table, which can be viewed using the "display ip routing-table" command. At the same time, each routing protocol running on the router also independently maintains its own routing table. These routing tables and the global routing table together constitute the complete routing information base of the router.

[0026] Resource Public Key Infrastructure (RPKI), also known as Resource Certification, with the full Chinese name "Internet Number Resource Public Key Infrastructure", is a Public Key Infrastructure (PKI) framework aimed at making the Internet routing infrastructure more secure.

[0027] The Internet Routing Registry (IRR) includes information about autonomous system numbers and routing prefix numbers submitted and maintained by Internet service providers or other entities.

[0028] After obtaining the data of the routing information base, Resource Public Key Infrastructure, and Internet Routing Registry in the Border Gateway Protocol, it also includes: preprocessing the data. This includes: collecting the data of the routing information base, Resource Public Key Infrastructure, and Internet Routing Registry related to the Border Gateway Protocol, extracting the prefixes, source AS numbers, time, and source information from the collected tripartite database, and then inserting the collected tripartite database into the IP prefix tree.

[0029] It should be noted that the AS number (Autonomous System Number) is the unique identifier used in the Internet to identify an autonomous system (AS). An autonomous system refers to a group of networks under the control of the same organization or management entity. These networks share the same routing policies and protocols and form a single management unit. The AS number is a 32-bit digital identifier used for routing selection and path transmission between autonomous systems.

[0030] S2. Construct a cloud model, construct prefix cloud droplets from the dimensions of time, space, and data source based on cloud model theory, and classify data into deterministic data and uncertain data based on the degree of dispersion of the cloud model; It should be noted that the cloud model performs an uncertainty conversion between qualitative concepts and quantitative descriptions according to three digital characteristics of the calculated data, namely the expected value (Ex), entropy (En), and hyperentropy (He). Prefix cloud droplets are constructed from the dimensions of time, space, and data source, and deterministic data and uncertain data are obtained according to the degree of dispersion of the cloud model. Figure 2 This is a schematic diagram of the cloud droplet distribution of the cloud model features provided by the embodiments of the present invention; each cloud droplet in the figure corresponds to the spatio-temporal characteristics of a prefix cloud droplet, and the depth of its color represents the degree of uncertainty of the cloud droplet.

[0031] Constructing the cloud model includes: constructing a cloud model of the prefix cloud droplet from the expected value (Ex), entropy (En), and hyperentropy (He) extracted from the prefix cloud droplet. The three characteristics are time persistence, spatial consistency, and data source. The uncertainty of the cloud droplet is calculated by weighted calculation of the three characteristics, and the specific steps are as follows.

[0032] The construction of prefix cloud droplets from the dimensions of time, space, and data source based on cloud model theory is respectively: S21. Calculate the characteristic component of time persistence, including: defining the observation matrix U , and calculating the continuous announcement time of the prefix cloud droplet through the time persistence vector . Use the weight vector to represent the weight coefficient of time in the observation window. The newer the time when the prefix cloud droplet appears, the higher the credibility. The calculation method of the time persistence of the prefix cloud droplet is as follows:

[0033] Among them, is the time persistence, indicating the degree of time persistence of the autonomous system's continuous announcement of the prefix cloud droplet; represents the persistence vector, d represents the size of the time window; represents the weight coefficient of time in the observation window.

[0034] To facilitate the quantitative calculation of features, we define the observation matrix , and the observation matrix is expressed as:

[0035] Among them, indicates that the value is 1 if the prefix i is observed at the observation point j, otherwise the value is 0; c represents the number of observation points, and d represents the length of the observation window.

[0036] S22. Calculate the characteristic component of spatial consistency, including: through the spatial consistency vector Calculate the number of times the prefix cloud droplet is observed by the observation point, and the weight vector Indicates the reliability of the observation point. The more frequently it is observed, the more stable the prefix cloud droplet is in space. The calculation method for the number of times the prefix cloud droplet is observed by the observation point is as follows:

[0037] Among them, is the spatial consistency, indicating the number of times the prefix cloud droplet is observed by the observation point; represents the number of times the prefix cloud droplet is observed by the observation point, and d represents the size of the time window; is the weight vector, indicating the reliability of the observation point.

[0038] S23. Calculate the characteristic components of subordination, including: using the membership vector to represent the attribution of the prefix cloud droplet whose information is extracted from different data sources; the calculation method of the characteristic components of subordination is as follows:

[0039] Among them, is the data source, indicating the prefix cloud droplet whose information is extracted from different data sources; represents the membership vector, is the weight vector, indicating the reliability of the data, and is calculated using a linear decreasing function for calculation.

[0040] Finally, based on the degree of dispersion of the cloud model, it is divided into deterministic data and uncertain data; including: In the cloud model, a multi-dimensional cloud model is constructed using time persistence, spatial consistency, and membership relationship. The reliability of the prefix cloud droplet is calculated using the cloud droplet certainty degree, and the calculation formula is:

[0041] Among them, y represents the feature vector of a certain prefix cloud droplet is the certainty degree of belonging to the feature cloud, are respectively the feature cloud droplets belonging to the three feature components of time persistence, spatial consistency, and membership degree; is the interval is the random value of the normal function generated on, and both adopt the same calculation method; respectively represent the expected values of the three feature components of time persistence, spatial consistency, and membership degree.

[0042] S3. Conduct spatio-temporal stability analysis on the deterministic data, dynamically score each prefix cloud droplet, and establish a dynamic deterministic information library; In this embodiment, drawing on the idea of the cloud model, a two-way transformation between qualitative concepts and quantitative values is achieved through the reverse cloud transformation algorithm. Specifically, each prefix cloud droplet's features are scored, and a dynamic certainty information library is established, with the steps as follows: S31. Define the prefix cloud droplet feature cloud, and use the cloud model to represent the stable qualitative concept of the prefix cloud droplet. A number of cloud droplets are represented as , where the three elements s i t , s i s , s i m represent the characteristic components of the time persistence, spatial consistency, and membership relationship of the cloud droplet respectively; S32. Calculate the cloud model parameters, and calculate the expectation, entropy, and hyperentropy of the prefix cloud droplet feature cloud. The expectation is the most typical sample value for quantifying the qualitative concept, the entropy measures the dispersion degree of all cloud droplets, and the hyperentropy measures the uncertainty of the entropy. Among them, The feature vector is represented as

[0043] where the expectation Ex is the most typical sample value for quantifying the qualitative concept; the entropy En is determined by the randomness and fuzziness of the qualitative concept, used to measure the dispersion degree of all cloud droplets, and can also reflect the value range of cloud droplets accepted by the concept; the hyperentropy He is used to measure the uncertainty of the entropy and is a correlative description of fuzziness and randomness.

[0044] S33. Calculate the uncertainty of the prefix cloud droplet, and calculate the reliability of the prefix cloud droplet according to the membership degree of the cloud droplet. In this embodiment, a multi-dimensional cloud model is constructed using time persistence, spatial consistency, and membership relationship, and the cloud droplet certainty is used to calculate the reliability of the prefix cloud droplet.

[0045] S4. For uncertain data, an online detection of the route is performed using a custom trie tree; The trie tree includes an online prefix tree and an offline prefix tree. The online prefix tree stores and evaluates the certainty of all prefixes and their originating autonomous systems, and the offline prefix tree stores the mapping relationship between the verified legal prefixes and autonomous systems; Figure 3 This is the construction and detection speed graph of the trie tree under different prefix lengths provided by the embodiment of the present invention. It can be seen from the figure that as the prefix length changes, the impact on the construction time and search time of the trie tree Trie is relatively small, indicating that real-time anomaly detection can be performed under different prefix lengths.

[0046] In this embodiment, the uncertainty of the prefix cloud droplet is defined For the prefix cloud droplets whose calculated probability exceeds a certain threshold, the mapping relationship library is screened out, and the new added feature vectors that do not exceed the threshold are used to update and adjust the feature cloud.

[0047] For the uncertain data, the online detection of the route using the custom trie tree includes: S41. Using the prefix coverage and matching rules, evaluate the relationship between the incoming route and the legal prefixes stored in the offline prefix tree, verify whether it is a legal prefix, and determine whether the prefix matches the legal autonomous system number ASN; S42. In a dynamic network environment, when the newly added prefix cloud droplets exceed a certain threshold, update the offline prefix tree according to the IP prefix tree IPTrie to achieve automatic update. The online prefix tree and the offline prefix tree cooperate with each other to continuously verify and update the legality of the prefix, improve the real-time performance and accuracy of detection, and enhance the processing ability for uncertain information sources; S5. Using the prefix coverage and matching rules, combined with a dual verification mechanism, determine whether the route is legal, so as to complete anomaly detection and online update.

[0048] The determination of whether the route is legal by using the prefix coverage and matching rules, combined with a dual verification mechanism includes: if and only if the prefix conforms to the known legal route (through the coverage and matching conditions), it is considered legal. If the prefix does not conform to any legal routing rules (that is, it is covered or does not match), it will be regarded as illegal.

[0049] To detect the effect of CloudTrie in prefix hijacking detection, the embodiments of the present invention use a multi-source data set, including RPKI, IRR, and RIB tables. The data set covers all BGP update data in January 2023 and is divided into 6 time windows, and each window contains continuous 5-day data. The case analysis in the experiment uses the corresponding time routing data for analysis and uses authoritative news reports for verification.

[0050] The experimental environment is an AMD EPYC 7K62, 48-core processor, the code runs on the Linux operating system, is configured with 64GB of memory, and is implemented using the Python language. The detection accuracy and time are used as performance evaluation indicators.

[0051] The experimental results show that: the uncertainty of about 85% of the prefix cloud droplets is less than 0.4, and most of the routing information has a high credibility; the cloud model can effectively adapt to the dynamic characteristics of BGP routing; the Trie tree is an efficient data structure for IP prefix storage and retrieval, maintaining a high query efficiency while occupying less memory; the proposed method reduces the false positive rate to 9.3% while maintaining a detection coverage rate of 85.7% (equivalent to Artemis), with an average reduction of 10.6 percentage points compared to the baseline method. Through case analysis, real hijacking events in history were successfully detected, proving its effectiveness in practical applications.

[0052] As can be seen from the above experimental results, the prefix hijacking detection method CloudTrie based on the cloud model theory and Trie tree proposed in the embodiments of the present invention can more accurately detect BGP prefix hijacking and perform traceability analysis.

[0053] According to the second aspect of the present invention, the embodiments of the present invention further provide a prefix hijacking detection system for uncertain information sources, for the above-mentioned prefix hijacking detection method for uncertain information sources, and the system includes: A data collection module, configured to obtain the routing information library, resource public key infrastructure, and Internet routing registry data in the Border Gateway Protocol. A data confidence calculation module, configured to construct a cloud model, construct prefix cloud droplets from the time, space, and data source dimensions based on the cloud model theory, and divide them into deterministic data and uncertain data based on the dispersion degree of the cloud model; perform spatio-temporal stability analysis on the deterministic data, dynamically score each prefix cloud droplet, and establish a dynamic deterministic information library; for the uncertain data, use a custom trie tree to perform online detection on the routing; the trie tree includes an online prefix tree and an offline prefix tree, the online prefix tree stores and evaluates the certainty of all prefixes and their originating autonomous systems; the offline prefix tree stores the mapping relationship between the verified legal prefixes and autonomous systems. An anomaly detection and location module, configured to use prefix coverage and matching rules, combined with a dual verification mechanism, to determine whether the routing is legal, thereby completing anomaly detection and online update.

[0054] It can be understood that the prefix hijacking detection system for uncertain information sources provided by the present invention corresponds to the prefix hijacking detection method for uncertain information sources provided in the foregoing embodiments. The relevant technical features of the prefix hijacking detection system for uncertain information sources can refer to the relevant technical features of the prefix hijacking detection method for uncertain information sources, and will not be elaborated here.

[0055] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the essence of the above technical solution, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0056] Although the preferred embodiments of the present invention have been described, those skilled in the art can make additional changes and modifications to these embodiments once they learn the basic creative concept. Therefore, the appended claims are intended to be interpreted to include the preferred embodiments as well as all changes and modifications falling within the scope of the present invention.

[0057] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention also intends to include these changes and modifications.

[0058] Finally, it should be noted that the above are only the preferred embodiments of the present invention and are not used to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

1. A prefix hijacking detection method for uncertain information sources, characterized in that, Including the following steps: S1. Obtain the routing information library, resource public key infrastructure, and Internet routing registry data in the Border Gateway Protocol; S2. Construct a cloud model, construct prefix cloud droplets from the dimensions of time, space, and data source based on the cloud model theory, and classify them into deterministic data and uncertain data based on the dispersion degree of the cloud model; S3. Conduct spatio-temporal stability analysis on the deterministic data, dynamically score each prefix cloud droplet, and establish a dynamic deterministic information library; S4. For the uncertain data, use a custom trie to perform online detection on the routing; the trie includes an online prefix tree and an offline prefix tree, and the online prefix tree stores and evaluates the certainty degrees of all prefixes and their originating autonomous systems; The offline prefix tree stores the mapping relationship between the verified legal prefixes and autonomous systems; S5. Use the prefix coverage and matching rules, combined with a dual verification mechanism, to determine whether the routing is legal, thereby completing anomaly detection and online update.

2. The prefix hijacking detection method for an uncertain information source according to claim 1, characterized in that The obtaining of the routing information library, resource public key infrastructure, and Internet routing registry data in the Border Gateway Protocol includes: Collect the routing information library, resource public key infrastructure, and Internet routing registry data related to the Border Gateway Protocol, extract the prefixes, source AS numbers, time, and source information from the collected tripartite database, and insert the collected tripartite database into the IP prefix tree.

3. A prefix hijacking detection method for an uncertain information source according to claim 1, characterized in that The constructing of the cloud model includes: Construct the cloud model of the prefix cloud droplet by using the expected value, entropy, and hyperentropy extracted from the prefix cloud droplet. The three features are time persistence, space consistency, and data source, and the uncertainty degree of the cloud droplet is calculated by weighted calculation of the expected value, entropy, and hyperentropy.

4. A prefix hijacking detection method for an uncertain information source according to claim 1, characterized in that Constructing prefix cloud droplets from the time dimension based on the cloud model theory includes: Calculate the characteristic components of time persistence, including: defining an observation matrix, calculating the continuous announcement time of the prefix cloud droplet through the time persistence vector. The newer the appearance time of the prefix cloud droplet, the higher the credibility; the calculation method of the time persistence of the prefix cloud droplet is as follows: Among them, is the time persistence, indicating the time persistence degree of the autonomous system's continuous announcement of the prefix cloud droplet; is expressed as a persistence vector, and d represents the size of the time window; represents the weight coefficient of time in the observation window.

5. A prefix hijacking detection method for an uncertain information source according to claim 1, characterized in that Constructing prefix cloud droplets from the space dimension based on the cloud model theory includes: Calculate the number of times the prefix cloud droplet is observed by the observation point through the space consistency vector. The more frequent the observation, the more stable the prefix cloud droplet is in space; the calculation method of the number of times the prefix cloud droplet is observed by the observation point is as follows: Among them, represents spatial consistency, indicating the number of times the prefix cloud droplets are observed at the observation point; represents the number of times the prefix cloud droplets are observed at the observation point, and d represents the size of the time window; is the weight vector, indicating the reliability of the observation point.

6. The prefix hijacking detection method for an uncertain information source according to claim 1, wherein Constructing prefix cloud droplets from the data source dimension based on the cloud model theory includes: Calculate the characteristic components of subordination, including: using the membership vector to represent the attribution of the prefix cloud droplet whose extracted information comes from different data sources; the calculation method of the characteristic components of subordination is as follows: Among them, is the data source, representing the prefix cloud droplets for extracting information from different data sources; represents the membership vector; is the weight vector, representing the reliability of the data.

7. A prefix hijacking detection method for an uncertain information source according to claim 1, characterized in that, The classification of the deterministic data and uncertain data based on the dispersion degree of the cloud model includes: In the cloud model, construct a multi-dimensional cloud model by using time persistence, space consistency, and membership relationship, and use the cloud droplet certainty degree to calculate the reliability degree of the prefix cloud droplet. The calculation formula is: Among them, y represents the feature vector of a certain prefix cloud droplet The degree of certainty belonging to the feature cloud They are respectively the feature cloud droplets belonging to the three feature components of time persistence, spatial consistency, and membership degree Is the interval The random value of the normal function generated on And Both adopt the same calculation method They respectively represent the expected values of the three feature components of time persistence, spatial consistency, and membership degree 8. A prefix hijacking detection method for an uncertain information source according to claim 1, characterized in that The conducting of spatio-temporal stability analysis on the deterministic data, dynamically scoring each prefix cloud droplet, and establishing a dynamic deterministic information library includes: S31. Define the prefix cloud droplet feature cloud, and use the cloud model to represent the stable qualitative concept of the prefix cloud droplets. A number of cloud droplets are represented as , where the three elements s i t 、s i s 、s i m represent the characteristic components of the time persistence, spatial consistency, and membership relationship of the cloud droplet respectively; S32. Calculate the cloud model parameters, and calculate the expectation, entropy, and hyperentropy of the prefix cloud droplet feature cloud; the expectation is the typical sample value of the qualitative concept quantification, the entropy measures the dispersion degree of all cloud droplets, and the hyperentropy is used to measure the uncertainty of the entropy. S33. Calculate the uncertainty of the prefix cloud droplets, and calculate the reliability degree of the prefix cloud droplets according to the membership degree of the cloud droplets.

9. The prefix hijacking detection method for an uncertain information source according to claim 1, wherein For the uncertain data, the online detection of the route using the custom trie tree includes: S41. Utilize the prefix coverage and matching rules to evaluate the relationship between the incoming route and the legal prefixes stored in the offline prefix tree, verify whether the uncertain data is a legal prefix, and determine whether the prefix matches the legal autonomous system number. S42. In a dynamic network environment, when the newly added prefix cloud droplets exceed the threshold, update the offline prefix tree according to the IP prefix tree IPTrie.

10. A prefix hijacking detection system for an uncertain information source, which is used for a prefix hijacking detection method for an uncertain information source according to any one of claims 1 to 9, and is characterized in that, The system includes: A data collection module, which is used to obtain the routing information library, resource public key infrastructure, and Internet routing registry data in the Border Gateway Protocol. A data confidence calculation module, which is used to construct a cloud model, construct prefix cloud droplets from the time, space, and data source dimensions based on the cloud model theory, and divide them into deterministic data and uncertain data according to the dispersion degree of the cloud model; conduct spatio-temporal stability analysis on the deterministic data, dynamically score each prefix cloud droplet, and establish a dynamic deterministic information library; for the uncertain data, use the custom trie tree to perform online detection on the route; the trie tree includes an online prefix tree and an offline prefix tree, the online prefix tree stores and evaluates the certainty of all prefixes and their originating autonomous systems; the offline prefix tree stores the mapping relationship between the verified legal prefixes and autonomous systems. An anomaly detection and location module, which is used to utilize the prefix coverage and matching rules, combine the dual verification mechanism, determine whether the route is legal, and thus complete anomaly detection and online update.

Images