Border gateway protocol anomaly detection model training method and device, and computer device

Abstract

The present application relates to the technical field of communication detection, and discloses a training method and device of a border gateway protocol anomaly detection model and computer equipment, wherein the historical route statistical features and historical graph topology features corresponding to historical BGP data are extracted, and the features are trained by using the border gateway protocol anomaly detection model, the drift detection score between the historical anomaly detection result and the historical BGP data is calculated in the training process, and the drift detection threshold is used as a reference benchmark to adaptively update the multiple parameter values of the border gateway protocol anomaly detection model in combination with the drift detection score. Therefore, even if the BGP abnormal condition caused by the dynamic change of the network environment is faced, the BGP abnormal data can be accurately detected, and the high efficiency of the BGP abnormal data anomaly detection can be ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication detection, and particularly relates to a training method and device of a border gateway protocol anomaly detection model and a computer device. BACKGROUND

[0002] The border gateway protocol (BGP) is an Internet core routing protocol, and realizes reachability between autonomous systems (ASs). The security of the BGP directly affects the stable operation of global network infrastructure. Since the BGP is established on the basis of a trust relationship network between ASs, the AS network is very vulnerable when encountering network attacks. Therefore, it is very important to study the BGP anomaly detection for the safe operation of the BGP.

[0003] In the related art, a static model is generally used to detect common BGP anomaly data such as specific prefix hijacking, route leakage, and configuration errors. However, due to the complex and diverse network environment, the accompanying BGP anomaly conditions are also increasingly diverse. Therefore, if the traditional static model is used for detection, the newly generated BGP anomaly conditions caused by the dynamic changes of the network environment cannot be detected, and thus the BGP detection result is not accurate enough. SUMMARY

[0004] Therefore, the present application provides a training method and device of a border gateway protocol anomaly detection model and a computer device to solve the problem that the detection result is not accurate enough due to the limited detection range when the static model is used to detect specific BGP anomaly data.

[0005] According to a first aspect, the present application provides a training method of a border gateway protocol anomaly detection model, and the method comprises the following steps.

[0006] Obtaining historical BGP data arranged in a time sequence;

[0007] Extracting historical route statistical features and historical graph topology features corresponding to the historical BGP data, wherein the historical route statistical features and the historical graph topology features affect the dynamic changes of the historical BGP data in the BGP network;

[0008] Fusing the historical route statistical features and the historical graph topology features to obtain historical fusion features corresponding to the historical BGP data;

[0009] Inputting the historical fusion features into the border gateway protocol anomaly detection model for training to obtain historical anomaly detection results corresponding to the historical BGP data and a drift detection score between the historical anomaly detection results and the historical BGP data, and the drift detection score is used as a reference benchmark to adaptively update a plurality of parameter values of the border gateway protocol anomaly detection model.

[0010] The embodiment extracts the historical route statistical features and the historical graph topology features corresponding to the historical BGP data, and trains the features by using the border gateway protocol anomaly detection model. In the training process, the drift detection score between the historical anomaly detection result and the historical BGP data is calculated, and the drift detection score is combined with the drift detection threshold as a reference benchmark to adaptively update the plurality of parameter values of the border gateway protocol anomaly detection model. Therefore, the embodiment can accurately detect the BGP abnormal data even in the face of BGP abnormal conditions caused by dynamic changes in the network environment, and can also ensure the high efficiency of the BGP abnormal data anomaly detection.

[0011] In some optional embodiments, the historical route statistical features include a plurality of historical route volume features, a plurality of historical route length features, and a plurality of historical route behavior features; the historical graph topology features include a historical global graph density feature, a historical maximum betweenness centrality feature, and a historical business relationship entropy feature. The historical route statistical features and the historical graph topology features corresponding to the historical BGP data are extracted, including:

[0012] The historical BGP data is cleaned;

[0013] According to the historical BGP data after the cleaning, a plurality of historical route volume features, a plurality of historical route length features, and a plurality of historical route behavior features are parsed;

[0014] From the historical BGP data after the cleaning, historical BGP path data is selected;

[0015] The historical BGP path data is input into a BGP graph topology database for graph topology mapping to obtain a historical global graph density feature, a historical maximum betweenness centrality feature, and a historical business relationship entropy feature.

[0016] The historical route statistical features and the historical graph topology features are beneficial to improve the accuracy of the border gateway protocol anomaly detection model.

[0017] In some optional embodiments, the historical route statistical features and the historical graph topology features are fused to obtain historical fusion features corresponding to the historical BGP data, including:

[0018] The historical route statistical features are interpolated by using the center interpolation method;

[0019] The historical graph topology features and the historical route statistical features after the interpolation are spliced according to the time sequence to obtain the historical fusion features corresponding to the historical BGP data.

[0020] The historical route statistical features and the historical graph topology features are also used to ensure that the detection result of the border gateway protocol anomaly detection model is more accurate.

[0021] In some optional embodiments, the border gateway protocol anomaly detection model is a multi-head self-attention bidirectional long short-term memory model, which includes a data standardization layer, a bidirectional long short-term memory encoding layer, a multi-head self-attention layer, and a classification output layer. The historical fusion features sequentially pass through the data standardization layer, the bidirectional long short-term memory encoding layer, the multi-head self-attention layer, and the classification output layer for feature processing to obtain the anomaly detection result corresponding to the historical BGP data.

[0022] The multi-head self-attention bidirectional long short-term memory model is of great significance to the discovery and tracing of complex patterns associated with the context before and after the BGP anomaly interruption.

[0023] In some optional embodiments, the drift detection score between the historical anomaly detection result and the historical BGP data is calculated in the following manner.

[0024] The historical fusion features are processed by a dimension reduction algorithm to obtain a two-dimensional space vector.

[0025] The dimension number of the historical fusion features, the first divergence value of each dimension, the spatial drift distance of the two-dimensional space vector, and a plurality of weight parameters are obtained.

[0026] According to the two-dimensional space vector, the dimension number of the historical fusion features, the first divergence value of each dimension, the spatial drift distance of the two-dimensional space vector, and the plurality of weight parameters, the drift detection score corresponding to the historical BGP data is calculated.

[0027] The drift detection score is calculated in the above manner, which can reflect the subtle changes in the historical statistical features and the output distribution of the multi-head self-attention bidirectional long short-term memory model.

[0028] In some optional embodiments, the drift detection threshold, which is a reference benchmark for the drift detection score, is calculated in the following manner.

[0029] The average value of the drift detection score corresponding to the historical BGP data and the standard deviation of the drift detection score corresponding to the historical BGP data are obtained within the target time window.

[0030] A sensitivity coefficient is obtained.

[0031] According to the sensitivity coefficient, the average value of the drift detection score corresponding to the historical BGP data, and the standard deviation of the drift detection score corresponding to the historical BGP data, the drift detection threshold corresponding to the historical BGP data at the current time and the drift detection threshold corresponding to the historical BGP data at the previous time of the current time are calculated.

[0032] obtaining a smoothness coefficient;

[0033] According to the smoothness coefficient, the drift detection threshold corresponding to the historical BGP data at the current moment, and the drift detection threshold corresponding to the historical BGP data at the previous moment of the current moment, the drift detection threshold serving as a reference benchmark of the drift detection score is calculated.

[0034] The embodiment calculates the drift detection threshold, so as to facilitate adaptive updating action as a reference benchmark of the drift detection score when the historical BGP data is abnormal due to network environment change.

[0035] In some optional embodiments, the drift detection score adaptively updates the plurality of parameter values of the border gateway protocol anomaly detection model with the drift detection threshold as a reference benchmark, and is implemented through the following steps:

[0036] When the drift detection score exceeds the drift detection threshold, the plurality of parameter values of the border gateway protocol anomaly detection model are repeatedly updated multiple times until the drift detection score is less than the drift detection threshold.

[0037] The embodiment indicates that the historical BGP data is abnormal due to dynamic drift when the drift detection score exceeds the drift detection threshold, and adaptively updates the border gateway protocol anomaly detection model, thereby realizing accurate detection of abnormal conditions caused by dynamic drift.

[0038] In a second aspect, the embodiment also provides a training device of a border gateway protocol anomaly detection model, and the device comprises:

[0039] a historical data acquisition module configured to acquire historical BGP data arranged in a time sequence;

[0040] a historical feature extraction module configured to extract historical route statistical features and historical graph topology features corresponding to the historical BGP data, wherein the historical route statistical features and the historical graph topology features affect dynamic changes of the historical BGP data in a BGP network;

[0041] a historical feature fusion module configured to fuse the historical route statistical features and the historical graph topology features to obtain historical fusion features corresponding to the historical BGP data;

[0042] a historical feature training module configured to input the historical fusion features into the border gateway protocol anomaly detection model training to obtain historical anomaly detection results corresponding to the historical BGP data, and a drift detection score between the historical anomaly detection results and the historical BGP data, wherein the drift detection score adaptively updates a plurality of parameter values of the border gateway protocol anomaly detection model with a drift detection threshold as a reference benchmark.

[0043] In a third aspect, the embodiment further provides a computer device, comprising:

[0044] a memory and a processor, which are connected in communication with each other, and the memory stores computer instructions, and the processor executes the computer instructions to perform the training method of the border gateway protocol anomaly detection model according to the first aspect or any one of the implementations of the first aspect.

[0045] In a fourth aspect, the embodiment further provides a computer readable storage medium, which stores computer instructions, and the computer instructions are used to make a computer execute the training method of the border gateway protocol anomaly detection model according to the first aspect or any one of the implementations of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0046] In order to more clearly illustrate the specific embodiments of the present application or the technical solutions in the prior art, the drawings needed in the specific embodiments or the prior art description will be briefly introduced as follows. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0047] Figure 1 FIG. 1 is a flow diagram of the training method of the border gateway protocol anomaly detection model according to the embodiment of the present application;

[0048] Figure 2 FIG. 2 is a data collection diagram according to the embodiment of the present application;

[0049] Figure 3 FIG. 3 is a structural diagram of the border gateway protocol anomaly detection model according to the embodiment of the present application;

[0050] Figure 4 FIG. 4 is a timing diagram of the drift condition of the historical BGP data according to the embodiment of the present application;

[0051] Figure 5 FIG. 5 is a confusion matrix diagram of the normal window and the drift window under different strategies according to the embodiment of the present application;

[0052] Figure 6A FIG. 6 is a parameter selection diagram of the training process of the border gateway protocol anomaly detection model according to the embodiment of the present application;

[0053] Figure 6B FIG. 7 is another parameter selection diagram of the training process of the border gateway protocol anomaly detection model according to the embodiment of the present application;

[0054] Figure 7 FIG. 8 is a structural block diagram of the training device of the border gateway protocol anomaly detection model according to the embodiment of the present application;

[0055] Figure 8 Fig. 1 is a schematic diagram of a hardware structure of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION

[0056] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0057] According to the embodiments of the present application, an embodiment of a training method of a border gateway protocol anomaly detection model is provided. It should be noted that the steps shown in the flowchart of the drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown herein.

[0058] In the present embodiment, a training method of a border gateway protocol anomaly detection model is provided. The training method of the border gateway protocol anomaly detection model can be used in a computer device such as a mobile phone, a tablet computer, a desktop computer, a portable notebook computer, a server, etc. Figure 1 Fig. 1 is a flowchart of a training method of a border gateway protocol anomaly detection model according to an embodiment of the present application. As shown in Fig. 1, the flowchart includes the following steps: Figure 1

[0059] In step S101, historical BGP data arranged in time sequence is acquired.

[0060] Specifically, the historical BGP data includes historical BGP update message data and historical BGP path data collected in a historical time period. The historical BGP update message data includes but is not limited to data such as route prefix, route cache, route source and route configuration. These historical BGP data are time series data marked with timestamp information in the historical period, i.e., each historical BGP data corresponds to a time point.

[0061] Exemplarily, the BGP data file of the corresponding period is acquired through a request historical data interface. The acquisition module in the computer device uses the following uniform resource locator (URL) strategy to acquire the historical BGP data arranged in time sequence as described above.

[0062] ​Step a1, locate the specific data file address in the webpage according to the time parameter;

[0063] Step a2, request data range parameters according to configuration needs to build a URL queue, which represents a set of data addresses to be requested, and sequentially start the download thread.

[0064] Step a3, the download thread polls the first collector, the second collector and the third collector in the queue, and links to the corresponding URL to download the BGP data file package.

[0065] The first collector is named Route Views, the second collector is named RIPE RIS, and the third collector is named AS Rankv2.1. As shown in the following table, it is a data collection diagram. Figure 2

[0066] Exemplarily, the embodiment collects AS inter-business connection relationship topology data, and uses the AS inter-relationship topology data provided by the Cooperative Association for Internet Data Analysis (CAIDA). The BGP path data in the historical BGP data is collected through the graph topology calling interface. For example, the offset parameter and the page size parameter are initialized, and the historical BGP path data is obtained by sequentially submitting a request to the graph topology calling interface. The historical BGP path data is AS-Link data.

[0067] For example, the collection time period is specified as the historical BGP data between 2022 / 12 / 25 00:00-2022 / 12 / 25 23:59, the collection module in the computer device requests and downloads the historical BGP data corresponding to the time period, and combines it into a JSON static file. The historical BGP path data is loaded according to the month, and the historical graph topology features are obtained through the BGP graph topology database.

[0068] Step S102, extract the historical route statistical features and the historical graph topology features corresponding to the historical BGP data. The historical route statistical features and the historical graph topology features affect the dynamic changes of the historical BGP data in the BGP network.

[0069] In a specific example, the historical route statistical features include: a plurality of historical route volume features, a plurality of historical route length features, and a plurality of historical route behavior features; the historical graph topology features include: historical global graph density features, historical maximum betweenness centrality features, and historical business relationship entropy features. The historical route statistical features and the historical graph topology features corresponding to the historical BGP data are extracted.

[0070] As shown in the following table 1, the description information of the plurality of historical route volume features is as follows. ​

[0071] Table 1

[0072]

[0073] In the above table 1, for example, pfx_avg means the average number of occurrences of each prefix in 1 minute, and the calculation method is expressed by the following formula (1):

[0074] (1)

[0075] wherein, pfx_avg represents the average number of occurrences of each prefix in a 1-minute window, represents the set of all route prefixes that occur in the current time window, and represents each route prefix in the set of all route prefixes that occur in the current time window.

[0076] As shown in the following table 2, the description information of a plurality of historical routing behavior features is as follows.

[0077] Table 2

[0078]

[0079] In the above table 2, the average length of the non-repeating path is calculated by the following formula (2):

[0080] (2)

[0081] wherein, is the average length of all paths after removing duplicate AS nodes in the window, is the number of all paths in the window, is the set of all paths in the window, i.e. the non-repeating path, and |path| is the path length.

[0082] As shown in the following table 3, the description information of a plurality of historical routing behavior features is as follows.

[0083] Table 3

[0084]

[0085] In some optional embodiments, the step S102 of extracting historical BGP data corresponding to historical routing statistical features and historical graph topology features comprises:

[0086] Step b1, cleaning the historical BGP data.

[0087] The historical BGP data is cleaned to delete abnormal BGP data.

[0088] In step b2, a plurality of historical route volume features, a plurality of historical route length features and a plurality of historical route behavior features are parsed according to the historical BGP data after the cleaning.

[0089] In Figure 2 , after downloading the BGP data file package, the BGP data file package is converted into a unified message format by the bgpdump parsing tool. Taking the BGP update message data with the data name BGP UPDATE as an example, the BGP data file package after parsing generates a standard format message containing 14 fields, which is convenient for subsequent data analysis. At the same time, in order to ensure long-term stable storage of data, the embodiment adopts a distributed storage scheme, combined with memory direct reading and Redis cache mechanism, to support efficient query and real-time processing of super large scale historical BGP data.

[0090] In step b3, historical BGP path data is selected from the historical BGP data after the cleaning.

[0091] In step b4, the historical BGP path data is input into the BGP graph topology database for graph topology mapping to obtain historical global graph density features, historical maximum betweenness centrality features and historical commercial relationship entropy features.

[0092] Exemplarily, historical BGP path data is first selected from the historical BGP data after the cleaning, and then the historical BGP path data is input into the BGP graph topology data for mapping to obtain historical global graph density features, historical maximum betweenness centrality features and historical commercial relationship entropy features and other historical graph topology features, thereby realizing permanent data storage of the network topology graph and providing support for subsequent network analysis.

[0093] In a specific example, the global graph density feature is the size of the actual edge number ratio, which is expressed by the following formula (3):

[0094] (3)

[0095] wherein, is the global graph density feature, is the actual edge number of the graph topology structure, is the node number of the graph topology structure, the lower the density, the more obvious the hierarchical structure of the graph topology structure, and an abnormally increased global density is related to route leakage, for example, a large number of non-compliant connections between ASs may be caused by large-scale route leakage.

[0096] In a specific example, the maximum betweenness centrality feature is the frequency of a node appearing in the shortest path between other node pairs, calculated using an undirected graph model because reverse transmission of users is not acceptable in business relationships. The maximum betweenness centrality feature is expressed by equation (4) as follows:

[0097] (4)

[0098] wherein, is the maximum betweenness centrality feature, is the number of shortest paths from node to , and is the number of paths passing through . The maximum betweenness centrality is calculated for all nodes, and the higher the value, the closer the node is to a key hub, and the greater the impact of node failure.

[0099] In a specific example, the historical business relationship entropy feature reflects the distribution of relationships between AS nodes, and the higher the entropy value, the more uniform the relationship distribution, and vice versa. For example, when a large number of Provider relationships are added in a certain period of time, and a certain AS suddenly becomes a Provider for a large number of ASs, the entropy value will decrease. The relationship entropy is higher in the topology in which the different BGP Peer percentages in Table 1 above are high. The entropy value is calculated as shown in equation (5) as follows:

[0100] (5)

[0101] In equation (5) above, H represents the business relationship entropy, and the greater the value of the degree of disorder of the relationship distribution between ASs, the more uniform the relationship, and the smaller the value, the more concentrated, is a set of business relationship types, defining three basic business relationships between ASs, supporting the following business relationships: Provider-Customer: a paid relationship, with traffic flowing from the Customer to the Provider, Peer-Peer: a peer relationship, with both sides exchanging traffic for free, Customer-Provider: a reverse paid relationship (actually equivalent to Provider-Customer), is the edge percentage of relationship type .

[0102] Step S103: Fusing the historical route statistics features and the historical graph topology features to obtain historical fusion features corresponding to the historical BGP data.

[0103] In some optional embodiments, the step S103 of fusing the historical route statistics features and the historical graph topology features to obtain historical fusion features corresponding to the historical BGP data includes:

[0104] Step c1: Use the center interpolation method to interpolate the historical routing statistical features.

[0105] Step c2: By splicing the historical map topology features and the historical routing statistical features after interpolation according to the time series, the historical fusion features corresponding to the historical BGP data are obtained.

[0106] In a specific example, the time period attributes of the historical graph topology features are aligned with the timestamps extracted from the historical route statistics features. Historical graph topology features F_graph = [f1, f2, f3 …] are recorded from the graph topology structure. Centering interpolation is performed on the historical statistical features to generate F_stats = interpolation(F_stats). Finally, F_stats and F_graph are concatenated by timestamps to form a complete dataset dataset = concat(F_stats, F_graph), thus obtaining the historical fused features corresponding to the historical BGP data.

[0107] Step S104: Input the historical fusion features into the training of the border gateway protocol anomaly detection model to obtain the historical anomaly detection results corresponding to the historical BGP data, as well as the drift detection score between the historical anomaly detection results and the historical BGP data. The drift detection score is used as a reference benchmark to adaptively update multiple parameter values ​​of the border gateway protocol anomaly detection model.

[0108] like Figure 3 The diagram shown is a structural schematic of a border gateway protocol anomaly detection model. In a specific example, this embodiment... Figure 3 The anomaly detection model of the BGP protocol in the model is a multi-head self-attention bidirectional long short-term memory model. The multi-head self-attention bidirectional long short-term memory model includes: a data normalization layer, a bidirectional long short-term memory encoding layer, a multi-head self-attention layer, and a classification output layer. Historical fusion features are processed sequentially through the data normalization layer, the bidirectional long short-term memory encoding layer, the multi-head self-attention layer, and the classification output layer to obtain the anomaly detection results corresponding to the historical BGP data.

[0109] To enable edge deployment and real-time monitoring, the border gateway protocol anomaly detection model constructed in this embodiment is a hybrid model, which is based on the fusion of multi-head self-attention mechanism and bidirectional long short-term memory (LSTM) network to optimize the traditional LSTM's context dependency awareness defects and insufficient feature selection ability.

[0110] Firstly, the bidirectional LSTM encoding layer is used to capture the context dependence of the routing data. It can capture both the forward historical dependence and the backward future dependence of the time series, such as the routing update trend belongs to the forward dependence and the subsequent propagation of the abnormal event belongs to the backward dependence, which solves the problem that the traditional LSTM cannot handle reverse causality.

[0111] Secondly, the multi-head self-attention layer can learn the diversified information between features. Compared with single-head attention, it can capture the information of different subspaces in the sequence, adaptively focus on key time steps, and improve the model's representation ability for complex patterns. Different attention heads focus on sub-space information such as routing frequency and AS path topology changes. Self-attention breaks through the local window limit of LSTM by calculating the global association between time steps, effectively identifying abnormal patterns across time steps, improving the sensitivity to multi-dimensional data and enhancing the model's ability to model long-distance dependencies, such as hijacking pattern recognition across time steps. Mining the complex patterns of context association before and after BGP abnormal interruption is of great significance for anomaly discovery and tracing.

[0112] 1) Data standardization layer

[0113] Since the dimensions of various attributes of the historical fusion features are different, in order to eliminate the scale difference between different features, batch normalization is performed on the input 55-dimensional high-dimensional features to help the network converge quickly and improve the generalization ability and algorithm stability. The data standardization layer normalization processing formula (6) is as follows:

[0114] (6)

[0115] wherein, is the average value of the drift detection score corresponding to the historical BGP data, is the standard deviation of the drift detection score corresponding to the historical BGP data. is the first learning parameter, is the second learning parameter, is the numerical stability term, is the input feature, is the input feature after standardization.

[0116] 2) Bidirectional LSTM encoding layer

[0117] The vector output by the data standardization layer is input into the bidirectional LSTM encoding layer to obtain the forward and backward hidden states simultaneously. The bidirectional LSTM encoding layer can capture both the forward and backward dependencies of the time series, thereby modeling the long and short-term features more comprehensively. For each time step t, the output includes the forward hidden state and the backward hidden state The forward hidden state captures historical dependence, and the backward hidden state captures future dependence. Finally, the two are concatenated and combined as formula (7):

[0118] (7)

[0119] The input of the input layer is time series data , where B is the batch size, T is the time step number, and D is the feature dimension. The bidirectional LSTM encoding layer has forward parameters, which are expressed by the following formula (8):

[0120] (8)

[0121] The backward parameters are expressed by the following formula:

[0122] (9)

[0123] The output is the bidirectional hidden state: Therefore, the embodiment can consider the context dependence of the time series.

[0124] 3) Multi-head attention layer

[0125] The multi-head self-attention mechanism calculates multiple attention heads in parallel to learn the diversified relationships between features. The bidirectional LSTM encoding layer output H is taken as the input of the multi-head self-attention, the attention weight is calculated, and the information is fused, and the output dimension is the same as the input. For each attention head i, the attention weight is calculated , and the weighted output is calculated, which is expressed by the following formula (10):

[0126] (10)

[0127] where, are linear transformations of queries, keys and values, respectively, is the dimension of the key vector.

[0128] The multi-head output is spliced and linearly transformed, which is expressed by the following formula (11):

[0129] (11)

[0130] where each self-attention head is expressed by the following formula (12):

[0131] (12)

[0132] is the third learning parameter, is the fourth learning parameter, is the fifth learning parameter,

[0133] Finally, the multi-head attention output of the last time step is used for classification.

[0134] 4) Classification output layer

[0135] The classification output layer is a fully connected layer that takes the multi-head attention output of the last time step and maps it to a 4-dimensional probability distribution for fine-grained classification: prefix hijacking, route leak, disruption, and normal. The calculation process is expressed by the following formula (13):

[0136] (13)

[0137] A four-layer hierarchical series architecture model is constructed: Input (B x T x N) → BatchNorm1d → Bi-LSTM (2H = 128) → Multi-Head Attention (4) → FC → Output. The input is the BGP feature extraction dataset, B is the batch size, T is the time step, and N is the read-in data feature dimension, with a bidirectional LSTM hidden unit For example, the output dimension is 128, which is input to the multi-head attention layer, with a dimension of 32 per head, and the fully connected layer weight matrix .

[0138] The BGP anomaly detection model in this embodiment combines the context modeling capability of bidirectional LSTM with the multi-dimensional feature expression capability of multi-head self-attention mechanism, and is suitable for processing complex and high-dimensional time series data. In BGP anomaly detection, this model can more effectively capture global and local features of abnormal patterns.

[0139] The traditional static route detection model training method for route anomaly detection is difficult to adapt to the changes in the mapping relationship between target variables and environmental variables in the network environment over time, that is, it is difficult to adapt to drift. This drift leads to problems such as a decrease in accuracy, an increase in false positives and false negatives when the route detection model faces new data distribution. Existing detection methods based on error rate or single distribution divergence are not sensitive enough to gradual drift in unsupervised scenarios, and cannot fully reflect the influence of changes in each dimension feature on the prediction of the route detection model. Therefore, there is an urgent need for a comprehensive and closed-loop concept drift detection and adaptive update mechanism to ensure the continuous and stable operation of the route detection model in a dynamic environment.

[0140] In the process of training the BGP anomaly detection model, the drift detection mechanism generates a drift detection score between the historical anomaly detection results and the historical BGP data, and the drift detection score is used as a reference benchmark to adaptively update the parameter values of the BGP anomaly detection model, thereby achieving the purpose of closed-loop optimization.

[0141] In some optional embodiments, the drift detection score between the historical anomaly detection result and the historical BGP data is calculated in the following manner.

[0142] Step d1, dimension reduction algorithm is used to reduce the dimension of the historical fusion feature to obtain a two-dimensional space vector.

[0143] Step d2, the number of dimensions of the historical fusion feature, the first divergence value of each dimension, the spatial drift distance of the two-dimensional space vector and the plurality of weight parameters are obtained.

[0144] Step d3, according to the two-dimensional space vector, the number of dimensions of the historical fusion feature, the first divergence value of each dimension, the spatial drift distance of the two-dimensional space vector and the plurality of weight parameters, the drift detection score corresponding to the historical BGP data is calculated.

[0145] In a specific example, in order to improve the detection efficiency and avoid calculating each high-dimensional feature, a dimension reduction algorithm is used to map the high-dimensional historical fusion feature to a two-dimensional space. The high-dimensional historical fusion feature in the historical time window is projected as a reference, and the high-dimensional route statistical feature in the observation time window is transformed, so that the high-dimensional historical fusion feature is converted into a two-dimensional space vector. Specifically, the following formula (14) is used to express:

[0146] (14)

[0147] The drift detection score is calculated in the two-dimensional space, and the following formula (15) is used to express:

[0148] (15)

[0149] Wherein, is the drift detection score, α is the first weight parameter, β is the second weight parameter, N is the number of dimensions of the historical fusion feature, is the first divergence value of each dimension, is the initial high-dimensional vector, is the two-dimensional space vector, that is, the spatial drift distance, that is, the Wasserstein distance of the two-dimensional vector obs_2d distribution, which comprehensively measures the distribution change between windows through the two-dimensional space vector.

[0150] The two-dimensional space vector in the above formula (15) and the first divergence value of each dimension is the drift detection index, and the two drift detection indexes are calculated by the following formula (16):

[0151] (16)

[0152] is the arithmetic mean distribution of P and Q distributions, that is: (x) (P(x) + Q(x)) / 2, Vx e X.

[0153] In the above formula (16), the second divergence value of each dimension is calculated by the following formula (17):

[0154] (17)

[0155] In the above formula (15), the two-dimensional space vector is calculated by the following formula (18):

[0156] (18)

[0157] is the first feature distribution within the observation time window, is the second feature distribution within the observation time window, X is the feature discrete value domain, Π is the joint distribution set of all historical fusion features, is the feature space distance, inf represents the lower bound, and represents the minimum value of the cost of taking the joint distribution set of all historical fusion features. The physical meaning represented by the above formula (18) is to find an optimal "transportation scheme" γ to distribute the mass of Pr to Qg so that the total transportation cost is the lowest, and ||x-y|| represents the Euclidean distance between the feature vectors x and y, E represents the mathematical expectation, i.e., the average value of the distance calculated for all possible pairs (x, y), and the overall meaning is to calculate the "average carrying distance" from Pr to Qg under the optimal transportation scheme γ.

[0158] In the above, the first divergence value of each dimension has symmetry and is more sensitive to gradual drift. In the above, the second divergence value of each dimension has symmetry and is not sensitive to feature scaling / translation, and is suitable for detecting sudden distribution mutation scenarios. In the above, the two-dimensional space vector has distribution non-overlapping robustness: it can effectively handle distributions with disjoint support sets.

[0159] The embodiment combines multiple drift detection indicators in the above, calculates the drift detection score in the above formula (15), and can comprehensively reflect the subtle changes of message statistical features and model output distribution, and overcome the problem of insufficient sensitivity of a single indicator such as error rate under gradual drift.

[0160] In some optional embodiments, the drift detection threshold serving as a reference benchmark for the drift detection score is calculated by the following formula:

[0161] Step e1, obtaining the average of the drift detection scores corresponding to the historical BGP data and the standard deviation of the drift detection scores corresponding to the historical BGP data within the target time window.

[0162] Specifically, the target time window can be a lookback time window. For example, a continuous time series is divided into three parts according to a time granularity, such as 1 minute, which are a history time window [t - ΔT_lookback, t), an observation time window [t, t + ΔT_detection), and a lookback time window [T_start, t]. Among them, the history time window is used to learn the historical distribution, the observation time window is used for current drift detection, and the lookback time window is used to dynamically calculate the drift threshold.

[0163] Step e2, obtaining a sensitivity coefficient.

[0164] Step e3, calculating the drift detection threshold corresponding to the historical BGP data at the current moment and the drift detection threshold corresponding to the historical BGP data at the previous moment of the current moment according to the sensitivity coefficient, the average of the drift detection scores corresponding to the historical BGP data, and the standard deviation of the drift detection scores corresponding to the historical BGP data.

[0165] Step e4, obtaining a smoothness coefficient.

[0166] In a specific example, the drift detection threshold corresponding to the historical BGP data at the current moment and the drift detection threshold corresponding to the historical BGP data at the previous moment of the current moment are calculated according to the sensitivity coefficient, the average of the drift detection scores corresponding to the historical BGP data, and the standard deviation of the drift detection scores corresponding to the historical BGP data, which are calculated by the following formula (19):

[0167] (19)

[0168] Wherein, is the drift detection threshold corresponding to the historical BGP data at the current moment, that is, the drift decision boundary, is the average of the drift detection scores corresponding to the historical BGP data, that is, the average of the drift scores in the lookback time window, is the standard deviation of the drift detection scores corresponding to the historical BGP data, that is, the standard deviation of the drift scores in the lookback time window, is the sensitivity coefficient, and the drift detection threshold is updated by using an exponential moving average smoothing to reduce false positives caused by mutations.

[0169] The average of the drift detection scores corresponding to the historical BGP data in the above formula (19) is calculated by the following formula (21).

[0170] Definition of error rate drift index obtain the drift detection score of the current time window through a sliding window and calculate the average of the drift detection scores corresponding to the historical BGP data the standard deviation of the drift detection scores corresponding to the historical BGP data The formula is as follows:

[0171] (20)

[0172] Wherein, a is a standard deviation adjustment factor, controlling the influence degree of historical fluctuations on current detection, the larger a is, the more sensitive to historical fluctuations, is the number of backtracking time windows.

[0173] (21)

[0174] the standard deviation of the drift detection scores corresponding to the historical BGP data It is calculated by the following formula (22):

[0175] (22)

[0176] The smoothing coefficient k in the above is calculated by the following formula (23).

[0177] The distribution of statistical characteristics is usually continuous variable, this embodiment adopts dynamic binning strategy, and performs probability density estimation on input feature x by kernel density estimation (KDE) algorithm. The calculation formula (23) is as follows:

[0178] (23) wherein, is the kernel density estimation function, is the sensitivity coefficient, is the feature value of the i-th time point, N is the sample quantity, and h is the bandwidth parameter, and the optimal value is obtained by minimizing the mean square error cross validation. Gaussian kernel function is usually used, that is, as shown in the following formula (24):

[0179] (24) wherein, u is the normalized distance, , is the distance attenuation factor,

[0180] is a normalization constant, which keeps the probability density integral constant, and thus the smooth density distribution of the historical time window and the observation time window at each sampling point can be obtained, that is, the smoothing coefficient k in the above.

[0181] Step e5, calculating the drift detection threshold of the drift detection score reference benchmark according to the smoothness coefficient, the drift detection threshold corresponding to the historical BGP data at the current moment, and the drift detection threshold corresponding to the historical BGP data at the previous moment of the current moment.

[0182] In a specific example, the drift detection threshold of the drift detection score reference benchmark is expressed by the following formula (25):

[0183] (25)

[0184] wherein, is the drift detection threshold of the drift detection score reference benchmark, that is, the drift detection threshold after smoothing processing, is the smoothness coefficient, controlling the update speed, is the drift detection threshold corresponding to the historical BGP data at the current moment, is the drift detection threshold corresponding to the historical BGP data at the previous moment of the current moment, ensuring that the drift detection threshold is dynamically smoothed and updated with data.

[0185] As shown in FIG. 5, it is a time sequence change schematic diagram of the drift of the historical BGP data, in which the red polygonal shape is a pre-warning area. Figure 4 Figure 4

[0186] The step S104 described above, the drift detection score updates the plurality of parameter values of the border gateway protocol anomaly detection model adaptively with the drift detection threshold as the reference benchmark, which is implemented by the following steps:

[0187] When the drift detection score exceeds the drift detection threshold, the plurality of parameter values of the border gateway protocol anomaly detection model are repeatedly updated multiple times until the drift detection score is less than the drift detection threshold.

[0188] For example, when the drift detection score exceeds the drift detection threshold, the plurality of parameter values of the border gateway protocol anomaly detection model are repeatedly updated multiple times until the drift detection score is less than the drift detection threshold.

[0189] Specifically, once the detection module in the computing device determines that the drift occurs, the adaptive updating link will be automatically triggered in this embodiment to adapt to the new data distribution. This embodiment adopts two types of methods to realize model updating: incremental retraining and integrated model updating. The former iteratively updates the learning parameters of each attribute through model incremental learning, and eliminates the old model; the latter constructs a model pool through pre-defined model switching, parameter fine-tuning and incremental learning strategies, and realizes multi-model dynamic fusion and adaptive optimization. The adaptive updating strategy includes:​​​​​​

[0190] (1) Incremental retraining:

[0191] Incremental learning of the model using newly collected data to update the parameters of each attribute, eliminate old parameters, and make the model adapt to the current data distribution again;

[0192] (2) Integrated model update:

[0193] This embodiment maintains a pool of pre-trained models, for example, a model pool is constructed and pre-trained in the initial stage , containing multiple candidate border gateway protocol anomaly detection models. The pre-training data comes from historical BGP data arranged in chronological order, ensuring that each model achieves preliminary results in a stable environment.

[0194] During the training of the border gateway protocol anomaly detection model, when the drift detection score DriftScore exceeds the drift detection threshold and is updated by the exponential moving average smoothing, the adaptive update process is triggered. Specifically, the following contents are included:

[0195] (1) Data preparation extracts samples with new labels Dnew from the latest observation time window to ensure that the data granularity is consistent with the original data.

[0196] (2) Performance evaluation calculates the performance indicator F1-score using the sample Dnew with new labels for each model in the model pool, denoted as F1( ). Select the model with the highest F1 score on the sample Dnew from the model pool M, denoted as the best performance model Mopt, and determine the best model .

[0197] (3) Dynamic retraining If the F1 of each model does not reach a certain proportion of the best performance model Mopt, i.e. , then incremental retraining is performed. The specific process is as follows: a. Use the sample Dnew with new labels to

[0198] perform several rounds of iterative training, using a fixed learning rate or tuning strategy, to obtain the updated model .

[0199] b. When updating the training parameters, if the loss of the validation set does not decrease for several consecutive times, the early stopping strategy can be used to avoid overfitting.

[0200] (4) Model pool update updates the model ​Replace the original model with poor performance At the same time, revalidate the entire model pool to ensure that each model meets the performance requirements under the current data distribution.

[0201] (5) The integrated output is weighted and fused using the prediction output generated by the updated model pool. The final output probability is defined as shown in the following formula:

[0202] (26)

[0203] wherein, According to the performance of the model on the validation set, such as F1 score and confidence dynamic allocation, to ensure that the best model has a higher weight.

[0204] As Figure 5 shown, the confusion matrix diagram of the normal window and the drift window under different strategies. In Figure 5 , the classification effect of the anomaly detection method with and without adaptive update strategy is compared, and the results show that in the drift window and the normal window, Figure 5 b in the figure relative to a, and d relative to c, the adaptive update strategy can effectively improve the detection accuracy of the border gateway protocol anomaly detection model. In Figure 5 , especially in the time window when the drift occurs, that is, d relative to c, the highest accuracy of the border gateway protocol anomaly detection model is improved by 20%.

[0205] To obtain multiple weight parameters of the optimal border gateway protocol anomaly detection model, the following strategies are adopted in this embodiment:

[0206] (a) Hyperparameters are jointly tuned using grid search and tree-structured Parzen Estimator (TPE) algorithm. The learning rate is logarithmically uniformly sampled in [1e-5, 1e-3], the number of attention heads is about 8, and the window size is in the range of [20, 70]. Optuna tool is used for auxiliary analysis, as shown in Figure 6A , which is a parameter selection diagram for the training process of the border gateway protocol anomaly detection model. For example, when the positive and negative sample sampling ratio is 2, the window size range is The optimal model parameters can be trained.

[0207] (b) Early stopping strategy is used: if the validation set loss does not decrease for 10 consecutive times, the training of the current parameter configuration is terminated.

[0208] (c) To ensure the robustness of the model, cross-validation is performed on the training data, and the five sets of super parameters with the best performance of each model are finally selected as the benchmark, and are compared with the multi-scale LSTM model and the self-attention LSTM as the benchmark model.

[0209] In this embodiment, a bidirectional interactive self-attention mechanism LSTM model can be built by using a Pytorch framework. The batch size B, the time step T and the feature dimension D are determined by the characteristics of the data set during training. The training process is performed by grid parameter tuning, as shown in Figure 6B The highest classification result accuracy of the BGP anomaly detection model after parameter tuning is 99.7%. After a large number of experiments, the bidirectional interactive self-attention mechanism LSTM model converges after about 458 parameter combination experiments, and the optimal super parameters are determined.

[0210] During the training of the BGP anomaly detection model, the following evaluation indexes can be used: accuracy (Accuracy), precision (Precision), recall (Recall) and F1-Score as evaluation indexes.

[0211] (27)

[0212] (28)

[0213] (29)

[0214] (30)

[0215] Wherein, the number of abnormal data classified as abnormal is TP, the number of normal data classified as abnormal is defined as FP, the number of abnormal data classified as normal is FN, and the number of normal data classified as normal is TN.

[0216] In this embodiment, a BGP anomaly detection model training device is also provided, which is used to implement the above embodiments and preferred embodiments, and will not be described again. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware is also possible and is contemplated.

[0217] This embodiment provides a BGP anomaly detection model training device, as shown in Figure 7 , comprising:

[0218] The historical data acquisition module 701 is configured to acquire historical BGP data arranged in time sequence.

[0219] The historical feature extraction module 702 is configured to extract historical route statistical features and historical graph topology features corresponding to the historical BGP data, and the historical route statistical features and the historical graph topology features influence dynamic changes of the historical BGP data in the BGP network;

[0220] The historical feature fusion module 703 is configured to fuse the historical route statistical features and the historical graph topology features to obtain historical fusion features corresponding to the historical BGP data.

[0221] The historical feature training module 704 is configured to input the historical fusion features into the BGP anomaly detection model training to obtain historical anomaly detection results corresponding to the historical BGP data and a drift detection score between the historical anomaly detection results and the historical BGP data, and the drift detection score is used as a reference benchmark to adaptively update a plurality of parameter values of the BGP anomaly detection model.

[0222] In some optional embodiments, the historical route statistical features include a plurality of historical route volume features, a plurality of historical route length features and a plurality of historical route behavior features, the historical graph topology features include historical global graph density features, historical maximum betweenness centrality features and historical business relationship entropy features, and the historical feature extraction module 702 includes:

[0223] The first processing submodule is configured to perform cleaning processing on the historical BGP data.

[0224] The second processing submodule is configured to parse the plurality of historical route volume features, the plurality of historical route length features and the plurality of historical route behavior features according to the historical BGP data after the cleaning processing.

[0225] The third processing submodule is configured to select historical BGP path data from the historical BGP data after the cleaning processing.

[0226] The feature mapping submodule is configured to input the historical BGP path data into a BGP graph topology database for graph topology mapping to obtain the historical global graph density features, the historical maximum betweenness centrality features and the historical business relationship entropy features.

[0227] In some optional embodiments, the historical feature fusion module 703 includes:

[0228] The interpolation processing submodule is configured to perform interpolation processing on the historical route statistical features by using a center interpolation method.

[0229] The feature fusion submodule is configured to splice the historical graph topology features and the historical route statistical features after the interpolation processing in a time sequence to obtain the historical fusion features corresponding to the historical BGP data.

[0230] In some optional embodiments, the border gateway protocol anomaly detection model is a multi-head self-attention bidirectional long short-term memory model, and the multi-head self-attention bidirectional long short-term memory model comprises a data standardization layer, a bidirectional long short-term memory encoding layer, a multi-head self-attention layer, and a classification output layer. The historical fusion features sequentially pass through the data standardization layer, the bidirectional long short-term memory encoding layer, the multi-head self-attention layer, and the classification output layer for feature processing to obtain the anomaly detection result corresponding to the historical BGP data.

[0231] In some optional embodiments, the history feature training module 704 calculates the drift detection score between the historical anomaly detection result and the historical BGP data by the following submodules.

[0232] The dimension reduction processing submodule is configured to perform dimension reduction processing on the historical fusion features by using a dimension reduction algorithm to obtain a two-dimensional space vector.

[0233] The feature acquisition submodule is configured to acquire the number of dimensions of the historical fusion features, the first divergence value of each dimension, the spatial drift distance of the two-dimensional space vector, and the plurality of weight parameters.

[0234] The feature calculation submodule is configured to calculate the drift detection score corresponding to the historical BGP data according to the two-dimensional space vector, the number of dimensions of the historical fusion features, the first divergence value of each dimension, the spatial drift distance of the two-dimensional space vector, and the plurality of weight parameters.

[0235] In some optional embodiments, the history feature training module 704 calculates the drift detection threshold serving as the reference benchmark of the drift detection score by the following submodules.

[0236] The first acquisition submodule is configured to acquire the average value of the drift detection scores corresponding to the historical BGP data and the standard deviation of the drift detection scores corresponding to the historical BGP data within the target time window.

[0237] The second acquisition submodule is configured to acquire the sensitivity coefficient.

[0238] The first calculation submodule is configured to calculate the drift detection threshold corresponding to the historical BGP data at the current moment and the drift detection threshold corresponding to the historical BGP data at the previous moment of the current moment according to the sensitivity coefficient, the average value of the drift detection scores corresponding to the historical BGP data, and the standard deviation of the drift detection scores corresponding to the historical BGP data.

[0239] The third acquisition submodule is configured to acquire the smoothness coefficient.

[0240] The second calculation sub-module is configured to calculate a drift detection threshold value serving as a reference benchmark of the drift detection score according to the smoothness coefficient, the drift detection threshold value corresponding to the historical BGP data at the current moment, and the drift detection threshold value corresponding to the historical BGP data at the previous moment of the current moment.

[0241] In some optional embodiments, the historical feature training module 704 is implemented by the following sub-modules:

[0242] The adaptive updating sub-module is configured to repeatedly update the plurality of parameter values of the border gateway protocol anomaly detection model for multiple times when the drift detection score exceeds the drift detection threshold value, until the drift detection score is less than the drift detection threshold value.

[0243] Further function descriptions of the above-mentioned modules and units are the same as those of the corresponding embodiments, and will not be described here again.

[0244] The training device of the border gateway protocol anomaly detection model in the embodiment is presented in the form of a functional unit. The unit herein refers to an ASIC (Application Specific Integrated Circuit, Application Specific Integrated Circuit) circuit, a processor and a memory executing one or more software or fixed programs, and / or other devices that can provide the above-mentioned functions.

[0245] The embodiment of the present application also provides a computer device with the above-mentioned training device of the border gateway protocol anomaly detection model.

[0246] Please refer to Figure 8 , Figure 8 is a structural schematic diagram of a computer device provided by an optional embodiment of the present application, as Figure 8 shown, the computer device includes one or more processors 10, a memory 20, and an interface for connecting various components, including a high-speed interface and a low-speed interface. Various components are communicatively connected to each other by different buses, and can be installed on a common mainboard or in other ways as needed. The processor can process instructions executed in the computer device, including instructions stored in the memory or on the memory to display graphical information on a GUI on an external input / output device (such as a display device coupled to the interface). In some optional embodiments, multiple processors and / or multiple buses can be used with multiple memories and multiple memories, if necessary. Similarly, multiple computer devices can be connected, each providing part of the necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 8 In the figure, the processor 10 is taken as an example.

[0247] The processor 10 can be a central processor, a network processor, or a combination thereof. The processor 10 can further include hardware chips. The hardware chips can be application specific integrated circuits, programmable logic devices, or a combination thereof. The programmable logic devices can be complex programmable logic devices, field programmable logic gate arrays, general array logic, or any combination thereof.

[0248] The memory 20 stores instructions executable by the at least one processor 10 to cause the at least one processor 10 to perform the methods illustrated by the above embodiments.

[0249] The memory 20 can include a program storage area and a data storage area. The program storage area can store an operating system, application programs required by at least one function, and the like. The data storage area can store data created according to the use of the computer device, and the like. In addition, the memory 20 can include a high-speed random access memory, and can further include a non-transitory memory such as at least one disk storage device, a flash memory device, or other non-transitory solid state memory device. In some alternative embodiments, the memory 20 can optionally include a memory disposed remotely from the processor 10, which can be connected to the computer device through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0250] The memory 20 can include a volatile memory such as a random access memory, and can also include a non-volatile memory such as a flash memory, a hard disk, or a solid state disk. The memory 20 can further include a combination of the above-mentioned types of memories.

[0251] The computer device further includes a communication interface 30 for communication of the computer device with other devices or communication networks.

[0252] The embodiments of the present application also provide a computer readable storage medium. The above-mentioned methods according to the embodiments of the present application can be implemented in hardware, firmware, or recorded in a storage medium, or stored in a remote storage medium or a non-transitory machine readable storage medium and downloaded to a local storage medium through network downloading, so that the methods described herein can be processed by such software on a storage medium using a general purpose computer, a special purpose processor, or programmable or special purpose hardware. The storage medium can be a disk, an optical disk, a read-only memory, a random access memory, a flash memory, a hard disk, or a solid state disk, etc. Further, the storage medium can further include a combination of the above-mentioned types of memories. It can be understood that the computer, the processor, the microprocessor controller, or the programmable hardware includes a storage component that can store or receive software or computer code, when the software or computer code is accessed and executed by the computer, the processor, or the hardware, the methods illustrated by the above embodiments are implemented.

[0253] While embodiments of the present application have been described in conjunction with the appended drawings, various modifications and changes are possible within the spirit and scope of the present application, and such modifications and changes are intended to fall within the scope of the appended claims.

Claims

1. A method for training a border gateway protocol anomaly detection model, characterized in that, The method comprises: obtaining historical BGP data arranged in time sequence; extracting historical route statistical features and historical graph topology features corresponding to the historical BGP data, the historical route statistical features and the historical graph topology features affecting dynamic changes of the historical BGP data in a BGP network; fusing the historical route statistical features and the historical graph topology features to obtain historical fusion features corresponding to the historical BGP data; inputting the historical fusion features into a border gateway protocol anomaly detection model for training to obtain historical anomaly detection results corresponding to the historical BGP data, and obtaining a corresponding drift detection score through the historical BGP data, the drift detection score taking a drift detection threshold as a reference benchmark to adaptively update a plurality of parameter values of the border gateway protocol anomaly detection model; wherein the drift detection score is calculated by: using a dimension reduction algorithm to perform dimension reduction processing on the historical fusion features to obtain a two-dimensional space vector; obtaining a dimension number of the historical fusion features, each dimension first divergence value, a space drift distance of the two-dimensional space vector, and a plurality of weight parameters; and calculating the drift detection score corresponding to the historical BGP data according to the two-dimensional space vector, the dimension number of the historical fusion features, the each dimension first divergence value, the space drift distance of the two-dimensional space vector, and the plurality of weight parameters; the drift detection threshold of the drift detection score reference benchmark is calculated by: obtaining a sensitivity coefficient; calculating the drift detection threshold corresponding to the historical BGP data at the current time and the drift detection threshold corresponding to the historical BGP data at the previous time of the current time according to the sensitivity coefficient, the average value of the drift detection score corresponding to the historical BGP data, and the standard deviation of the drift detection score corresponding to the historical BGP data; obtaining a smoothness coefficient; and calculating the drift detection threshold as the drift detection score reference benchmark according to the smoothness coefficient, the drift detection threshold corresponding to the historical BGP data at the current time, and the drift detection threshold corresponding to the historical BGP data at the previous time of the current time. 2.The method of claim 1, wherein, The historical route statistical features include: a plurality of historical route volume features, a plurality of historical route length features, and a plurality of historical route behavior features; the historical graph topology features include: historical global graph density features, historical maximum betweenness centrality features, and historical business relationship entropy features, the extracting the historical route statistical features and the historical graph topology features corresponding to the historical BGP data comprises: cleaning the historical BGP data; parsing the plurality of historical route volume features, the plurality of historical route length features, and the plurality of historical route behavior features according to the historical BGP data after cleaning; selecting historical BGP path data from the historical BGP data after cleaning; The historical BGP path data is input into a BGP graph topology database for graph topology mapping, to obtain the historical global graph density feature, the historical maximum betweenness centrality feature, and the historical business relationship entropy feature. 3.The method of training a BGP anomaly detection model according to claim 1 or 2, characterized in that, The historical route statistical feature and the historical graph topology feature are fused to obtain a historical fusion feature corresponding to the historical BGP data, including: The historical route statistical feature is processed by interpolation using a center interpolation method. The historical graph topology feature and the historical route statistical feature after the interpolation processing are spliced according to the time sequence to obtain the historical fusion feature corresponding to the historical BGP data. 4.The method of claim 1, wherein, The boundary gateway protocol anomaly detection model is a multi-head self-attention bidirectional long short-term memory model, which includes a data standardization layer, a bidirectional long short-term memory encoding layer, a multi-head self-attention layer, and a classification output layer. The historical fusion feature sequentially passes through the data standardization layer, the bidirectional long short-term memory encoding layer, the multi-head self-attention layer, and the classification output layer for feature processing, to obtain an anomaly detection result corresponding to the historical BGP data. 5.The method of claim 1, wherein, The drift detection score adaptively updates a plurality of parameter values of the boundary gateway protocol anomaly detection model with a drift detection threshold as a reference benchmark, by the following steps: When the drift detection score exceeds the drift detection threshold, the plurality of parameter values of the boundary gateway protocol anomaly detection model are repeatedly updated multiple times until the drift detection score is less than the drift detection threshold. 6.A device for training a border gateway protocol anomaly detection model, characterized in that, The device includes: a historical data acquisition module configured to acquire historical BGP data arranged in a time sequence; a historical feature extraction module configured to extract historical route statistical features and historical graph topology features corresponding to the historical BGP data, which affect dynamic changes of the historical BGP data in a BGP network; a historical feature fusion module configured to fuse the historical route statistical features and the historical graph topology features to obtain historical fusion features corresponding to the historical BGP data; a historical feature training module configured to input the historical fusion features into a boundary gateway protocol anomaly detection model for training, to obtain historical anomaly detection results corresponding to the historical BGP data, and to obtain a drift detection score corresponding to the historical BGP data, which adaptively updates a plurality of parameter values of the boundary gateway protocol anomaly detection model with a drift detection threshold as a reference benchmark; The drift detection score is calculated by the following method: a dimension reduction algorithm is used to perform dimension reduction processing on the historical fusion features to obtain a two-dimensional space vector; the number of dimensions of the historical fusion features, each dimension first divergence value, the space drift distance of the two-dimensional space vector, and a plurality of weight parameters are obtained; and the drift detection score corresponding to the historical BGP data is calculated according to the two-dimensional space vector, the number of dimensions of the historical fusion features, the each dimension first divergence value, the space drift distance of the two-dimensional space vector, and the plurality of weight parameters. The drift detection threshold of the drift detection score reference benchmark is calculated by: obtaining a sensitivity coefficient; calculating the drift detection threshold corresponding to the historical BGP data at the current moment and the drift detection threshold corresponding to the historical BGP data at the previous moment of the current moment according to the sensitivity coefficient, the average of the drift detection scores corresponding to the historical BGP data and the standard deviation of the drift detection scores corresponding to the historical BGP data; obtaining a smoothing coefficient; and calculating the drift detection threshold as the drift detection score reference benchmark according to the smoothing coefficient, the drift detection threshold corresponding to the historical BGP data at the current moment and the drift detection threshold corresponding to the historical BGP data at the previous moment of the current moment.

7. A computer device, characterized by Comprise: A memory and a processor, which are connected in communication with each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the training method of the border gateway protocol anomaly detection model according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for causing a computer to execute the training method of the border gateway protocol anomaly detection model according to any one of claims 1 to 5.

Images