BGP (Border Gateway Protocol) routing anomaly detection method and system based on graph attention auto-encoder

Abstract

The invention discloses a BGP (Border Gateway Protocol) routing anomaly detection method and system based on a graph attention auto-encoder. The method comprises the following steps: step 1, collecting normal BGP data when routing anomaly does not occur on the Internet, and constructing an AS-level topological graph; 2, obtaining AS-level topological graph representation according to a graph attention auto-encoder model encoder; 3, obtaining a reconstructed adjacent matrix according to a graph attention auto-encoder model decoder; step 4, training a graph attention auto-encoder model; 5, obtaining target BGP data and constructing an AS-level topological graph sequence corresponding to the target BGP data; step 6, obtaining AS node embedding of the AS-level topological graph sequence according to an encoder in the pre-trained graph attention auto-encoder model; and 7, embedding and inputting the AS nodes into the multi-layer perceptron model to obtain an anomaly detection result. According to the invention, the key AS is convenient to pay attention, and the accuracy of anomaly detection is improved.

Description

Technical Field

[0001] This invention relates to the field of inter-domain routing security technology, and in particular to a BGP routing anomaly detection method and system based on graph attention autoencoders. Background Technology

[0002] Border Gateway Protocol (BGP) is the most widely used inter-domain routing protocol, enabling the exchange of routing information between Autonomous Systems (AS). However, BGP itself has security vulnerabilities, making it susceptible to malicious attacks and misconfigurations, leading to anomalies such as prefix hijacking and route leakage. These anomalies severely impact network reachability and pose a significant threat to BGP routing systems. Therefore, detecting routing anomalies is crucial for monitoring network operational status and maintaining network security and stability.

[0003] Early methods for route anomaly detection included time series analysis, statistical pattern recognition, and reachability checks. In recent years, machine learning has shown good performance in the field of anomaly detection. How to extract effective features is the focus of research for this type of method. Currently, there are two main ways to extract features: manual extraction and automatic extraction based on graph representation learning models.

[0004] (1) Routing anomaly detection method based on manually extracted features

[0005] Most existing methods detect routing anomalies by manually extracting features, which can be mainly divided into two categories: statistical features and graph features. Statistical features include the number of update messages, the announcement interval, and the average and maximum length of AS paths. Graph features include centrality, clustering coefficient, average degree of neighboring nodes, and the maximum size of the connected subgraph.

[0006] However, manually extracting and selecting features that depend on domain knowledge can easily lead to feature redundancy or the loss of important features. In addition, designing features is very time-consuming and costly, which affects the accuracy and efficiency of routing anomaly detection.

[0007] (2) Routing anomaly detection method based on feature extraction from graph representation learning model

[0008] Graph representation learning can represent graphs as low-dimensional vectors while preserving most of the network structure information within the graph. It only requires inputting the graph and a small amount of initial node features into the graph representation learning model to automatically extract graph features. In recent years, some research has made progress in routing anomaly detection based on graph representation learning models. However, existing typical graph representation learning-based detection methods assume that different ASs have the same probability and impact on routing anomalies when aggregating neighbor node information to update AS node embeddings. In reality, however, ASs that cause routing anomalies often play an important role in the network. Existing methods use averaging or summation to aggregate AS neighbor node features, leading to interference from many unimportant or even irrelevant ASs in anomaly detection. Furthermore, existing detection methods typically use supervised learning to train the model, requiring labeled datasets. However, BGP anomaly data is scarce, and obtaining large amounts of labeled data is difficult. These issues affect the effectiveness of large-scale BGP routing anomaly detection. Summary of the Invention

[0009] To address the problems of existing machine learning-based routing anomaly detection methods being susceptible to interference from unimportant AS nodes and struggling to acquire large amounts of labeled anomaly data, this invention provides a BGP routing anomaly detection method and system based on a graph attention autoencoder. By introducing an attention mechanism into the graph autoencoder, the importance of ASs is evaluated and weights are assigned, focusing more on important ASs that may experience routing anomalies, thus improving anomaly detection accuracy. Furthermore, this invention employs unsupervised learning to pre-train the graph attention autoencoder model, learning routing behavior patterns from normal BGP data, thereby avoiding reliance on labeled BGP anomaly data.

[0010] To achieve the above objectives, the technical solution of the present invention is as follows:

[0011] The first aspect of this invention proposes a BGP routing anomaly detection method based on a graph attention autoencoder, comprising:

[0012] Step 1: Collect normal BGP data when no routing anomalies occur on the Internet, and construct an AS-level topology map based on the normal BGP data;

[0013] Step 2: Input the AS-level topology graph into the encoder in the preset graph attention autoencoder model to process all AS nodes in the AS-level topology graph to obtain the AS-level topology graph representation, which is convenient for subsequent reconstruction of the adjacency matrix.

[0014] Step 3: Input the AS-level topological graph representation into the decoder of the preset graph attention autoencoder model to obtain the reconstructed adjacency matrix, which is convenient for subsequent model training;

[0015] Step 4: Calculate the loss between the true adjacency matrix and the reconstructed adjacency matrix using the loss function, and train the graph attention autoencoder model by minimizing the loss to obtain the pre-trained graph attention autoencoder model, which facilitates the improvement of detection accuracy;

[0016] Step 5: Obtain the target BGP data and construct the AS-level topology graph sequence corresponding to the target BGP data;

[0017] Step 6: Input the AS-level topology graph sequence of the target BGP data into the encoder of the pre-trained graph attention autoencoder model to process the AS nodes in the AS-level topology graph sequence and obtain the AS node embedding, which is convenient for subsequent judgment of abnormal situations.

[0018] Step 7: Embed the AS nodes into the multilayer perceptron model for classification to obtain anomaly detection results.

[0019] Furthermore, the graph attention autoencoder model includes an encoder and an inner product decoder. The encoder includes two stacked graph attention layers with a ReLU activation function layer between them. The two graph attention layers have the same structure.

[0020] The first graph attention layer is used to transform the AS-level topology graph into AS node embeddings that contain network structure information.

[0021] The second graph attention layer is used to update the AS node embeddings, which facilitates the learning of more complex deep features.

[0022] Furthermore, the processing procedure of the graph attention layer specifically includes:

[0023] Calculate the correlation degree between AS nodes and their neighboring nodes in an AS-level topology graph sequence;

[0024] Calculate the attention coefficients of AS nodes and their neighboring nodes based on the correlation degree;

[0025] The AS node embedding is obtained based on the attention coefficient.

[0026] Furthermore, the correlation degree between the AS node and its neighboring nodes is expressed by the following formula:

[0027]

[0028] in, Let be the correlation between AS node i and AS node j in the k-th graph attention layer, and LeakyReLU be the activation function. W is a learnable weight vector. (k) The weight matrix is ​​a learnable matrix. The AS node embedding of AS node i output by the (k-1)th graph attention layer. For the AS node embedding of AS node j output by the (k-1)th graph attention layer, || is the splicing operation;

[0029] The attention coefficient is expressed by the following formula:

[0030]

[0031] in, Let N be the attention coefficients of AS nodes i and j in the k-th graph attention layer. i Let AS be the set of neighboring AS nodes of AS node i;

[0032] The AS node embedding obtained based on the attention coefficient is specifically expressed by the following formula:

[0033]

[0034] in, σ is the AS node embedding of AS node i output by the k-th graph attention layer, where σ is the activation function.

[0035] Furthermore, the loss function is expressed by the following formula:

[0036]

[0037] Among them, L GATE Let A be the loss function. ij For the true adjacency matrix, To reconstruct the adjacency matrix, E p E represents the number of edges in an AS-level topological graph. n This represents the number of edges that do not exist in the AS-level topology graph.

[0038] A second aspect of this invention proposes a BGP routing anomaly detection system based on a graph attention autoencoder, comprising:

[0039] The first preprocessing module is used to collect normal BGP data when no routing anomalies occur on the Internet, and to construct an AS-level topology map based on the normal BGP data;

[0040] The first encoding module is used to input the AS-level topology graph into the encoder in the preset graph attention autoencoder model to process all AS nodes in the AS-level topology graph to obtain the AS-level topology graph representation, which is convenient for subsequent reconstructing the adjacency matrix.

[0041] The decoding module is used to input the AS-level topological graph representation into the decoder in the preset graph attention autoencoder model to obtain the reconstructed adjacency matrix, which is convenient for subsequent model training.

[0042] The training module is used to calculate the loss between the real adjacency matrix and the reconstructed adjacency matrix through a loss function, and to train the graph attention autoencoder model by minimizing the loss, thereby obtaining a pre-trained graph attention autoencoder model, which facilitates the improvement of detection accuracy.

[0043] The second preprocessing module is used to acquire target BGP data and construct the AS-level topology graph sequence corresponding to the target BGP data;

[0044] The second encoding module is used to input the AS-level topology graph sequence of the target BGP data into the encoder of the pre-trained graph attention autoencoder model to process the AS nodes in the AS-level topology graph sequence and obtain the AS node embedding, which is convenient for subsequent judgment of abnormal situations.

[0045] The detection module is used to embed AS nodes into the multilayer perceptron model for classification and obtain anomaly detection results.

[0046] A third aspect of the present invention provides an electronic device including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements a BGP routing anomaly detection method based on a graph attention autoencoder as described in the first aspect above.

[0047] A fourth aspect of the present invention provides a computer-readable storage medium comprising a stored computer program, wherein, when the computer program is executed, it controls the device where the storage medium is located to perform a BGP routing anomaly detection method based on a graph attention autoencoder as described in the first aspect above.

[0048] The beneficial effects of this invention are:

[0049] The graph attention autoencoder model employed in this invention focuses more on important ASs that may experience routing anomalies, reducing interference from unimportant or even irrelevant ASs and improving routing anomaly detection. This invention utilizes only AS-level topology graph data from when no anomalies occur on the Internet to pre-train the graph attention autoencoder model, learning normal BGP routing behavior. Then, the encoder in the trained graph attention autoencoder model generates AS node embeddings for the AS-level topology graph sequence to be detected. These AS node embeddings are then classified using a multilayer perceptron model to achieve BGP routing anomaly detection. This training method avoids the reliance of traditional supervised learning methods on large amounts of accurate, labeled BGP anomaly data. Attached Figure Description

[0050] Figure 1 This is a flowchart of a BGP routing anomaly detection method based on a graph attention autoencoder, provided for an embodiment of the present invention.

[0051] Figure 2 This is a schematic diagram of a BGP routing anomaly detection method based on a graph attention autoencoder provided in an embodiment of the present invention.

[0052] Figure 3 This is a schematic diagram of an encoder provided in an embodiment of the present invention.

[0053] Figure 4 This is a schematic diagram of a multilayer perceptron model provided in an embodiment of the present invention.

[0054] Figure 5 This is a schematic diagram comparing the reconstruction errors of the AS-level topology graphs with and without anomalies, as provided in an embodiment of the present invention.

[0055] Figure 6 This is an architecture diagram of a BGP routing anomaly detection system based on a graph attention autoencoder, provided in an embodiment of the present invention. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of the embodiments of this invention will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0057] Example 1

[0058] like Figure 1 and Figure 2 As shown, a BGP routing anomaly detection method based on graph attention autoencoders includes:

[0059] S101: Collect normal BGP data when no routing anomalies occur on the Internet, and construct an AS-level topology map based on the normal BGP data.

[0060] Specifically, download and collect normal BGP data from when no routing anomalies have occurred on the Internet. The network is usually operating normally one day before a routing anomaly event occurs, and the routing tables and update messages at this time are collected as normal BGP data (including routing tables and update messages), sourced from the RouteViews and RIPE RIS projects.

[0061] Parse the raw BGP data. The raw BGP packets are decompressed into MRT format files. The BGP packet parsing tool bgpdump converts this binary file format routing table and update messages into a readable format.

[0062] The AS_PATH field (Autonomous System Path field) is preprocessed. The AS_PATH attribute in BGP data contains an ordered list of ASNs (Autonomous System Numbers), describing the sequence of ASNs required to reach the target network. By extracting AS (Autonomous System) adjacency pairs from AS_PATH, the connectivity relationships of nodes in the AS topology are obtained, thus constructing the Internet AS-level topology. After extracting the AS_PATH field from the BGP message, it needs to be preprocessed. This step specifically includes the following sub-steps:

[0063] Compression processing. The BGP protocol allows routers to add their local AS to the AS_PATH attribute multiple times consecutively, increasing the overall route length and interfering with peer routing decisions. Therefore, such paths need to be compressed during data extraction.

[0064] Filter out self-loops in AS_PATH. When administrators manually configure BGP rules, human error may cause self-loops to appear, so they need to be removed.

[0065] Remove reserved ASNs from AS_PATH. Reserved ASNs cannot be used on the public internet and need to be removed according to the table provided by the Internet Corporation for Assigned Numbers (ICANN).

[0066] Multi-node path processing including AS_SET. If AS_PATH contains "{}", the AS numbers inside the "{}" and outside the brackets need to be combined into new sequences, then compressed and AS adjacency pairs extracted.

[0067] Construct the AS-level topology graph. Use the AS_PATH of preprocessed normal BGP data to construct an AS-level topology graph for subsequent pre-training of the graph attention autoencoder model.

[0068] S102: Input the AS-level topology graph into the encoder in the preset graph attention autoencoder model to process all AS nodes in the AS-level topology graph to obtain the AS-level topology graph representation.

[0069] Specifically, when training the graph attention autoencoder model, all AS nodes are processed, and an AS-level topological graph representation is obtained based on the embedding of all AS nodes, which helps to improve the accuracy of model processing.

[0070] S103: Input the AS-level topological graph representation into the decoder in the preset graph attention autoencoder model to obtain the reconstructed adjacency matrix.

[0071] S104: Calculate the loss between the true adjacency matrix and the reconstructed adjacency matrix using a loss function, and train the graph attention autoencoder model by minimizing the loss to obtain the pre-trained graph attention autoencoder model.

[0072] Specifically, the graph attention autoencoder model is trained by minimizing the error between the true adjacency matrix and the reconstructed adjacency matrix, updating the model weights, and effectively learning the AS-level topology graph representation under normal BGP routing behavior. The loss function used for model training is shown in the following equation:

[0073]

[0074] Among them, L GATE For the total loss, E p Let N be the number of positive sample pairs, and A be the total number of AS nodes. ij For the true adjacency matrix, To reconstruct the adjacency matrix, E n This represents the number of negative sample pairs.

[0075] S105: Obtain the target BGP data and construct the AS-level topology graph sequence corresponding to the target BGP data.

[0076] S106: Input the AS-level topology graph sequence of the target BGP data into the encoder of the pre-trained graph attention autoencoder model to process the AS nodes in the AS-level topology graph sequence and obtain the AS node embedding.

[0077] Specifically, the AS-level topology graph sequence includes multiple AS-level topology graphs. In practical applications, considering time complexity, it is not necessary to process all AS nodes. Instead, a subset of AS nodes can be randomly selected for processing to obtain their corresponding AS node embeddings.

[0078] S107: Embed the AS nodes into the multilayer perceptron model for classification to obtain anomaly detection results.

[0079] Specifically, the anomaly detection results include whether the AS node embedded in the corresponding AS node is abnormal.

[0080] Preferably, the multilayer perceptron model is also trained to ensure detection accuracy.

[0081] This invention mainly consists of two stages: pre-training of the graph attention autoencoder model (construction of the Internet AS-level topology graph, acquisition of the embedding representation of the AS-level topology graph, and reconstruction of the adjacency matrix of the AS-level topology graph) and large-scale BGP routing anomaly detection based on a multilayer perceptron (construction of the Internet AS-level topology graph sequence, acquisition of the node embeddings of ASs in the AS topology graph sequence, and anomaly detection based on a multilayer perceptron). First, the graph attention autoencoder model is pre-trained only on the AS-level topology graph when no anomalies occur in the Internet, learning normal BGP routing behavior in an unsupervised manner. Then, the encoder in the trained graph attention autoencoder model generates the AS node embeddings of the AS-level topology graph sequence to be detected, and the AS node embeddings are classified based on the multilayer perceptron model to achieve BGP routing anomaly detection. This invention introduces an attention mechanism into the graph autoencoder, using the attention mechanism to evaluate the importance of ASs and assign weights to them, paying more attention to important ASs that may cause routing anomalies, thus improving the anomaly detection accuracy. Furthermore, the training method of the graph attention autoencoder model in this invention is an unsupervised learning method, learning routing behavior patterns from normal BGP data, avoiding dependence on labeled BGP anomaly data.

[0082] Example 2

[0083] Based on the above embodiments, this invention proposes a process for obtaining AS-level topological graph representation and reconstructing the adjacency matrix using a graph attention autoencoder model, specifically including:

[0084] Graph attention autoencoder models include encoders and decoders (such as inner product decoders).

[0085] The AS-level topology graph is input into the encoder of the constructed graph attention autoencoder model. Stacked graph attention layers encode the topology graph, mapping the high-dimensional graph structure data to a low-dimensional representation space. An attention mechanism is introduced to dynamically adjust the weights of different node embeddings within the AS's neighborhood, focusing on important ASs that may experience large-scale BGP routing anomalies. AS node embeddings are iteratively updated by aggregating the embedding representations of neighboring nodes, outputting an AS-level topology graph representation containing rich network structure information.

[0086] The encoder consists of two graph attention layers, such as Figure 3 As shown, the first graph attention layer transforms the initial AS features in the AS-level topology graph into AS node embeddings containing network structure information. The second graph attention layer updates the AS node embeddings and learns more complex deep features. ReLU is used as the activation function between the two neural network layers.

[0087] The processing of the graph attention layer specifically includes:

[0088] Calculate the correlation between AS node j and AS node i. Concatenate the feature vectors of AS node i and its neighbor node j, perform a linear transformation using the weight matrix, and then apply the LeakyReLU activation function to obtain the correlation e between the two AS nodes. ij The calculation process is shown in the following formula:

[0089]

[0090] in, Let be the correlation between AS node i and AS node j in the k-th graph attention layer, and LeakyReLU be the activation function. W is a learnable weight vector. (k) The weight matrix is ​​a learnable matrix. The AS node embedding of AS node i output by the (k-1)th graph attention layer. This is the AS node embedding of AS node j output by the (k-1)th graph attention layer, where || is the concatenation operation.

[0091] Calculate the attention coefficient of AS node j relative to AS node i. To compare the correlation between AS nodes, a common scale is needed; therefore, the Softmax function is used to evaluate the correlation coefficient e. ij After normalization, the attention coefficient α is obtained. ij The calculation process is shown in the following formula:

[0092]

[0093] in, Let N be the attention coefficients of AS nodes i and j in the k-th graph attention layer. i Let be the set of neighboring AS nodes of AS node i.

[0094] Obtain the AS-level topological graph representation. Update the AS node embeddings using the learned attention coefficients. The calculation formula for the output node embedding of the k-th graph attention layer in the encoder is shown below:

[0095]

[0096] in, σ is the AS node embedding of AS node i output by the k-th graph attention layer, where σ is the activation function.

[0097] Preferably, during training, it is necessary to obtain the embeddings of all AS nodes and construct a graph representation of the AS-level topology using all AS node embeddings.

[0098] Adjacency Matrix Reconstruction of AS-Level Topology Graph: The decoder in the graph attention autoencoder receives the graph representation Z generated by the encoder, maps it back to the original data space, and reconstructs the adjacency matrix of the AS-level topology graph.

[0099] Example 3

[0100] Based on the above embodiments, this invention proposes a training process for a multilayer perceptron model, specifically including:

[0101] Download BGP data from historical routing anomaly events. Collect abnormal BGP data (including routing tables and update messages) from the RouteViews and RIPE RIS projects.

[0102] Parse the raw BGP data. The raw BGP packets are decompressed into MRT format files. The BGP packet parsing tool bgpdump converts this binary file format routing table and update messages into a readable format.

[0103] The AS_PATH field is preprocessed. The AS_PATH attribute in BGP data contains an ordered list of ASNs, describing the sequence of ASNs traversed to reach the target network. By extracting AS adjacency pairs from AS_PATH, the connectivity relationships of nodes in the AS topology are obtained, thus constructing the Internet AS-level topology. After extracting the AS_PATH field from the BGP packet, it needs to be preprocessed. This step specifically includes the following sub-steps:

[0104] Compression processing. The BGP protocol allows routers to add their local AS to the AS_PATH attribute multiple times consecutively, increasing the overall route length and interfering with peer routing decisions. Therefore, such paths need to be compressed during data extraction.

[0105] Filter out self-loops in AS_PATH. When administrators manually configure BGP rules, human error may cause self-loops to appear, which need to be removed.

[0106] Remove reserved ASNs from AS_PATH. Reserved ASNs cannot be used on the public internet and need to be removed according to the table provided by the Internet Corporation for Assigned Numbers (ICANN).

[0107] Multi-node path processing including AS_SET. If AS_PATH contains "{}", the AS numbers inside the "{}" and outside the brackets need to be combined into new sequences, then compressed and AS adjacency pairs extracted.

[0108] Construct AS-level topology graph sequences. AS-level topology graphs are constructed using the AS_PATH preprocessed from normal and abnormal BGP data, respectively. AS-level topology graph sequences are then built based on different timestamps for training and testing of the multilayer perceptron model.

[0109] The trained graph attention autoencoder model learns normal BGP routing behavior patterns. However, there are significant differences between the AS node embeddings obtained using this model when routing anomalies occur and when they do occur. Therefore, this invention keeps the model weights unchanged and utilizes the encoder in the trained model to obtain the AS node embeddings of the AS-level topology graph sequence. For AS-level topology graph G i The embedding representation of AS node n is determined, and all AS node embeddings are used to construct an AS-level topology graph representation.

[0110] This invention selects a multilayer perceptron model as the classifier, and its architecture is as follows: Figure 4 As shown, the model is trained by using AS node embeddings during anomalies and AS node embeddings under normal network conditions to learn abnormal and normal routing behaviors.

[0111] Specifically, AS nodes in the AS-level topology graph representation are embedded and flattened into one-dimensional vectors, which facilitates subsequent multilayer perceptron processing.

[0112] The flattened nodes are embedded into the input multilayer perceptron model. After passing through the input layer, they are passed to the hidden layer. Each hidden layer neuron performs weight and bias calculations and uses an activation function for nonlinear transformation. The output is then passed to the next hidden layer or output layer to obtain the predicted probabilities of the "normal" and "abnormal" categories. The category with the highest probability is taken as the final detection result.

[0113] Calculate the error and update the model parameters. Calculate the error between the anomaly detection result output by the multilayer perceptron model and the true category, propagate the error back from the output layer to the hidden layer, and update the model parameters, including weights and biases.

[0114] Detecting route anomalies. A pre-trained multilayer perceptron model is used for route anomaly detection, and the anomaly detection results are obtained and the detection accuracy is evaluated.

[0115] Example 4

[0116] Based on the above embodiments, this invention proposes a verification process for the effectiveness of a BGP routing anomaly detection method based on a graph attention autoencoder, specifically including:

[0117] Comparison of reconstruction errors of AS-level topology maps with and without anomalies, for example Figure 5 As shown ( Figure 5The diagram in Figure 'a' illustrates the difference between a Rostelecom routing anomaly event (Rostelecom routing hijacking by Russian telecom operator) and a no-anomaly event. Figure 5 (b in the diagram represents the routing anomaly event India (Vodafone routing leak incident) and the absence of anomalies). For different routing anomaly events, the error in reconstructing a normal AS-level topology is smaller and remains stable, while the error in reconstructing an abnormal AS-level topology is larger and varies significantly. This indicates that the present invention can better capture the routing behavior patterns of ASs by utilizing the different characteristics of reconstruction errors.

[0118] Table 1 compares the route anomaly detection accuracy of this invention with existing typical methods. As shown in Table 1, for the anomaly events Rostelecom and India, the average accuracy of this invention is improved by 13.1%, 3.3%, 2.9%, and 8.6% compared to BSVM, BMLP, BGNN, and BGIN methods, respectively. This indicates that by introducing an attention mechanism into the graph autoencoder, this invention makes the model pay more attention to important ASs that may cause route anomalies, thereby improving the anomaly detection accuracy.

[0119] Table 1 Comparison of accuracy rates for route anomaly detection

[0120]

[0121] Example 5

[0122] Based on the above embodiments, such as Figure 6 As shown, this invention proposes a BGP routing anomaly detection system based on a graph attention autoencoder, comprising:

[0123] The first preprocessing module is used to collect normal BGP data when no routing anomalies occur on the Internet, and to construct an AS-level topology map based on the normal BGP data.

[0124] The first encoding module is used to input the AS-level topology graph into the encoder in the preset graph attention autoencoder model to process all AS nodes in the AS-level topology graph and obtain the AS-level topology graph representation.

[0125] The decoding module is used to input the AS-level topological graph representation into the decoder in the preset graph attention autoencoder model to obtain the reconstructed adjacency matrix.

[0126] The training module is used to calculate the loss between the true adjacency matrix and the reconstructed adjacency matrix through a loss function, and to train the graph attention autoencoder model by minimizing the loss, thereby obtaining the pre-trained graph attention autoencoder model.

[0127] The second preprocessing module is used to acquire the target BGP data and construct the AS-level topology graph sequence corresponding to the target BGP data.

[0128] The second encoding module is used to input the AS-level topology graph sequence of the target BGP data into the encoder of the pre-trained graph attention autoencoder model to process the AS nodes in the AS-level topology graph sequence and obtain the AS node embedding.

[0129] The detection module is used to embed AS nodes into the multilayer perceptron model for classification and obtain anomaly detection results.

[0130] It should be noted that the BGP route anomaly detection system based on graph attention autoencoder provided in this embodiment of the invention is to implement the above-mentioned BGP route anomaly detection method based on graph attention autoencoder. Its specific functions can be referred to in the above-mentioned method embodiments, and will not be repeated here.

[0131] Example 6

[0132] Based on the above embodiments, the present invention proposes an electronic device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements a BGP routing anomaly detection method based on a graph attention autoencoder as described in Embodiment 1 above.

[0133] Example 7

[0134] This invention proposes a computer-readable storage medium comprising a stored computer program, wherein, when the computer program is executed, it controls the device where the storage medium is located to execute a BGP routing anomaly detection method based on a graph attention autoencoder as described in Embodiment 1 above.

[0135] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A BGP routing anomaly detection method based on graph attention autoencoder, characterized in that, include: Step 1: Collect normal BGP data when no routing anomalies occur on the Internet, and construct an AS-level topology map based on the normal BGP data; Step 2: Input the AS-level topology graph into the encoder in the preset graph attention autoencoder model to process all AS nodes in the AS-level topology graph to obtain the AS-level topology graph representation. Step 3: Input the AS-level topological graph representation into the decoder in the preset graph attention autoencoder model to obtain the reconstructed adjacency matrix; Step 4: Calculate the loss between the true adjacency matrix and the reconstructed adjacency matrix using the loss function, and train the graph attention autoencoder model by minimizing the loss to obtain the pre-trained graph attention autoencoder model; Step 5: Obtain the target BGP data and construct the AS-level topology graph sequence corresponding to the target BGP data; Step 6: Input the AS-level topology graph sequence of the target BGP data into the encoder of the pre-trained graph attention autoencoder model to process the AS nodes in the AS-level topology graph sequence and obtain the AS node embeddings. Step 7: Embed the AS nodes into the multilayer perceptron model for classification to obtain anomaly detection results.

2. The BGP routing anomaly detection method based on graph attention autoencoder according to claim 1, characterized in that, The graph attention autoencoder model includes an encoder and an inner product decoder. The encoder includes two stacked graph attention layers with a ReLU activation function layer between the two graph attention layers. The two graph attention layers have the same structure. The first graph attention layer is used to transform the AS-level topology graph into AS node embeddings that contain network structure information. The second graph attention layer is used to update the AS node embedding.

3. The BGP routing anomaly detection method based on graph attention autoencoder according to claim 2, characterized in that, The processing procedure of the graph attention layer specifically includes: Calculate the correlation degree between AS nodes and their neighboring nodes in an AS-level topology graph sequence; Calculate the attention coefficients of AS nodes and their neighboring nodes based on the correlation degree; The AS node embedding is obtained based on the attention coefficient.

4. The BGP routing anomaly detection method based on graph attention autoencoder according to claim 3, characterized in that, The correlation between an AS node and its neighboring nodes is expressed by the following formula: in, Let be the correlation between AS node i and AS node j in the k-th graph attention layer, and LeakyReLU be the activation function. W is a learnable weight vector. (k) The weight matrix is ​​a learnable matrix. The AS node embedding of AS node i output by the (k-1)th graph attention layer. For the AS node embedding of AS node j output by the (k-1)th graph attention layer, || is the splicing operation; The attention coefficient is expressed by the following formula: in, Let N be the attention coefficients of AS nodes i and j in the k-th graph attention layer. i Let AS be the set of neighboring AS nodes of AS node i; The AS node embedding obtained based on the attention coefficient is specifically expressed by the following formula: in, σ is the AS node embedding of AS node i output by the k-th graph attention layer, where σ is the activation function.

5. The BGP routing anomaly detection method based on graph attention autoencoder according to claim 1, characterized in that, The loss function is expressed by the following formula: Among them, L GATE Let A be the loss function. ij For the true adjacency matrix, To reconstruct the adjacency matrix, E p E represents the number of edges in an AS-level topological graph. n This represents the number of edges that do not exist in the AS-level topology graph.

6. A BGP routing anomaly detection system based on graph attention autoencoders, characterized in that, include: The first preprocessing module is used to collect normal BGP data when no routing anomalies occur on the Internet, and to construct an AS-level topology map based on the normal BGP data; The first encoding module is used to input the AS-level topology graph into the encoder in the preset graph attention autoencoder model to process all AS nodes in the AS-level topology graph and obtain the AS-level topology graph representation. The decoding module is used to input the AS-level topological graph representation into the decoder in the preset graph attention autoencoder model to obtain the reconstructed adjacency matrix; The training module is used to calculate the loss between the real adjacency matrix and the reconstructed adjacency matrix through a loss function, and to train the graph attention autoencoder model by minimizing the loss, thereby obtaining the pre-trained graph attention autoencoder model. The second preprocessing module is used to acquire target BGP data and construct the AS-level topology graph sequence corresponding to the target BGP data; The second encoding module is used to input the AS-level topology graph sequence of the target BGP data into the encoder of the pre-trained graph attention autoencoder model to process the AS nodes in the AS-level topology graph sequence and obtain the AS node embedding. The detection module is used to embed AS nodes into the multilayer perceptron model for classification and obtain anomaly detection results.

7. An electronic device, characterized in that, The system includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements a BGP route anomaly detection method based on a graph attention autoencoder as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device where the storage medium is located to perform a BGP routing anomaly detection method based on a graph attention autoencoder as described in any one of claims 1 to 5.

Images