Routing source verification deployment point detection method and related devices

Abstract

The present application provides a method for detecting a routing source verification deployment point and related devices. By introducing node confidence into the detection of the routing source verification deployment point, it avoids the detection errors caused by taking the node forwarding illegal packets alone as the detection result, thereby improving the detection scope of the routing source verification deployment point. Moreover, by constructing the splicing path, it avoids the limitations of obtaining the path through the deployed collection points, and uses the decision tree model to classify the splicing path to achieve the acquisition of candidate nodes, and improves the detection scope of the routing source verification deployment point by using the comprehensiveness of the splicing path.

Description

Technical Field

[0001] The present application relates to the field of computer networks, and particularly to a method for detecting a deployment point of route origin validation and related devices. Background Art

[0002] Currently, with the gradual advancement of the deployment of RPKI (Resource Public Key Infrastructure), finding the AS (Autonomous System) in the network that actually performs ROV (Route Origin Validation) filtering on RPKI has become the focus of attention of RPKI users.

[0003] Generally, the methods for detecting ROV deployment points mainly include: active measurement methods and passive measurement methods. However, the limitation of the active measurement method is that sending probe messages to the autonomous system will impose a burden on the original autonomous system. The passive measurement method ignores the situation that some ROV deployment points will forward illegal messages in small amounts and cannot successfully determine such nodes, and will misjudge some ROV deployment points as not deployed. Summary of the Invention

[0004] In view of this, the purpose of the present application is to propose a method for detecting a deployment point of route origin validation and related devices to solve or partially solve the above technical problems.

[0005] Based on the above purpose, the first aspect of the present application provides a method for detecting a deployment point of route origin validation. The method is applied to an autonomous network system, and the system includes autonomous system nodes. The method includes:

[0006] Obtain route origin authorization data, and determine the affected route data and non-affected route data in the route origin authorization data according to the matching situation between the prefix in the route origin authorization data and the autonomous system nodes;

[0007] Construct a splicing path set by using the Cartesian product method according to the affected route data, and classify the splicing path set by using a decision tree model trained according to the non-affected route data to obtain a classification result;

[0008] Label the autonomous system nodes according to the classification result to obtain candidate nodes;

[0009] Statistically analyze the affected route data in the candidate nodes to obtain a node confidence level, and use the node confidence level as the detection result of the route origin validation deployment point.

[0010] The second aspect of the present application provides a device for detecting a deployment point of route origin validation, including:

[0011] An acquisition module, configured to acquire routing source authorization data, and determine affected routing data and unaffected routing data in the routing source authorization data according to the matching situation between the prefix in the routing source authorization data and the autonomous system node;

[0012] A classification module, configured to construct a splicing path set by using the Cartesian product method according to the affected routing data, and classify the splicing path set by using a decision tree model trained according to the unaffected routing data to obtain a classification result;

[0013] A labeling module, configured to label the autonomous system node according to the classification result to obtain candidate nodes;

[0014] A statistics module, configured to count the affected routing data in the candidate nodes to obtain a node confidence level, and use the node confidence level as the detection result of the routing source verification deployment point.

[0015] The third aspect of the present application provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, the method described in the first aspect is implemented.

[0016] The fourth aspect of the present application provides a non-transitory computer-readable storage medium. The non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to cause a computer to execute the method described in the first aspect.

[0017] As can be seen from the above, a method and related devices for detecting a routing source verification deployment point provided by the present application introduce a node confidence level into the detection of the routing source verification deployment point, avoiding detection errors caused by taking the node forwarding illegal packets alone as the detection result, thereby improving the detection scope of the routing source verification deployment point. Moreover, by constructing the splicing path, the limitation of obtaining the path through the deployed collection point is avoided, and the acquisition of candidate nodes is realized by classifying the splicing path by using the decision tree model, and the detection scope of the routing source verification deployment point is improved by using the comprehensiveness of the splicing path. Description of the Drawings

[0018] In order to more clearly illustrate the technical solutions in the present application or related technologies, the following will briefly introduce the drawings required for use in the embodiments or related technology descriptions. Obviously, the drawings in the following description are only the embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0019] Figure 1a It is a schematic diagram of the RPKI architecture;

[0020] Figure 1b It is a schematic flowchart of the routing source verification deployment point detection method according to the embodiment of the present application;

[0021] Figure 1c It is a schematic expansion diagram of step 102;

[0022] Figure 1d It is a schematic expansion diagram of step 1021;

[0023] Figure 2a It is a schematic flowchart of the RPKI verification according to the embodiment of the present application;

[0024] Figure 2b It is a schematic flowchart of the generation of the routing decision model according to the embodiment of the present application;

[0025] Figure 2c It is a schematic flowchart of the ROV deployment point judgment according to the embodiment of the present application;

[0026] Figure 3 It is a schematic structural diagram of the routing source verification deployment point detection device according to the embodiment of the present application;

[0027] Figure 4 It is a schematic structural diagram of the electronic device according to the embodiment of the present application. Detailed implementation manners

[0028] To make the objectives, technical solutions and advantages of the present application clearer and more understandable, the present application will be further described in detail below with reference to specific embodiments and the accompanying drawings.

[0029] It should be noted that unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should have the ordinary meanings understood by those of ordinary skill in the technical field to which the present application belongs. The "first", "second" and similar terms used in the embodiments of the present application do not denote any order, quantity or importance, but are only used to distinguish different components. The terms such as "include" or "comprise" mean that the elements or items appearing before this word cover the elements or items listed after this word and their equivalents, without excluding other elements or items. The terms such as "connect" or "couple" are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The terms such as "upper", "lower", "left" and "right" are only used to indicate relative positional relationships, and when the absolute position of the object being described changes, the relative positional relationship may also change accordingly.

[0030] The noun explanations involved in each embodiment are as follows:

[0031] RPKI, Resource Public Key Infrastructure, is the Resource Public Key Infrastructure;

[0032] ROA, Route Origin Authorization, is the Route Origin Authorization;

[0033] ROV, Route Origin Validation, is the Route Origin Validation;

[0034] AS, Autonomous System, is the Autonomous System node;

[0035] ASN, Autonomous System Number, is the Autonomous System node number;

[0036] RIR, Regional Internet Registry, is the Regional Internet Registry;

[0037] BGP, Border Gateway Protocol, is the Border Gateway Routing Protocol;

[0038] As described in the background art, the Internet is composed of thousands of ASs distributed globally. Each AS belongs to a specific organization, such as technology companies, universities, government agencies, and research institutions. It is an independent interconnected network composed of routing transmission devices and routing protocols, with the same routing strategy and being managed and operated by the same technical management department. The Autonomous System node number ASN, as a globally unique and spatially limited Internet resource, is the digital identifier of the Autonomous System node. ASN is represented by 2 bytes or 4 bytes, ranging from 1 to 4294967295. Each AS that needs to exchange routing information must have a registered autonomous system number. IANA assigns ASNs to RIRs, and then distributes them to the organizations in that region. RIRs store information about the assigned autonomous domain systems in their databases, including AS numbers, AS names, the organizations to which the AS belongs, relevant descriptions of the AS, and routing input and output policies, etc.

[0039] BGP is a distance-vector routing protocol that enables the reachability of routing prefixes between autonomous systems (ASes) and selects the best route. In each AS network, there are several backbone routers running the BGP routing protocol as its BGP speakers. When two ASes need to exchange routing information, a BGP session connection needs to be established between the BGP speakers of the two ASes to exchange routing reachability information. BGP allows an AS to announce the reachability information of its internal network to other ASes, or the routing information of other networks reachable through this AS. When BGP announces the reachability information of the destination network, in addition to specifying the next-hop information of the destination network, the announcement also includes the autonomous system path (AS path), that is, the list of ASes that need to be passed through when going to the destination network. When each AS receives the routing reachability information of other ASes, it first filters the received information according to its own routing policy, decides whether to add it to its own routing table, and adds its own AS number to the AS path; when its own routing table is updated, the AS broadcasts its update content to its neighbor ASes. By repeating the above process, the routing reachability information is propagated in the BGP network. Among them, the BGP routing specification stipulates that there cannot be loop nodes in the path, and the business relationship between nodes in the path conforms to the no-loop principle. That is, in the BGP business relationship, if p represents the provider and c represents the customer, then (1) the c2p and p2p relationships cannot appear after the p2c relationship; (2) the c2p cannot appear after the p2p. Thanks to the large number of Vantage Points (VPs) deployed globally by two organizations, RIPENCC (Reseaux IP Europeens Network Coordination Centre, European Network Protocol Centre) and ROUTEVIEW (a routing observation agency), a large number of AS path paths that a large number of prefixes pass through from their source AS to the VP can be obtained.

[0040] Such as Figure 1aAs shown, RPKI is a dedicated PKI (Public Key Infrastructure) framework that prevents BGP prefix and sub-prefix hijacking attacks by verifying the validity of routing announcement information. Each AS adopting RPKI first needs to apply for a CA certificate from its upstream AS and use the CA certificate to sign the prefixes it publishes, generating and publishing ROA information. These objects are all published in the public RPKI repository operated by the RIR, and each RIR hierarchically manages its address space through its downstream NIRs (National Internet Registries), etc. When using RPKI, RPKI users first need to publish ROA information, which contains IP prefixes, AS numbers, the longest allowed prefix length, etc. After the ROA is published, the prefixes included in the ROA are considered the prefixes covered by the ROA.

[0041] For an AS to deploy ROV, it first needs to set a trust anchor as the data source of ROA messages. Usually, the trust anchors are the RIRs on the five continents. After setting the trust anchor, RPKI will automatically synchronize ROA information from the ROA library of the trust anchor at regular intervals and use it for RPKI route source verification when receiving route update messages locally.

[0042] There may be the following situations for RPKI route source verification: (1) If at least one ROA message contains the destination prefix, and the prefix length does not exceed the maximum length and the source AS information matches, then the target route update packet is determined to be valid. (2) If at least one ROA message contains the destination prefix, and all ROA messages do not meet the conditions in (1), then the target route update packet is determined to be invalid. (3) If none of the ROA messages' prefixes contain the destination prefix, then this route update packet is determined to be not found. According to this rule, ROV deployers classify the received route update packets into three categories. Among them, according to the RPKI specification, ROV deployers should discard invalid packets. However, due to issues such as non-standard use in RPKI currently, many prefixes have registered incorrect ROA information due to incorrect configurations by network owners, etc., which results in many legitimate prefixes being wrongly marked as RPKI illegal packets. If these packets are directly discarded, it may lead to network unreachability. To avoid the impact on the network caused by directly discarding such packets, in actual networks, some ROV deployers use RPKI as part of the reference basis for routing decisions. For example, they place invalid packets at a lower routing decision preference level. These ROV deployers may participate in forwarding a small number of RPKI illegal packets.

[0043] There are mainly two types of methods for detecting ROV deployment points: active measurement methods and passive measurement methods.

[0044] The active measurement method first publishes two RPKI-valid prefixes in the same AS-to-network. Since the paths between two ASes tend to be the same path, the paths of the two prefixes propagated in the network are roughly the same, and the same paths are monitored. Then, change the ROA registration information of one of the prefixes to make it an illegal path, and then observe the propagation paths of the two prefixes. If the paths of the two prefixes were originally the same and one of the prefixes becomes an illegal prefix, and the paths of the two prefixes become different, then the first different node between the original path and the new path is considered the ROV deployment point. The limitation of active measurement is that sending probe messages into the network will impose a burden on the original network. Moreover, the detection range is limited and cannot detect on a large scale. Active measurement is more suitable for verifying whether to deploy ROV for certain nodes specifically within a certain range.

[0045] The passive measurement method first collects the routing table information in the network. First, perform RPKI verification on all prefix reachability information in the routing table. The prefix reachability information contains the AS path, and all ASes that have participated in forwarding illegal messages are excluded. If there are a total of n paths from the source node a of an illegal path to the observation point, and m of them contain the illegal messages sent by node a, then all the nodes on these m paths are marked as undeployed, and the first node after the undeployed nodes on the remaining n - m paths is marked as to be detected, thus obtaining n - m nodes to be detected. When a node is marked as a node to be detected more than ten times, it is confirmed as an ROV deployment node. This method ignores the situation that some ROV deployment points will forward illegal messages in small amounts and cannot successfully determine such nodes, and will misjudge some ROV deployment points as undeployed. Moreover, the n paths used in the method all originate from the captured RIB table. Due to the limited observation range, a large number of paths may be missed, resulting in misjudgment.

[0046] In view of the above problems, an embodiment of the present application provides a method for detecting a routing source verification deployment point, which can be applied to an autonomous system network system including autonomous system nodes.

[0047] As Figure 1b shown, the method of this embodiment includes:

[0048] Step 101, obtain routing source authorization data, and determine the affected routing data and unaffected routing data in the routing source authorization data according to the matching situation between the prefixes in the routing source authorization data and the autonomous system nodes.

[0049] In this step, the routing source authorization data refers to the ROA data. The preferred ROA data in this embodiment may be the ROA data in the autonomous network system cache pool. The prefix refers to the data for routing reachability. The preferred prefix in this embodiment may be the data for routing reachability in the ROA data. For example, the prefix may be an ipv4 (Internet Protocol version 4) prefix and an ipv6 (Internet Protocol version 6) prefix.

[0050] The autonomous system node refers to an independent interconnected network composed of routing transmission devices and routing protocols, and having the same routing strategy and being managed and operated by the same technical management department. The preferred autonomous system node in this embodiment may be an AS in the autonomous network system. The affected routing data refers to the data affected by RPKI. The preferred affected routing data in this embodiment may be the ROA data affected by RPKI. The non-affected routing data refers to the data not affected by RPKI. The preferred non-affected routing data in this embodiment may be the ROA data not affected by RPKI. In this way, it provides a data basis for the construction of the subsequent splicing path set and the training of the decision tree model.

[0051] Step 102: Construct a splicing path set by using the Cartesian product method according to the affected routing data, and classify the splicing path set by using the decision tree model trained according to the non-affected routing data to obtain a classification result.

[0052] In this step, the splicing path set refers to the path obtained by the autonomous system node through the Cartesian product method. The preferred splicing path set in this embodiment may be the path obtained by the AS in the autonomous network system through the Cartesian product method.

[0053] Specifically, according to the affected routing data, obtain the AS path (path) fields corresponding to all ASs. An AS path includes n nodes, where n is a positive integer, and p0 to pn-1 represent the AS sequence from the 0th node to the (n-1)th node. Obtain all pi to pn-1 (0 ≤ i ≤ n-2) and all p0 to pj (1 ≤ j ≤ n-1) from the AS paths corresponding to all ASs and denote them as set A. Find all the AS sequences starting from the start node in set A and denote them as table S. Find all the AS sequences ending at the end node in set A and denote them as table E. Denote the end point of the AS sequence in table S as mid1 (middle 1), and the start point of the AS sequence in table E as mid2 (middle 2). Calculate the Cartesian product of table S and table E according to mid1 and mid2. The Cartesian product result can splice the AS sequences from table S and table E to obtain the splicing path set.

[0054] The decision tree model refers to a classification model trained based on non-influential routing data. The preferred decision tree model in this embodiment can be a CART decision tree model trained based on non-influential routing data. The classification result refers to the output result of the decision tree model. The preferred classification result in this embodiment can be two values, true or false. Among them, true means that the next-hop node of the path input to the decision tree model is the same as the next-hop node of the actual path, and false means that the next-hop of the path input to the decision tree model is different. In this way, it provides a model basis for the subsequent annotation of candidate nodes. By constructing the splicing path, the limitation of obtaining the path by deploying collection points is avoided, and the classification of the splicing path using the decision tree model realizes the acquisition of candidate nodes, and the comprehensiveness of the splicing path is used to improve the detection range of the routing source verification deployment point.

[0055] Step 103: Annotate the autonomous system nodes according to the classification result to obtain candidate nodes.

[0056] In this step, the candidate node refers to the routing source verification deployment point. The preferred candidate node in this embodiment can be the ROV deployment point in the autonomous network system. In this way, it provides a node basis for the subsequent calculation of node confidence.

[0057] Step 104: Statistically analyze the affected routing data in the candidate nodes to obtain the node confidence, and use the node confidence as the detection result of the routing source verification deployment point.

[0058] In this step, the node confidence refers to the confidence calculated according to the forwarding of the affected routing data by the routing source verification deployment point. The preferred node confidence in this embodiment can be the confidence calculated according to the forwarding of the affected routing data by the routing source verification deployment point in the autonomous network system. In this way, by introducing the node confidence into the detection of the routing source verification deployment point, the detection error caused by taking the node forwarding illegal packets alone as the detection result is avoided.

[0059] Through the above solution, the node confidence is introduced into the detection of the routing source verification deployment point, avoiding the detection error caused by taking the node forwarding illegal packets alone as the detection result, thereby improving the detection range of the routing source verification deployment point. And, by constructing the splicing path, the limitation of obtaining the path by deploying collection points is avoided, and the classification of the splicing path using the decision tree model realizes the acquisition of candidate nodes, and the comprehensiveness of the splicing path is used to improve the detection range of the routing source verification deployment point.

[0060] In some embodiments, as Figure 1c shown, step 102 specifically includes:

[0061] Step 1021, constructing a training splicing path set using a Cartesian product method according to the non-impacted routing data;

[0062] Step 1022, constructing an initial decision tree model based on the binary classification model;

[0063] Step 1023: Use the training splicing path set to train the initial decision tree model to obtain the decision tree model.

[0064] In the above scheme, the initial decision tree model is trained according to the training concatenated path set constructed by using the Cartesian product method based on the non-influenced routing data in the routing source authorization data.

[0065] The above scheme provides a model basis for the subsequent annotation of candidate nodes. The decision tree model is used to classify the splicing path to achieve the acquisition of candidate nodes, and the comprehensiveness of the splicing path is used to improve the detection range of the routing source verification deployment point. The initial decision tree model is trained using the non-affected routing data in the routing source authorization data. Since the training of the decision tree model is completed using the same data source, the adaptability of the trained decision tree model to the affected routing data can be improved.

[0066] In some embodiments, Figure 1d As shown, step 1021 specifically includes:

[0067] Step 10211, obtaining the autonomous system node set and border gateway protocol corresponding to the non-impact routing data;

[0068] Step 10212, dividing the autonomous system node set into a start node subset and an end node subset;

[0069] Step 10213, obtaining a starting autonomous system path corresponding to each autonomous system node in the starting node subset according to the starting node subset, to obtain a first path set;

[0070] Step 10214, obtaining an end autonomous system path corresponding to each autonomous system node in the end node subset according to the end node subset, to obtain a second path set;

[0071] Step 10215, using a Cartesian product method to concatenate the first path set and the second path set to obtain a concatenated path set;

[0072] Step 10216, remove the stitching result paths that do not comply with the border gateway protocol from the stitching result path set to obtain the training stitching path set.

[0073] In the above solution, the AS path fields corresponding to all ASs are obtained according to the non-influential routing data. An AS path includes n autonomous system nodes, where n is a positive integer, and p0 to p n-1 represents the AS sequence from node 0 to node n-1. All p are obtained from the AS paths corresponding to all ASs i ~p n-1 (0 ≤ i ≤ n-2) and all p0 to p j (1 ≤ j ≤ n-1) are denoted as set A. Set A can be used as the autonomous system node set. The AS sequences starting from all start nodes found in set A are denoted as table S, and table S can be used as the first path set. The AS sequences ending at all end nodes found in set A are denoted as table E, and table E can be used as the second path set. The end points of the AS sequences in table S are denoted as mid1 (middle 1), and the start points of the AS sequences in table E are denoted as mid2 (middle 2). Table S and table E perform a Cartesian product based on mid1 and mid2. The result of the Cartesian product can splice the AS sequences from table S and table E to obtain a spliced result path set. The spliced result paths that do not conform to the Border Gateway Protocol in the spliced result path set are removed to obtain a training spliced path set. For example, the link nodes in the spliced result path set are removed.

[0074] Through the above solution, a model basis is provided for the subsequent annotation of candidate nodes.

[0075] In some embodiments, step 1023 specifically includes:

[0076] Obtain the path frequency, the number of optional paths, the geographical location relationship, the path length, and the start node corresponding to each training spliced path in the training spliced path set to obtain training path features, and sort the training path features to obtain the sorted training path features;

[0077] Obtain the actual path corresponding to the sorted training spliced path;

[0078] In response to determining that the next-hop node in the sorted training spliced path is the same as the next-hop node in the actual path, set the classification result in the training spliced path to true;

[0079] In response to determining that the next-hop node in the sorted training spliced path is different from the next-hop node in the actual path, set the classification result corresponding to the training spliced path to false;

[0080] Train the initial decision tree model according to the sorted training path features and the classification results to obtain the decision tree model.

[0081] In the above solution, for each training splicing path, the data storage module can be called to query the path frequency, the number of optional paths, the geographical location relationship, the path length, and the start node in the training splicing path as training path features, and sort the training path features to obtain the sorted training path features. The sorted training path features and the classification result are used as a pair of training feature data to train the initial decision tree model.

[0082] Through the above solution, during the training process, the sorted training path features are used to replace the training path features, and the corresponding relationship of the sorted data in different training paths is utilized to avoid the influence of the initial values of the training path feature data in the local range on the training path features, thereby ensuring the unity of the data between different training path features and providing a model basis for the subsequent annotation of candidate nodes.

[0083] In some embodiments, step 104 specifically includes:

[0084] Calculate the node confidence according to the following formula:

[0085]

[0086] Where deployRate is the node confidence, score is the accuracy rate of the decision tree model, n is the number of times the candidate node is marked, and m is the number of the affected routing data in which the candidate node forwards the candidate node.

[0087] In the above solution, preferably, m in this embodiment can also be the number of the illegal ROA data forwarded by the autonomous system node.

[0088] Through the above solution, by introducing the node confidence into the detection of the routing source verification deployment point, the detection error caused by taking the node forwarding illegal packets alone as the detection result is avoided, and thus the detection range of the routing source verification deployment point is improved.

[0089] In some embodiments, step 101 specifically includes:

[0090] Obtain the target key corresponding to the prefix;

[0091] Traverse the routing source authorization data according to the target key to obtain a traversal result;

[0092] In response to determining that there is no routing source authorization data for the prefix in the traversal result, use the routing source authorization data corresponding to the prefix as the non-influential routing data;

[0093] In response to determining that there is routing source authorization data for the prefix in the traversal result and the prefix matches the autonomous system node, use the routing source authorization data corresponding to the prefix as the non-influential routing data;

[0094] In response to determining that there is routing source authorization data of the prefix in the traversal result and the prefix does not match the autonomous system node, the routing source authorization data corresponding to the prefix is used as the affected routing data.

[0095] In the above solution, the target key corresponding to the prefix can be obtained in the form of a MAP (an unordered set composed of key-value pairs). Among them, if it is an ipv4 prefix, the first eight decimal digits are taken as the target key; if it is an ipv6 prefix, the first 16 bits + ":" are taken as the target key. Traversing the routing source authorization data can be completed by querying the cache pool. If there is no routing source authorization data including the prefix in the traversal result, the routing source authorization data is marked as not found; if there is routing source authorization data including the prefix in the traversal result and the prefix matches the autonomous system node, the routing source authorization data is marked as valid; if there is routing source authorization data including the prefix in the traversal result and the prefix does not match the autonomous system node, the routing source authorization data is marked as invalid. The routing source authorization data of not found and valid is used as the non-affected routing data, and the routing source authorization data of invalid is used as the affected routing data.

[0096] Through the above solution, it provides a data basis for the construction of the subsequent splicing path set and the training of the decision tree model.

[0097] In some embodiments, step 103 specifically includes:

[0098] In response to determining that the classification result is true, the autonomous system node corresponding to the classification result is marked as the candidate node;

[0099] In response to determining that the classification result is false, the autonomous system node corresponding to the classification result is marked as a non-candidate node.

[0100] In the above solution, a splicing path with a true classification result indicates that the prediction of the next-hop node of the splicing path is accurate and different from the next-hop node of the actual path; a splicing path with a false classification result indicates that the prediction of the next-hop node of the splicing path is accurate and the same as the next-hop node of the actual path.

[0101] Through the above solution, it provides a node basis for the subsequent calculation of node confidence.

[0102] It should be noted that the method of the embodiments of the present application can be executed by a single device, such as a computer or a server. The method of this embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In such a distributed scenario, one of the multiple devices can only execute one or more steps of the method of the embodiments of the present application, and these multiple devices will interact with each other to complete the described method.

[0103] It should be noted that some embodiments of the present application have been described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in a different order than in the above embodiments and still achieve the desired results. Additionally, the processes depicted in the figures do not necessarily require the specific order or sequential order shown to achieve the desired results. In certain implementations, multitasking and parallel processing are also possible or may be advantageous.

[0104] Based on the same inventive concept, on the basis of the corresponding implementation schemes of the methods in the above respective embodiments, the following specific implementation situations may exist.

[0105] A. Classify the known routed forwarding packets through RPKI verification.

[0106] B. Intercept paths from the known prefix forwarding paths to construct a path splicing resource pool.

[0107] C. Train a model according to the path features included in the paths of the existing legal prefixes, and deduce the next-hop AS from the features included in the current AS.

[0108] D. Obtain the predicted next-hop node through the model, and then obtain the ROV deployment point.

[0109] E. Comprehensively calculate the number of times the node is marked and the number of times it participates in forwarding illegal packets, and calculate the ROV deployment confidence rate.

[0110] The process of step A includes:

[0111] A1. Create a cache pool for caching the RPKI verification results subsequently.

[0112] A2. Load the ROA data (corresponding to the route origin authorization data of the embodiments of the present application), obtain the corresponding date according to the timestamp included in the RIB data to be verified, and retrieve the ROA data record of that day from the database.

[0113] A3. Extract the prefix contained in the ROA record. If it is an IPv4 prefix, take the first eight decimal digits as the key; if it is an IPv6 prefix, take the first 16 digits + ":" as the key, and store the corresponding value as a list of the corresponding ROA information in MAP form.

[0114] A4. For each prefix reachability information to be verified, query the cache pool according to

prefix

AS

[0115] A5. If no result is found in the cache pool, extract the target key (corresponding to the target key in the embodiment of the present application) according to the rule in A3, and take out the ROA list corresponding to the target key from the MAP in A3.

[0116] A6. Traverse the ROA list. If none of the prefixes in any ROA contains the prefix to be verified, mark it as notfound.

[0117] A7. If at least one prefix in the ROA record contains the target prefix, and the source AS (corresponding to the autonomous system node in the embodiment of the present application) matches, and the length of the target prefix does not exceed the maximum length in the ROA record, mark it as valid.

[0118] A8. In other cases, mark it as invalid. The verification process is as Figure 2a shown.

[0119] A9. Concatenate the verification result into the format of

prefix

AS

verification result

[0120] A10. Classify the data with valid and notfound verification results as data whose propagation is not affected by RPKI (corresponding to the non-affected routing data in the embodiment of the present application), and classify the data with invalid results as data affected by RPKI (corresponding to the affected routing data in the embodiment of the present application).

[0121] The process of step B includes:

[0122] B1. Extract the AS path field contained in the data not affected by RPKI as the basic data.

[0123] B2. If an AS path contains n nodes, p0 to p n-1 represents the AS sequence from node 0 to node n - 1. Obtain all p from the path i to p n-1 (0 ≤ i ≤ n - 2) and all p0 to p j (1 ≤ j ≤ n - 1) and record them as set A (corresponding to the autonomous system node set in the embodiment of the present application).

[0124] B3. Obtain the AS path, with the start node denoted as start and the end node denoted as end.

[0125] B4. Find all paths in set A with the start node as start, denoted as set S (corresponding to the first path set in the embodiments of the present application), and all paths with the end node as end, denoted as table E (corresponding to the second path set in the embodiments of the present application). The end point of the path in table S is denoted as mid, and the start point of the path in table E is denoted as mid.

[0126] B5. Calculate the Cartesian product of table S and table E based on mid. In the result, splice the paths from S and E to obtain a new path set P′, and the second-hop node of the new path is denoted as next.

[0127] B6. Eliminate the paths in set P′ that do not conform to the BGP routing specification to obtain set P (corresponding to the spliced path set in the embodiments of the present application).

[0128] B7. For the data that was not originally affected by RPKI, repeat the above processes B2 to B6 one by one.

[0129] As Figure 2b shown, the process of step C includes:

[0130] C1. For each hop to generate a path, record its start node, end node, splicing node, and the next-hop node of the start node.

[0131] C2. Call the interface of the data storage module to query the AS rank information of the node, including the transit information of the AS and the total connection number information.

[0132] C3. Obtain the path frequency, the number of alternative paths, the geographical location relationship, the path length, the count of the start node as a transmission node, the global degree of the start node, the count of the splicing node as a transmission node, the global degree of the splicing node, the count of the next-hop node as a transmission node, the global degree of the next-hop node, the propagation direction from the start node to the end node as a prefix, the relationship between the start node and the splicing point, the relationship between the start node and the next-hop node, the type of the splicing node, and the type of the next-hop node from the data storage module in sequence.

[0133] C4. If the next node in the spliced path is the same as the next node in the actual path, set the predicted value res to True, otherwise to False. Combine all the above information to form the features of a spliced path.

[0134] C5. For a set of path features obtained for each start AS - end AS, attributes such as path frequency and path length only take effect within the optional range when making path selection, that is, only within this group. Therefore, for the unity of inter - group data, the intra - group ranking of these data (corresponding to the sorted training splicing paths in the embodiments of the present application) is used to replace their initial values, and the finally obtained features are used for input into the model.

[0135] C6. Use a CART decision tree (corresponding to the decision tree model in the embodiments of the present application) to train a binary classification model. Input a set of path features and output labels TRUE (corresponding to the true classification result in the embodiments of the present application) and FALSE (corresponding to the false classification result in the embodiments of the present application).

[0136] The process of step D includes:

[0137] D1. Take the AS path in the data affected by RPKI, and take its p i ~p n-1 (0 ≤ i ≤ n - 2) as the start node.

[0138] D2. Use the above steps B3 to B6 to obtain the reconstructed path set.

[0139] D3. Input the reconstructed path set into the CART decision tree model according to step C, and obtain the next node labeled TRUE.

[0140] D4. Compare the next node in the actual path with the next node generated in D3. If they are different, mark the next in the generated path as a candidate node.

[0141] As Figure 2c shown, the process of step E includes:

[0142] E1. Record the number of times n that all candidate nodes are marked.

[0143] E2. Conduct data statistics on illegal routing packets. Create a separate set for each AS node to record the number of illegal prefixes it forwards.

[0144] E3. The confidence level of the candidate node is deployRate, and the calculation formula is as follows, where score is the model accuracy rate, n is the number of times the node is marked, and m is the number of illegal prefixes forwarded by the node.

[0145]

[0146] Based on the same inventive concept, corresponding to the method of any of the above embodiments, the present application also provides a routing source verification deployment point detection device.

[0147] ReferenceFigure 3 , the routing source verification deployment point detection device includes:

[0148] An acquisition module 301, configured to acquire routing source authorization data, and determine affected routing data and unaffected routing data in the routing source authorization data according to the matching situation between the prefix in the routing source authorization data and the autonomous system node;

[0149] A classification module 302, configured to construct a splicing path set by using the Cartesian product method according to the affected routing data, and classify the splicing path set by using a decision tree model trained according to the unaffected routing data to obtain a classification result;

[0150] A labeling module 303, configured to label the autonomous system node according to the classification result to obtain a candidate node;

[0151] A statistical module 304, configured to count the affected routing data in the candidate nodes to obtain a node confidence level, and use the node confidence level as the detection result of the routing source verification deployment point.

[0152] In some embodiments, the classification module 302 specifically includes:

[0153] A splicing unit, configured to construct a training splicing path set by using the Cartesian product method according to the unaffected routing data;

[0154] An initial construction unit, configured to construct an initial decision tree model according to a binary classification model;

[0155] A training unit, configured to train the initial decision tree model by using the training splicing path set to obtain the decision tree model.

[0156] In some embodiments, the splicing unit is specifically configured to:

[0157] Obtain the autonomous system node set and the Border Gateway Protocol corresponding to the unaffected routing data;

[0158] Divide the autonomous system node set into a start node subset and an end node subset;

[0159] According to the start node subset, obtain the start autonomous system path corresponding to each autonomous system node in the start node subset to obtain a first path set;

[0160] According to the end node subset, obtain the end autonomous system path corresponding to each autonomous system node in the end node subset to obtain a second path set;

[0161] Use the Cartesian product method to splice the first path set and the second path set to obtain a spliced result path set;

[0162] Remove the splicing result paths that do not conform to the Border Gateway Protocol in the splicing result path set to obtain the training splicing path set.

[0163] In some embodiments, the training unit is specifically configured to:

[0164] Obtain the path frequency, the number of alternative paths, the geographical location relationship, the path length, and the start node corresponding to each training splicing path in the training splicing path set to obtain training path features, and sort the training path features to obtain the sorted training path features;

[0165] Obtain the actual path corresponding to the sorted training splicing path;

[0166] In response to determining that the next-hop node in the sorted training splicing path is different from the next-hop node in the actual path, set the classification result in the training splicing path to true;

[0167] In response to determining that the next-hop node in the sorted training splicing path is the same as the next-hop node in the actual path, set the classification result corresponding to the training splicing path to false;

[0168] Train the initial decision tree model according to the sorted training path features and the classification results to obtain the decision tree model.

[0169] In some embodiments, the statistics module 304 is specifically configured to:

[0170] Calculate the node confidence according to the following formula:

[0171]

[0172] Where deployRate is the node confidence, score is the accuracy rate of the decision tree model, n is the number of times the candidate node is marked, and m is the number of affected routing data in the candidate node that forwards the candidate node.

[0173] In some embodiments, the acquisition module 301 is specifically configured to:

[0174] Obtain the target key corresponding to the prefix;

[0175] Traverse the routing source authorization data according to the target key to obtain a traversal result;

[0176] In response to determining that there is no routing source authorization data for the prefix in the traversal result, use the routing source authorization data corresponding to the prefix as the non-affected routing data;

[0177] In response to determining that there is routing source authorization data for the prefix in the traversal result and the prefix matches the autonomous system node, the routing source authorization data corresponding to the prefix is used as the unaffected routing data;

[0178] In response to determining that there is routing source authorization data for the prefix in the traversal result and the prefix does not match the autonomous system node, the routing source authorization data corresponding to the prefix is used as the affected routing data.

[0179] In some embodiments, the annotation module 303 is specifically configured to:

[0180] In response to determining that the classification result is true, the autonomous system node corresponding to the classification result is marked as a non-candidate node;

[0181] In response to determining that the classification result is false, the autonomous system node corresponding to the classification result is marked as the candidate node.

[0182] For the sake of description, when describing the above device, various modules are described separately according to their functions. Of course, when implementing the present application, the functions of each module can be implemented in one or more software and / or hardware.

[0183] The device in the above embodiment is used to implement the corresponding routing source verification deployment point detection method in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be elaborated here.

[0184] Based on the same inventive concept, corresponding to the method in any of the above embodiments, the present application further provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, it implements the routing source verification deployment point detection method in any of the above embodiments.

[0185] Figure 4 FIG. shows a more specific schematic diagram of the hardware structure of the electronic device provided in this embodiment. The device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. Among them, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are communicatively connected to each other inside the device through the bus 1050.

[0186] The processor 1010 can be implemented in the form of a general-purpose CPU (Central Processing Unit), a microprocessor, an Application Specific Integrated Circuit (ASIC), or one or more integrated circuits, etc., and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0187] The memory 1020 can be implemented in the form of a ROM (Read Only Memory), a RAM (Random Access Memory), a static storage device, a dynamic storage device, etc. The memory 1020 can store an operating system and other application programs. When implementing the technical solutions provided in the embodiments of this specification through software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0188] The input / output interface 1030 is used to connect to the input / output module to achieve information input and output. The input / output module can be configured as a component in the device (not shown in the figure) or can be externally connected to the device to provide corresponding functions. Among them, the input device can include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device can include a display, a speaker, a vibrator, an indicator light, etc.

[0189] The communication interface 1040 is used to connect to a communication module (not shown in the figure) to achieve communication and interaction between this device and other devices. Among them, the communication module can achieve communication through a wired method (such as USB, network cable, etc.) or can also achieve communication through a wireless method (such as a mobile network, WIFI, Bluetooth, etc.).

[0190] The bus 1050 includes a path for transmitting information between various components of the device (such as the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0191] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040, and the bus 1050, in the specific implementation process, this device may also include other components necessary for normal operation. In addition, those skilled in the art can understand that the above device may also only include the components necessary to implement the solution of the embodiments of this specification and does not necessarily include all the components shown in the figure.

[0192] The electronic device of the above embodiment is used to implement the corresponding routing source verification deployment point detection method in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be elaborated here.

[0193] Based on the same inventive concept, corresponding to the method of any of the above embodiments, the present application also provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute the routing source verification deployment point detection method as described in any of the foregoing embodiments.

[0194] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette tapes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device.

[0195] The computer instructions stored in the storage medium of the above embodiment are used to cause the computer to execute the routing source verification deployment point detection method as described in any of the foregoing embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be elaborated here.

[0196] Those of ordinary skill in the art should understand that the discussion of any of the above embodiments is only exemplary and is not intended to imply that the scope of the present application (including the claims) is limited to these examples; within the concept of the present application, the technical features in the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations in different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of brevity.

[0197] In addition, for simplicity of explanation and discussion, and so as not to make the embodiments of the present application difficult to understand, well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided drawings. Further, the devices may be shown in block diagram form in order to avoid making the embodiments of the present application difficult to understand, and this also takes into account the fact that details of the implementation of such block diagram devices are highly dependent on the platform on which the embodiments of the present application are to be implemented (i.e., these details should be fully within the understanding of those skilled in the art). In cases where specific details (e.g., circuits) are set forth to describe exemplary embodiments of the present application, it will be apparent to those skilled in the art that the embodiments of the present application may be practiced without these specific details or with variations of these specific details. Accordingly, these descriptions should be considered illustrative rather than restrictive.

[0198] Although the present application has been described in connection with specific embodiments thereof, many alternatives, modifications, and variations of these embodiments will be apparent to those of ordinary skill in the art in light of the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0199] Embodiments of the present application are intended to cover all such alternatives, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the embodiments of the present application shall be included within the protection scope of the present application.

Claims

1. A method for detecting a routing source verification deployment point, characterized in that The method is applied to an autonomous network system, which includes autonomous system nodes; the method includes: Obtain routing source authorization data, and determine the affected routing data and unaffected routing data in the routing source authorization data according to the matching situation between the prefix in the routing source authorization data and the autonomous system nodes; Obtain the autonomous system node path fields corresponding to all the autonomous system nodes according to the affected routing data; the autonomous system node path includes n autonomous system nodes, where n is a positive integer; p0 to pn-1 represent the sequence of autonomous system nodes from node 0 to node n-1; From all the autonomous system node paths corresponding to all the autonomous system nodes, obtain all pi to pn-1 (0 ≤ i ≤ n-2) and all p0 to pj (1 ≤ j ≤ n-1), denoted as set A; Find out the sequence of autonomous system nodes of all the start nodes from the set A, denoted as table S, and denote the end point of the sequence of autonomous system nodes in the table S as mid1; Find out the sequence of autonomous system nodes of all the end nodes from the set A, denoted as table E, and denote the start point of the sequence of autonomous system nodes in the table E as mid2; Calculate the Cartesian product of the table S and the table E according to the mid1 and the mid2; Splice the sequences of autonomous system nodes from the table S and the table E according to the Cartesian product to obtain a spliced path set; Construct a training spliced path set by using the Cartesian product method according to the unaffected routing data; Construct an initial decision tree model according to a binary classification model; Obtain the path frequency, the number of alternative paths, the geographical location relationship, the path length, and the start node corresponding to each training spliced path in the training spliced path set to obtain training path features, and sort the training path features to obtain sorted training path features; Obtain the actual path corresponding to the sorted training spliced path; In response to determining that the next-hop node in the sorted training spliced path is the same as the next-hop node in the actual path, set the classification result in the training spliced path to true; In response to determining that the next-hop node in the sorted training spliced path is different from the next-hop node in the actual path, set the classification result corresponding to the training spliced path to false; Train the initial decision tree model according to the sorted training path features and the classification results to obtain a decision tree model; Classify the spliced path set by using the decision tree model to obtain a classification result; Label the autonomous system nodes according to the classification result to obtain candidate nodes; Statistically analyze the affected routing data in the candidate nodes to obtain a node confidence level, and use the node confidence level as the detection result of the routing source verification deployment point; Calculate the node confidence level according to the following formula: Where deployRate is the node confidence level, score is the accuracy rate of the decision tree model, n is the number of times the candidate node is marked, and m is the number of affected routing data in the candidate node forwarded by the candidate node.

2. The method according to claim 1, characterized in that, Constructing a training splicing path set using the Cartesian product method according to the non - affected routing data includes: Obtaining the autonomous system node set and the Border Gateway Protocol corresponding to the non - affected routing data; Dividing the autonomous system node set into a start node subset and an end node subset; Obtaining the start autonomous system paths corresponding to each autonomous system node in the start node subset according to the start node subset, to obtain a first path set; Obtaining the end autonomous system paths corresponding to each autonomous system node in the end node subset according to the end node subset, to obtain a second path set; Using the Cartesian product method to splice the first path set and the second path set to obtain a spliced result path set; Removing the spliced result paths in the spliced result path set that do not conform to the Border Gateway Protocol to obtain the training splicing path set.

3. The method according to claim 1, wherein Determining the affected routing data and non - affected routing data in the routing source authorization data according to the matching situation between the prefix in the routing source authorization data and the autonomous system node includes: Obtaining the target key corresponding to the prefix; Traversing the routing source authorization data according to the target key to obtain a traversal result; In response to determining that there is no routing source authorization data for the prefix in the traversal result, taking the routing source authorization data corresponding to the prefix as the non - affected routing data; In response to determining that there is routing source authorization data for the prefix in the traversal result and the prefix matches the autonomous system node, taking the routing source authorization data corresponding to the prefix as the non - affected routing data; In response to determining that there is routing source authorization data for the prefix in the traversal result and the prefix does not match the autonomous system node, taking the routing source authorization data corresponding to the prefix as the affected routing data.

4. The method according to claim 1, wherein Labeling the autonomous system nodes according to the classification result to obtain candidate nodes, including: In response to determining that the classification result is true, labeling the autonomous system node corresponding to the classification result as the candidate node; In response to determining that the classification result is false, labeling the autonomous system node corresponding to the classification result as a non - candidate node.

5. A routing source verification deployment point detection device, characterized in that Includes: An acquisition module, configured to acquire routing source authorization data, and determine the affected routing data and non - affected routing data in the routing source authorization data according to the matching situation between the prefix in the routing source authorization data and the autonomous system node; A classification module, configured to obtain the autonomous system node path fields corresponding to all the autonomous system nodes according to the affected routing data; the autonomous system node path includes n of the autonomous system nodes, where n is a positive integer; p0 to pn - 1 represent the sequence of the autonomous system nodes from the 0th node to the (n - 1)th node; From all the autonomous system node paths corresponding to all the autonomous system nodes, obtaining all pi to pn - 1(0 ≤ i ≤ n - 2) and all p0 to pj(1 ≤ j ≤ n - 1), denoted as set A; Finding out the sequence of the autonomous system nodes of all the start nodes from the set A, denoted as table S, and taking the end point of the sequence of the autonomous system nodes in the table S as mid1; The sequence of autonomous system nodes that finds all end nodes from the set A is denoted as Table E, and the starting point of the sequence of autonomous system nodes in Table E is denoted as mid2; Perform a Cartesian product of Table S and Table E based on mid1 and mid2; Splice the sequences of autonomous system nodes from Table S and Table E according to the Cartesian product to obtain a spliced path set; Construct a training spliced path set using the Cartesian product method according to the non-influential routing data; Construct an initial decision tree model according to the binary classification model; Obtain the path frequency, number of alternative paths, geographical location relationship, path length, and start node corresponding to each training spliced path in the training spliced path set to obtain training path features, and sort the training path features to obtain sorted training path features; Obtain the actual path corresponding to the sorted training spliced path; In response to determining that the next-hop node in the sorted training spliced path is the same as the next-hop node in the actual path, set the classification result in the training spliced path to true; In response to determining that the next-hop node in the sorted training spliced path is different from the next-hop node in the actual path, set the classification result corresponding to the training spliced path to false; Train the initial decision tree model according to the sorted training path features and the classification results to obtain a decision tree model; Classify the spliced path set using the decision tree model to obtain a classification result; A labeling module, configured to label the autonomous system nodes according to the classification result to obtain candidate nodes; A statistics module, configured to count the affected routing data in the candidate nodes to obtain a node confidence level, and use the node confidence level as the detection result of the routing source verification deployment point; Calculate the node confidence level according to the following formula: Where deployRate is the node confidence level, score is the accuracy rate of the decision tree model, n is the number of times the candidate node is marked, and m is the number of the candidate node forwarding the affected routing data in the candidate node.

6. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored on the memory and executable by the processor. When the processor executes the computer program, it implements the method according to any one of claims 1 to 4.

7. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to cause a computer to execute the method according to any one of claims 1 to 4.

Images