A method and device for analyzing customer scheduling behavior based on BGP routing and DNS

Abstract

The present invention discloses a method and device for analyzing customer scheduling behavior based on BGP routing and DNS, wherein the method includes: collecting NetFlow information of provincial export equipment, national BGP routing information, DNS logs and customer domain name information; obtaining the address segment range corresponding to each province according to the AsPath attribute in the BGP routing information; monitoring the DNS log according to the customer's domain name information, and when it is found that the corresponding customer address segment in the DNS log has changed, and the range of the change exceeds the address segment range of the province, further analyzing and finding the changed IP address, and then combining the NetFlow information to obtain the size of the scheduling flow. The method and device combine BGP routing, Netflow and DNS logs, and analyze the customer's scheduling behavior between provinces, provide data support for the operator's operation and formulation of relevant strategies, and increase the operator's revenue.

Description

Technical Field

[0001] The present invention relates to the field of customer dispatching behavior monitoring, and in particular to a customer dispatching behavior analysis method and device based on BGP routing and DNS. Background Art

[0002] In the actual operation of the provincial companies of operators, pricing strategies for large customers are often involved. For example, the 95 billing principle of the billing mechanism. The large customers of operators often take advantage of the price gap between provinces and use related scheduling to schedule traffic between different provinces to reduce costs. However, due to the lack of effective means, the operators are unable to effectively monitor the customer's scheduling, let alone analyze it, and thus cannot formulate targeted strategies to increase revenue. Summary of the invention

[0003] In order to solve the above problems existing in the prior art, the present invention provides a customer scheduling behavior analysis method and device based on BGP routing and DNS, which combines BGP routing, Netflow and DNS logs, and analyzes the customer's scheduling behavior between provinces, providing data support for the operator's operation and formulation of relevant strategies, thereby increasing the operator's revenue.

[0004] To achieve the above object, the present invention adopts the following technical solutions:

[0005] In one embodiment of the present invention, a method for analyzing customer scheduling behavior based on BGP routing and DNS is proposed, and the method includes:

[0006] Collect NetFlow information of provincial export equipment, national BGP routing information, DNS logs, and customer domain name information;

[0007] According to the AsPath attribute in the BGP routing information, obtain the address segment range corresponding to each province;

[0008] Based on the customer's domain name information, the DNS log is monitored. When it is found that the corresponding customer address segment in the DNS log has changed, and the range of the change exceeds the address segment range of the province, further analysis is performed to find out the changed IP address, and then combined with the NetFlow information, the size of the scheduling traffic is obtained.

[0009] Furthermore, the source IP field in the NetFlow information corresponds to the IP address in the DNS log and is associated with the BGP routing information to form the provincial information.

[0010] Furthermore, when the scheduling traffic is greater than a predetermined threshold, it is determined whether the changed IP address is a newly added IP address or a reduced IP address. If the changed IP address is a newly added IP address, the province where the IP address is distributed and the corresponding traffic are added; if the changed IP address is a reduced IP address, the province where the IP address is distributed and the corresponding traffic are reduced.

[0011] In one embodiment of the present invention, a client scheduling behavior analysis device based on BGP routing and DNS is also proposed, and the device includes:

[0012] The information collection module is used to collect NetFlow information of provincial export equipment, national BGP routing information, DNS logs and customer domain name information;

[0013] The scheduling analysis module is used to obtain the address segment range corresponding to each province based on the AsPath attribute in the BGP routing information; monitor the DNS log based on the customer's domain name information. When it is found that the corresponding customer address segment in the DNS log has changed and the changed range exceeds the address segment range of the province, further analysis is performed to find out the changed IP address, and then combined with the NetFlow information to obtain the size of the scheduling traffic.

[0014] Furthermore, the source IP field in the NetFlow information corresponds to the IP address in the DNS log and is associated with the BGP routing information to form the provincial information.

[0015] Furthermore, when the scheduling traffic is greater than a predetermined threshold, it is determined whether the changed IP address is a newly added IP address or a reduced IP address. If the changed IP address is a newly added IP address, the province where the IP address is distributed and the corresponding traffic are added; if the changed IP address is a reduced IP address, the province where the IP address is distributed and the corresponding traffic are reduced.

[0016] In one embodiment of the present invention, a computer device is also proposed, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the aforementioned customer scheduling behavior analysis based on BGP routing and DNS is implemented.

[0017] In one embodiment of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium stores a computer program for performing customer scheduling behavior analysis based on BGP routing and DNS.

[0018] Beneficial effects:

[0019] 1. The present invention combines BGP routing information and DNS logs to accurately determine the scheduling of the provincial dimension.

[0020] 2. The present invention combines Netflow information with BGP routing information and DNS logs to form the scheduling flow size, thereby accurately monitoring the scheduling behavior and scheduling flow size. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a flow chart of the method for analyzing customer scheduling behavior based on BGP routing and DNS of the present invention;

[0022] Figure 2 It is a schematic diagram of the structure of a client scheduling behavior analysis device based on BGP routing and DNS of the present invention;

[0023] Figure 3 It is a schematic diagram of the computer device structure of the present invention. DETAILED DESCRIPTION

[0024] The principles and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0025] Those skilled in the art will appreciate that the embodiments of the present invention may be implemented as a device, apparatus, node, method or computer program product. Therefore, the present disclosure may be implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0026] The implementation mode of the present invention proposes a method and device for analyzing customer scheduling behavior based on BGP routing and DNS, which combines BGP routing data, Netflow data and DNS log data, and analyzes the customer's scheduling behavior between provinces, providing data support for the operator's operation and formulation of relevant strategies, thereby increasing the operator's revenue.

[0027] The principle and spirit of the present invention are explained in detail below with reference to several representative embodiments of the present invention.

[0028] Figure 1 1 is a flow chart of the method for analyzing customer scheduling behavior based on BGP routing and DNS in the present invention. Figure 1 As shown, the method includes:

[0029] 1. Collect NetFlow information of provincial export equipment, national BGP routing information, DNS logs and customer domain name information;

[0030] (1) BGP routing information, operators will divide different cities by As. In the routing entry information, this method needs to use the Aspath field (autonomous system routing mainly records the autonomous domain information that the route passes through from the starting autonomous domain to the current autonomous domain). The prefix field represents the address segment range, which mainly represents the As propagation path of the route. Among them, as2 represents the broadcast domain of the route, that is, the city, and the city is further classified into provinces. This method uses As to distinguish the provincial information of the address segment.

[0031] (2) DNS log: When a user visits different websites, the computer will first convert the customer's domain name into an IP address. This process is implemented through the DNS server and recorded as a DNS log.

[0032] This method mainly uses the A record (a type of DNS record, which mainly points the domain name to an IPv4 address such as: 100.100.100.100) and the CName record (points the domain name to a domain name). The A record directly obtains the relationship between the domain name and the IP address, and the CName record eventually forms an A record through iteration.

[0033] (3) NetFlow information, the customer obtains the traffic components flowing through the device. This method requires the use of the source IP address and traffic size of the NetFlow information in the backbone edge device. The source IP address is mainly used to correspond to the IP address in the DNS log and is associated with the BGP routing information to form provincial information. It should be noted that multiple Netflow records involved in the source IP address in the Netflow information need to be merged and accumulated to form the traffic size.

[0034] (4) The customer's domain name information, as the technical data of this method, requires basic configuration.

[0035] 2. According to the AsPath attribute in the BGP routing information, obtain the address segment range corresponding to each province;

[0036] 3. Monitor the DNS logs based on the customer's domain name information. When the corresponding customer address segment in the DNS log is found to have changed, and the range of the change exceeds the address segment range of the province (across provinces), further analyze and find out the changed IP address (through DNS logs, regular comparison), and then combine with NetFlow information to obtain the size of the scheduling flow. When the scheduling flow is greater than the established threshold, it is divided into the following situations:

[0037] (1) When a new IP is added, the province where the new IP is distributed and the corresponding traffic.

[0038] (2) When reducing an IP, reduce the province and traffic corresponding to the IP.

[0039] It should be noted that, although the operations of the method of the present invention are described in a specific order in the above embodiments and the accompanying drawings, this does not require or imply that the operations must be performed in the specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0040] In order to explain the above-mentioned customer scheduling behavior analysis method based on BGP routing and DNS more clearly, a specific embodiment is used for illustration below. However, it should be noted that this embodiment is only for better illustrating the present invention and does not constitute an improper limitation to the present invention.

[0041] Example:

[0042] 1. Collect NetFlow information of provincial export equipment, national BGP routing information, DNS logs and customer domain name information;

[0043] (1) BGP routing information, operators will divide different cities by As. The summary format of the routing entry information is shown in Table 1 below, where the Aspath field is required for this method, the prefix field represents the address segment range, mainly representing the As propagation path of the route, where as2 represents the broadcast domain of the route, i.e., the city, and the city is further classified into provinces. This embodiment uses As to distinguish the provincial information of the address segment.

[0044] Table 1

[0045] Prefix aspath Source Router Next hop Local priority Neighbor IP 10.1.2..3 / 24 as1as2 10.1.2.1 10.1.2.1 100 10.1.2.1

[0046] (2) DNS log. When a user accesses different websites, the computer will first convert the customer's domain name into an IP address. This process is implemented by the DNS server and recorded in the DNS log. The reference format is as follows:

[0047]

[0048] This embodiment mainly uses the A record and CName record. The A record directly obtains the relationship between the domain name and the IP address, and the CName record eventually forms an A record through iteration. Therefore, the DNS format used is as shown in Table 2:

[0049] Table 2

[0050] domain name IP address www.baidu.com 10.20.4.3

[0051] (3) NetFlow information, the customer obtains the traffic components flowing through the device. This method requires the use of the source IP address and traffic size of the NetFlow information in the backbone edge device. The source IP address is mainly used to correspond to the IP address in the DNS log and is associated with the BGP routing information to form provincial information. It should be noted that multiple Netflow records involved in the source IP address in the Netflow information need to be merged and accumulated to form the traffic size, as shown in Table 3 below:

[0052] Table 3

[0053] Source IP address Traffic size 192.168.55.22 50000kbps

[0054] (4) The customer's domain name information, as the technical data of this method, requires basic configuration as shown in Table 4:

[0055] Table 4

[0056] client domain name Ali www.taobao.com Ali www.tianmao.com

[0057] 2. According to the AsPath attribute in the BGP routing information, obtain the address segment range corresponding to each province;

[0058] 3. Monitor the DNS logs based on the customer's domain name information. When the corresponding customer address segment in the DNS log is found to have changed, and the range of the change exceeds the address segment range of the province (cross-province), further analyze and find out the changed IP address, and then combine the NetFlow information to obtain the size of the scheduling flow. When the scheduling flow is greater than the established threshold, it is divided into the following situations:

[0059] (1) When a new IP is added, the province where the new IP is distributed and the corresponding traffic.

[0060] (2) When reducing an IP, reduce the province and traffic corresponding to the IP.

[0061] The new record format is shown in Table 5 below:

[0062] Table 5

[0063] time Compare time Added Province Traffic size 2022-11-1300:05 2022-11-1300:05 Jiangsu 10G 2022-11-1300:05 2022-11-1300:05 Hubei 5G

[0064] Please refer to Table 6 for the reduced record format:

[0065] Table 6

[0066] time Compare time Reduce the province Traffic size 2022-11-1300:05 2022-11-1300:05 Zhejiang 10G 2022-11-1300:05 2022-11-1300:05 Fujian 5G

[0067] Based on the same inventive concept, the present invention also proposes a client scheduling behavior analysis device based on BGP routing and DNS. The implementation of the device can refer to the implementation of the above method, and the repeated parts will not be repeated. The term "module" used below can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0068] Figure 2 Schematic diagram of the structure of the client scheduling behavior analysis device based on BGP routing and DNS of the present invention. Figure 2 As shown, the device comprises:

[0069] The information collection module 101 is used to collect NetFlow information of provincial export equipment, national BGP routing information, DNS logs and customer domain name information;

[0070] (1) BGP routing information, operators will divide different cities by As. In the routing entry information, this device needs to use the Aspath field. The prefix field represents the address segment range, which mainly represents the As propagation path of the route. Among them, as2 represents the broadcast domain of the route, that is, the city, and the city is further classified into provinces. This device uses As to distinguish the province information of the address segment.

[0071] (3) DNS log: When a user visits different websites, the computer will first convert the customer's domain name into an IP address. This process is implemented through the DNS server and recorded as a DNS log.

[0072] This device mainly uses the A record and CName record. The A record directly obtains the relationship between the domain name and the IP address, and the CName record eventually forms an A record through iteration.

[0073] (3) NetFlow information, the customer obtains the traffic components flowing through the device. This device needs to use the source IP address and traffic size of the NetFlow information in the backbone edge device. The source IP address is mainly used to correspond to the IP address in the DNS log and is associated with the BGP routing information to form provincial information. It should be noted that multiple Netflow records involved in the source IP address in the Netflow information need to be merged and accumulated to form the traffic size.

[0074] (4) The customer's domain name information, as the technical data of this device, requires basic configuration.

[0075] The scheduling analysis module 102 is used to obtain the address segment range corresponding to each province according to the AsPath attribute in the BGP routing information; monitor the DNS log according to the customer's domain name information, and when it is found that the corresponding customer address segment in the DNS log has changed, and the range of the change exceeds the address segment range of the province, further analyze and find out the changed IP address, and then combine the NetFlow information to obtain the size of the scheduling flow. When the scheduling flow is greater than the established threshold, it is specifically divided into the following situations:

[0076] (1) When a new IP is added, the province where the new IP is distributed and the corresponding traffic.

[0077] (2) When reducing an IP, reduce the province and traffic corresponding to the IP.

[0078] It should be noted that although several modules of the client scheduling behavior analysis device based on BGP routing and DNS are mentioned in the above detailed description, this division is only exemplary and not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more modules described above can be concretized in one module. Conversely, the features and functions of one module described above can be further divided into multiple modules to be concretized.

[0079] Based on the above invention concept, Figure 3 As shown, the present invention also proposes a computer device 200, including a memory 210, a processor 220, and a computer program 230 stored in the memory 210 and executable on the processor 220. When the processor 220 executes the computer program 230, the aforementioned customer scheduling behavior analysis method based on BGP routing and DNS is implemented.

[0080] Based on the aforementioned inventive concept, the present invention further proposes a computer-readable storage medium, which stores a computer program for executing the aforementioned BGP routing and DNS-based customer scheduling behavior analysis.

[0081] The customer scheduling behavior analysis method and device based on BGP routing and DNS proposed in the present invention accurately determine the scheduling of the provincial dimension by combining BGP routing information and DNS logs, and then combine with Netflow information to form the scheduling traffic size, thereby accurately monitoring the scheduling behavior and scheduling traffic size.

[0082] Although the spirit and principle of the present invention have been described with reference to several specific embodiments, it should be understood that the present invention is not limited to the disclosed specific embodiments, and the division of various aspects does not mean that the features in these aspects cannot be combined to benefit, and such division is only for the convenience of expression. The present invention is intended to cover various modifications and equivalent arrangements contained in the spirit and scope of the attached claims.

[0083] Regarding the limitation of the protection scope of the present invention, those skilled in the art should understand that, based on the technical solution of the present invention, various modifications or variations that can be made by those skilled in the art without creative work are still within the protection scope of the present invention.

Claims

1. A method for analyzing customer scheduling behavior based on BGP routing and DNS, characterized in that: The method includes: Collect NetFlow information of provincial export equipment, national BGP routing information, DNS logs, and customer domain name information; According to the AsPath attribute in the BGP routing information, obtain the address segment range corresponding to each province; Monitor DNS logs based on customer domain name information. When a change is found in the corresponding customer address segment in the DNS log, and the change range exceeds the address segment range of the province, further analyze and find out the changed IP address, and then combine it with NetFlow information to obtain the size of the scheduling traffic. When the scheduling traffic is greater than the established threshold, it is determined whether the changed IP address is a newly added IP address or a reduced IP address. If the changed IP address is a newly added IP address, the province where the IP address is distributed and the corresponding traffic are added; if the changed IP address is a reduced IP address, the province where the IP address is distributed and the corresponding traffic are reduced.

2. The method for analyzing customer scheduling behavior based on BGP routing and DNS according to claim 1, characterized in that: The source IP field in the NetFlow information corresponds to the IP address in the DNS log and is associated with the BGP routing information to form provincial information.

3. A client scheduling behavior analysis device based on BGP routing and DNS, characterized in that: The device includes: The information collection module is used to collect NetFlow information of provincial export equipment, national BGP routing information, DNS logs and customer domain name information; The scheduling analysis module is used to obtain the address segment range corresponding to each province based on the AsPath attribute in the BGP routing information; monitor the DNS log based on the customer's domain name information. When it is found that the corresponding customer address segment in the DNS log has changed and the range of the change exceeds the address segment range of the province, further analysis is performed to find out the changed IP address, and then combined with the NetFlow information to obtain the size of the scheduling traffic; When the scheduling traffic is greater than the established threshold, it is determined whether the changed IP address is a newly added IP address or a reduced IP address. If the changed IP address is a newly added IP address, the province where the IP address is distributed and the corresponding traffic are added; if the changed IP address is a reduced IP address, the province where the IP address is distributed and the corresponding traffic are reduced.

4. The client scheduling behavior analysis device based on BGP routing and DNS according to claim 3 is characterized in that: The source IP field in the NetFlow information corresponds to the IP address in the DNS log and is associated with the BGP routing information to form provincial information.

5. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 2 is implemented.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 2.

Images