Positioning method and device for route leakage, electronic device and storage medium

Abstract

The application relates to the technical field of routing anomaly positioning, in particular to a routing leakage positioning method and device, electronic equipment and a storage medium, wherein the method comprises the following steps: acquiring a border gateway protocol update message; extracting a code composed of an autonomous system number in the update message, generating an autonomous system triple according to the code, and extracting an autonomous system triple feature corresponding to the autonomous system triple; inputting the autonomous system triple and the corresponding autonomous system triple feature into a trained random forest classifier, and outputting an actual position of routing leakage. Therefore, the problems that the routing leakage position cannot be accurately positioned and the positioning takes a long time in the related art are solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of routing anomaly positioning, and in particular to a routing leakage positioning method and device, an electronic device and a storage medium. BACKGROUND

[0002] BGP (Border Gateway Protocol) is the only inter-domain routing protocol in use, which connects all the networks in the world, i.e. autonomous systems (AS, Autonomous System). Each autonomous system learns the reachability of each destination network by exchanging BGP update messages. The AS_PATH in the BGP update message contains the AS numbers of the autonomous systems along the path to the destination network. The autonomous system receiving the update message can go to the destination network along the AS_PATH in the message. The AS_PATH can be understood as a code composed of a set of AS numbers of autonomous systems. If an autonomous system does not comply with the correct routing policy for route announcement, but announces the route to the wrong autonomous system, routing leakage may occur. Routing leakage may cause traffic to be monitored or discarded by attackers, and large-scale routing leakage often causes long-term network performance degradation or even paralysis of large network applications worldwide.

[0003] The importance of the Internet to human society is self-evident. In recent years, many major routing leakage accidents have occurred on the international Internet, and corresponding network security has become a top priority. An accurate and real-time routing leakage positioning method can help network administrators to quickly locate the routing leakage position, locate the faulty autonomous system, and generate a corresponding routing filter to minimize the adverse effects of routing leakage accidents.

[0004] Researchers have proposed a real-time routing leakage positioning method based on the commercial relationship between autonomous systems. This method checks whether the commercial relationship between autonomous systems on the AS_PATH violates the no valley principle, i.e. extracts autonomous system triples from the AS_PATH and checks each autonomous system triple to see if it violates the no valley principle. Although this method designs an algorithm that can accurately infer the commercial relationship between a pair of autonomous systems, it cannot accurately locate the routing leakage. Locating routing leakage requires knowing the commercial relationship between two pairs of autonomous systems at the same time. According to the principle of probability multiplication, the accuracy of this method in accurately determining the commercial relationship between two pairs of autonomous systems at the same time will be greatly reduced. In addition, this method cannot locate routing leakage that occurs on the edge of autonomous systems that it cannot see in advance.

[0005] Another type of method is to directly apply machine learning to the statistical features of a large number of BGP update messages to detect route leakage. Although this type of method can achieve accurate route leakage detection, they cannot locate the position of route leakage, that is, the three-tuple of the autonomous system where the leakage occurs, the autonomous system that receives the leaked route, and the autonomous system that is the source of the leaked route. Therefore, BGP security experts still need to spend a long time to locate the route leakage. In addition, this type of method needs a long time to periodically collect and calculate statistical features, which will result in a large detection delay. In summary, the current work is difficult to achieve accurate and real-time route leakage positioning at the same time. SUMMARY

[0006] The present application provides a route leakage positioning method, device, electronic equipment and storage medium to solve the problems of inaccurate route leakage positioning and long positioning time in related technologies.

[0007] The first aspect embodiment of the present application provides a route leakage positioning method, comprising the following steps: obtaining an update message of a border gateway protocol; extracting an encoding composed of an autonomous system number in the update message, generating an autonomous system three-tuple according to the encoding, and extracting an autonomous system three-tuple feature corresponding to the autonomous system three-tuple; inputting the autonomous system three-tuple and the corresponding autonomous system three-tuple feature into a trained random forest classifier, and outputting the actual position of route leakage.

[0008] Optionally, the training of the random forest classifier comprises: obtaining a route leakage event, wherein the route leakage event comprises an autonomous system three-tuple where route leakage occurs and an autonomous system three-tuple where route leakage does not occur; generating positive and negative samples according to the autonomous system three-tuple where route leakage occurs, the autonomous system three-tuple where route leakage does not occur, and the respective corresponding autonomous system three-tuple features; training the random forest classifier using the positive and negative samples until a training stop condition is met, to obtain the trained random forest classifier.

[0009] Optionally, the extracting of the autonomous system three-tuple feature corresponding to the autonomous system three-tuple comprises: querying a pre-established database with the autonomous system three-tuple as an index, and outputting the autonomous system three-tuple feature.

[0010] Optionally, the database stores autonomous system features updated at intervals of a preset time length, wherein the autonomous system distance, autonomous system degree, and autonomous system type in the autonomous system features are updated by a first route data source, the autonomous system address space in the autonomous system features is updated by a second route data source and a third route data source, and the autonomous system geographic location in the autonomous system features is updated by the first route data source and a fourth route data source.

[0011] Optionally, the generating the autonomous system triple according to the code comprises: identifying preset codes, repeated codes and target fields in the code; discarding or removing the preset codes, deleting the repeated codes, and generating respective corresponding autonomous system triples for autonomous systems corresponding to autonomous system numbers contained in the target fields, wherein for a preset code satisfying a preset condition, the autonomous system triple corresponding to the code is discarded.

[0012] Optionally, after outputting the actual location of the route leak, the method further comprises: generating alarm information of the route leak, and sending the alarm information to a preset terminal.

[0013] The second aspect embodiment of the present application provides a positioning device for route leak, comprising: an acquisition module configured to acquire an update message of a border gateway protocol; an extraction module configured to extract a code composed of autonomous system numbers from the update message, generate autonomous system triples according to the code, and extract autonomous system triple features corresponding to the autonomous system triples; and an output module configured to input the autonomous system triples and the corresponding autonomous system triple features into a trained random forest classifier, and output an actual location of a route leak.

[0014] Optionally, the output module is further configured to: acquire route leak events, wherein the route leak events comprise autonomous system triples in which route leak occurs and autonomous system triples in which route leak does not occur; generate positive and negative samples according to the autonomous system triples in which route leak occurs, the autonomous system triples in which route leak does not occur, and respective corresponding autonomous system triple features; and train the random forest classifier using the positive and negative samples until a training stop condition is met, to obtain the trained random forest classifier.

[0015] Optionally, the extraction module is further configured to: query a pre-established database using the autonomous system triples as indexes, and output the autonomous system triple features.

[0016] Optionally, the database stores autonomous system features updated at intervals of a preset time length, wherein autonomous system distances, autonomous system degrees and autonomous system types in the autonomous system features are updated by a first route data source, autonomous system address spaces in the autonomous system features are updated by a second route data source and a third route data source, and autonomous system geographic locations in the autonomous system features are updated by the first route data source and a fourth route data source.

[0017] Optionally, the extracting module is further configured to: identify preset encodings, repeated encodings and a target field in the encoding; discard or remove the preset encodings, delete the repeated encodings, and generate respective autonomous system triplets corresponding to autonomous systems corresponding to autonomous system numbers contained in the target field, wherein for a preset encoding satisfying a preset condition, discard the autonomous system triplet corresponding to the encoding.

[0018] Optionally, the method further includes: generating alarm information of the route leak after outputting the actual position of the route leak, and sending the alarm information to a preset terminal.

[0019] The third aspect of the embodiments of the present application provides an electronic device, including: a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor executes the program to implement the positioning method of the route leak as described in the above embodiments.

[0020] The fourth aspect of the embodiments of the present application provides a computer readable storage medium having a computer program stored thereon, which is executed by a processor to implement the positioning method of the route leak as described in the above embodiments.

[0021] Therefore, the present application has at least the following beneficial effects:

[0022] The embodiments of the present application can locate the route leak from the AS_PATH in the BGP update message by obtaining the autonomous system triplet features and training the random forest classifier; extract the AS_PATH from a single BGP update message, generate multiple autonomous system triplets, and then judge each autonomous system triplet to determine whether the route leak occurs; the autonomous system triplet features can accurately distinguish the route leak and the normal route; the relatively stable autonomous system triplet features are used, which do not need to be collected frequently, thereby saving the positioning time, and based on the lightweight random forest classifier, the route leak position can be located in real time. Therefore, the technical problems of being unable to accurately locate the route leak position and taking a long time to locate in the related art are solved.

[0023] Additional aspects and advantages of the present application will be in part apparent and in part pointed out hereinafter. BRIEF DESCRIPTION OF DRAWINGS

[0024] The above and / or additional aspects and advantages of the present application will become apparent and be readily appreciated from the following description, including the accompanying drawings, in which:

[0025] Figure 1 A flowchart of the positioning method of the route leak according to the embodiments of the present application is provided.

[0026] Figure 2A schematic diagram of a positioning method for route leakage provided by an embodiment of the present application;

[0027] Figure 3 A schematic diagram of a delay cumulative distribution of a positioning method for route leakage provided by an embodiment of the present application;

[0028] Figure 4 A schematic diagram of a positioning device for route leakage according to an embodiment of the present application;

[0029] Figure 5 A schematic diagram of the structure of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0030] Embodiments of the present application are described in detail below with reference to the accompanying drawings, in which the same or similar notations used throughout the drawings denote the same or similar elements or elements having the same or similar functions. The embodiments described below by reference to the accompanying drawings are exemplary and are intended to explain the present application, and should not be understood as limiting the present application.

[0031] A positioning method, device, electronic device and storage medium for route leakage according to an embodiment of the present application are described below with reference to the accompanying drawings. In view of the problem that the current positioning method for route leakage cannot accurately locate route leakage and needs a long time to collect and calculate statistical features periodically, the present application provides a positioning method for route leakage, in which autonomous system triple features are obtained and a random forest classifier is trained to locate route leakage, which can accurately distinguish between route leakage and normal routing, and uses autonomous system triple features that are relatively stable and do not need to be collected frequently. Thus, the problems of being unable to accurately locate route leakage in the related art and taking a long time to locate are solved.

[0032] Specifically, Figure 1 A flowchart of a positioning method for route leakage provided by an embodiment of the present application.

[0033] As Figure 1 shown, the positioning method for route leakage includes the following steps:

[0034] In step S101, an update message of a border gateway protocol is obtained.

[0035] The border gateway protocol (BGP) is a path vector routing protocol for exchanging reachability information between autonomous systems (AS), and the protocol mainly propagates routing information through update messages.

[0036] Autonomous System (AS): The Internet is a huge network made up of hundreds of thousands of smaller networks called autonomous systems (AS). Each of these autonomous systems is essentially a large pool of routers run by a single organization, and an autonomous system is a large network or group of networks managed by a single organization. An autonomous system can have many subnets, but all share the same routing policy. Each autonomous system is assigned its own autonomous system number (ASN) for easy identification.

[0037] It can be understood that the embodiments of the present application can obtain the update information of the border gateway protocol from the route collectors of RIPE NCC and RouteView, for subsequent positioning of the location of the routing leakage.

[0038] Among them, RIPE NCC is the regional Internet registrar of Europe, the Middle East and part of Central Asia, which provides route collectors and the inter-domain routing table and routing update data collected by the route collectors for the network research community; RouteViews is a project established by the Advanced Network Technology Center of the University of Oregon, which provides route collectors and the inter-domain routing table and routing update data collected by the route collectors for the network research community.

[0039] In step S102, the code composed of the autonomous system number in the update message is extracted, the autonomous system triple is generated according to the code, and the autonomous system triple corresponding to the autonomous system triple is extracted.

[0040] It can be understood that the embodiments of the present application can obtain the code composed of the autonomous system number (AS_PATH) from the update information in the border gateway protocol, generate the autonomous system triple according to the code, and perform feature extraction on the autonomous system triple.

[0041] It should be noted that the BGP update message will add its autonomous system number to its AS_PATH every time it passes through an autonomous system. There may be an AS_SET for route aggregation in the AS_PATH, which contains multiple autonomous system numbers.

[0042] In the embodiments of the present application, the autonomous system triple is generated according to the code, including: identifying the preset code, repeated number and target field in the code; discarding or removing the preset code, deleting the repeated code, and generating respective corresponding autonomous system triples for the autonomous systems corresponding to the autonomous system numbers contained in the target field, wherein for the preset code satisfying the preset condition, the autonomous system triple corresponding to the code is discarded.

[0043] Among them, the preset code can be an abnormal code or a code containing a ring, etc.; the target field can be 23456; the preset condition refers to the code containing the preset code, the repeated code and the target field.

[0044] It can be understood that the embodiments of the present application can preprocess the acquired AS_PATH, filter out illegal paths and abnormal autonomous system numbers, and generate autonomous system triples. The specific steps are as follows:

[0045] 1. Discard the AS_PATH containing a loop.

[0046] 2. Process path filling and delete duplicate autonomous system numbers in the AS_PATH, leaving only one of the duplicate autonomous system numbers.

[0047] 3. Process the AS_SET in the AS_PATH, and generate respective autonomous system triples for the autonomous systems in the AS_SET.

[0048] 4. Remove the reserved autonomous system numbers in the AS_PATH. Among them, for specific autonomous system numbers such as 23456, discard the autonomous system triples containing the numbers.

[0049] In the embodiments of the present application, the autonomous system triple corresponding to the autonomous system triple feature is extracted, including: querying the pre-established database with the autonomous system triple as the index, and outputting the autonomous system triple feature.

[0050] Among them, the database is used to store the relationship between the autonomous system triple and the autonomous system triple feature.

[0051] It can be understood that the embodiments of the present application can query the autonomous system triple corresponding to the autonomous system triple feature in the database.

[0052] It should be noted that the present application needs to periodically collect autonomous system features from the route data source and store them in the database. The route data source is: RIPE NCC, RouteViews, CAIDA and PeeringDB.

[0053] Among them, RIPE NCC and RouteViews have been described in the above embodiments and will not be repeated here. CAIDA is the Center for Applied Internet Data Analysis, which provides Internet measurement data for the network research community; PeeringDB is a web-based Internet connection information database.

[0054] In the embodiments of the present application, the database stores autonomous system features updated at intervals of a preset time length, wherein the autonomous system distance, the autonomous system degree and the autonomous system type in the autonomous system feature are updated by the first route data source, the autonomous system address space in the autonomous system feature is updated by the second route data source and the third route data source, and the autonomous system geographic location in the autonomous system feature is updated by the first route data source and the fourth route data source.

[0055] The preset interval duration can be set according to specific conditions, and is not limited.

[0056] It can be understood that the autonomous system features can be periodically collected from the routing data sources and stored in the database.

[0057] Taking the first routing data source as CAIDA, the second routing data source as RIPE NCC, the third routing data source as RouteViews, and the fourth routing data source as PeeringDB as an example, the specific steps of collecting autonomous system features by the embodiments of the present application are as follows:

[0058] 1. Obtain the autonomous system distance, autonomous system degree, and autonomous system type from the routing data source CAIDA. The autonomous system distance refers to the average number of hops from the autonomous system to each layer autonomous system; the autonomous system type is divided into three categories, namely content provider, enterprise network, and access and transmission service provider. This method uses 0 to represent the content provider, 1 to represent the enterprise network, and 2 to represent the transmission service provider.

[0059] 2. Obtain the autonomous system address space from the routing data sources RIPE NCC and RouteViews.

[0060] 3. Obtain the autonomous system geographic location from the routing data sources CAIDA and PeeringDB. The autonomous system geographic location refers to the country and IXP to which the autonomous system belongs. This method uses 1-5 to represent the geographic location relationship of the three autonomous systems in <AS1, AS2, AS3>. AS1 geographic location is the same as AS2 geographic location and different from AS3 geographic location, represented as 1; AS1 geographic location is the same as AS3 geographic location and different from AS2 geographic location, represented as 2; AS2 geographic location is the same as AS3 geographic location and different from AS1 geographic location, represented as 3; AS1, AS2, and AS3 geographic locations are all different, represented as 4; AS1, AS2, and AS3 geographic locations are all the same, represented as 5.

[0061] 4. Store the autonomous system features obtained above in the database and periodically update.

[0062] It should be noted that IXP is an Internet Exchange Center, which is one of the physical infrastructures of the Internet and can help autonomous systems exchange Internet traffic efficiently.

[0063] In step S103, the autonomous system triple and the corresponding autonomous system triple features are input into the trained random forest classifier, and the actual position of the routing leak is output.

[0064] It can be understood that the embodiments of the present application can locate the actual position of the route leakage by obtaining the autonomous system triplets and corresponding autonomous system triplet features input into the trained random forest classifier.

[0065] It should be noted that route leakage refers to route leakage caused by the fact that the propagation of BGP update messages violates the no-valley principle, that is, an autonomous system cannot announce the route from its own provider or peer to another provider or peer of the autonomous system. The no-valley principle is a rule followed by the propagation of BGP update messages. Autonomous systems have different hierarchical positions in inter-domain routing. Generally speaking, the provider of an autonomous system is higher than its hierarchical position, the peer of an autonomous system is generally equivalent to its hierarchical position, and the customer of an autonomous system is lower than its hierarchical position. The path formed by the autonomous systems through which the BGP update message propagates cannot form a valley shape, that is, the update message cannot propagate from a high-level autonomous system to a low-level autonomous system and then to a high-level autonomous system. Specifically, an autonomous system can announce the route from its own customer to any other neighbor, can announce the route from its own peer to any customer neighbor, and can announce the route from its own provider to any customer neighbor.

[0066] Specifically, the trained random forest classifier locates the route leakage according to the input autonomous system triplets and corresponding triplet features, for example, locates the route leakage to the autonomous system triplet <AS1, AS2, AS3>. The autonomous system that leaks the route is AS2, the receiver of the leaked route is AS1, and the route leaked by AS2 comes from AS3.

[0067] In the embodiments of the present application, the training of the random forest classifier includes: obtaining a route leakage event, wherein the route leakage event includes an autonomous system triplet in which route leakage occurs and an autonomous system triplet in which route leakage does not occur; generating positive and negative samples according to the autonomous system triplet in which route leakage occurs, the autonomous system triplet in which route leakage does not occur, and the respective corresponding autonomous system triplet features; training the random forest classifier using the positive and negative samples until a training stop condition is met, and obtaining a trained random forest classifier.

[0068] It can be understood that the embodiments of the present application can collect route leakage events from a route leakage event data source, train a random forest classifier, and then use the random forest classifier to locate route leakage events according to autonomous system triplet features.

[0069] It can be understood that the training steps of the random forest classifier specifically include:

[0070] 1. Collect route leakage events from the BGPStream platform, which is a route leakage event data source, to obtain autonomous system triplets in which route leakage occurs and normal autonomous system triplets.

[0071] 2. Using the obtained autonomous system triplets of routing leaks and normal autonomous system triplets and their corresponding triplet features as positive and negative samples, training a random forest classifier.

[0072] Wherein, BGPStream is an alert platform that provides information about hijacks, leaks and failures in BGP.

[0073] In the embodiments of the present application, after outputting the actual position of the routing leak, the method further comprises: generating an alarm information of the routing leak, and sending the alarm information to a preset terminal.

[0074] Wherein, the preset terminal can be a display, etc., which is not limited.

[0075] It can be understood that, after outputting the actual position of the routing leak, the embodiments of the present application can generate corresponding alarm information of the located routing leak, and send the alarm information to a preset terminal (such as a display screen), so as to timely inform the corresponding network administrator of the problem of routing leak.

[0076] The positioning method of routing leak will be described below through a specific implementation, as shown in Figure 2 The method comprises the following steps:

[0077] Step 1, BGP update message preprocessing. Obtaining AS_PATH in BGP update message from a route collector, and filtering out illegal paths and abnormal autonomous system numbers to generate autonomous system triplets.

[0078] Step 2, autonomous system triplet feature extraction. Collecting autonomous system features from a route data source periodically and storing them in a database, and generating corresponding autonomous system triplet features according to the autonomous system triplets.

[0079] Step 3, routing leak positioning. Collecting routing leak events from a routing leak event data source, training a random forest classifier, and then using the random forest classifier to locate routing leaks and generate alerts according to autonomous system triplet features,

[0080] The positioning method of routing leak will be described below through a specific implementation, as shown in

[0081] 1. BGP update message preprocessing. Obtaining AS_PATH as [4637, 4775, 4766, 174, 3491, 65000] from a route collector, filtering out abnormal autonomous system number 65000, and generating autonomous system triplets: <4637, 4775, 4766>, <4775, 4766, 174> and <4766, 174, 3491>.

[0082] 2. Autonomous system triplets feature extraction. Autonomous system features are periodically collected from routing data sources. According to autonomous system triplets, corresponding triplet features are generated as shown in Table 1. The contents of autonomous system triplet features are: <AS1 distance, AS2 distance, AS3 distance>, <AS1 address space, AS2 address space, AS3 address space>, <AS1 degree, AS2 degree, AS3 degree>, <AS1 type, AS2 type, AS3 type>, the relationship of 3 autonomous systems belonging to countries, and the relationship of 3 autonomous systems belonging to IXPs.

[0083] Table 1

[0084]

[0085] 3. Route leak positioning. From the route leak event data source BGPStream, the AS_PATH of the route leak event is collected as: [53432, 13994, 7029, 6461, 37662, 37204, 5511, 174, 25818], in which 37204 is the leaking autonomous system, which leaks the route to the autonomous system 37662. The autonomous system triplet <37662, 37204, 5511> of the route leak is taken as a positive sample for training, and the normal autonomous system triplets <53432, 13994, 7029>, <13994, 7029, 6461>, <7029, 6461, 37662>, <6461, 37662, 37204>, <37204, 5511, 174> and <5511, 174, 25818> are taken as negative samples for training. Similarly, the triplet features corresponding to these autonomous system triplets are obtained. Then, the balanced positive and negative samples and their corresponding triplet features are used to train the random forest classifier. The trained random forest classifier receives the autonomous system triplet <3320, 9002, 44628>, and the classifier detects that the triplet has route leak according to the triplet features corresponding to the autonomous system triplet, and locates 9002 as the leaking autonomous system, which leaks the route from the autonomous system 44628 to the autonomous system 3320. Finally, the corresponding alarm is generated and timely notified to the relevant network administrator. When the implementation environment is a Dell PowerEdge R740 rack server equipped with Intel Xeon(R) Gold 6230R CPU @ 2.10 GHz and 128 GB RAM, the route leak can be located in an average of 7.86 milliseconds, as shown in Figure 3 Table 2 shows the accuracy of route leak positioning, which can achieve more than 90% route leak positioning accuracy.

[0086] Table 2

[0087] False positive rate Recall Precision Accuracy F1 score The present application 0.11 0.92 0.90 0.91 0.91

[0088] The positioning method for route leakage provided in the embodiments of the present application can locate route leakage from AS_PATH in BGP update messages by obtaining autonomous system triple characteristics and training a random forest classifier; AS_PATH is extracted from a single BGP update message, a plurality of autonomous system triples are generated, and then it is judged whether each autonomous system triple has route leakage; the autonomous system triple characteristics can accurately distinguish route leakage from normal routes; the autonomous system triple characteristics are relatively stable and do not need to be collected frequently, which saves positioning time and can locate the route leakage position in real time based on a lightweight random forest classifier.

[0089] Next, the positioning device for route leakage provided in the embodiments of the present application is described with reference to the accompanying drawings.

[0090] Figure 4 is a block schematic diagram of the positioning device for route leakage in the embodiments of the present application.

[0091] As shown in Figure 4 , the positioning device for route leakage 10 comprises an acquisition module 100, an extraction module 200 and an output module 300.

[0092] The acquisition module 100 is configured to acquire a border gateway protocol update message; the extraction module 200 is configured to extract a code composed of autonomous system numbers in the update message, generate autonomous system triples according to the code, and extract autonomous system triple characteristics corresponding to the autonomous system triples; and the output module 300 is configured to input the autonomous system triples and the corresponding autonomous system triple characteristics into a trained random forest classifier, and output the actual position of route leakage.

[0093] In the embodiments of the present application, the output module 300 is further configured to: acquire route leakage events, wherein the route leakage events include autonomous system triples with route leakage and autonomous system triples without route leakage; generate positive and negative samples according to the autonomous system triples with route leakage, the autonomous system triples without route leakage and the autonomous system triple characteristics corresponding thereto; and train the random forest classifier using the positive and negative samples until a training stop condition is met, to obtain the trained random forest classifier.

[0094] In the embodiments of the present application, the extraction module 200 is further configured to: query a pre-established database with the autonomous system triples as indexes, and output the autonomous system triple characteristics.

[0095] In the embodiment of the present application, the database stores the autonomous system features updated at intervals of a preset time length, wherein the autonomous system distance, the autonomous system degree and the autonomous system type in the autonomous system features are updated by the first routing data source, the autonomous system address space in the autonomous system features is updated by the second routing data source and the third routing data source, and the autonomous system geographic location in the autonomous system features is updated by the first routing data source and the fourth routing data source.

[0096] In the embodiment of the present application, the extraction module 200 is further configured to: identify the preset encoding, the repeated encoding and the target field in the encoding; discard or remove the preset encoding, delete the repeated encoding, and generate respective autonomous system triples corresponding to the autonomous systems corresponding to the autonomous system numbers contained in the target field, wherein for the preset encoding satisfying the preset condition, the autonomous system triple corresponding to the encoding is discarded.

[0097] In the embodiment of the present application, the device 10 of the present application further comprises a sending module.

[0098] The sending module is configured to generate an alarm information of the routing leak after outputting the actual position of the routing leak, and send the alarm information to a preset terminal.

[0099] It should be noted that the above explanation of the positioning method embodiment of the routing leak is also applicable to the positioning device of the routing leak of this embodiment, which will not be described here.

[0100] The positioning device of the routing leak according to the embodiment of the present application can locate the routing leak from the AS_PATH in the BGP update message by obtaining the autonomous system triple feature and training the random forest classifier; extract the AS_PATH from a single BGP update message to generate a plurality of autonomous system triples, and then judge whether each autonomous system triple occurs routing leak; the autonomous system triple feature can accurately distinguish routing leak and normal routing; using the relatively stable autonomous system triple feature which does not need to be collected frequently, the positioning time is saved, and based on the lightweight random forest classifier, the routing leak position can be located in real time.

[0101] Figure 5 The electronic device provided in the embodiment of the present application is shown in a structural schematic diagram. The electronic device can include:

[0102] The memory 501, the processor 502, and the computer program stored in the memory 501 and executable on the processor 502.

[0103] The processor 502 executes the program to implement the positioning method of the routing leak provided in the above embodiments.

[0104] Further, the electronic device further includes:

[0105] The communication interface 503 is configured to communicate between the memory 501 and the processor 502.

[0106] The memory 501 is configured to store a computer program executable in the processor 502.

[0107] The memory 501 can include a high-speed RAM (Random Access Memory) memory, and can further include a nonvolatile memory, for example, at least one disk memory.

[0108] If the memory 501, the processor 502 and the communication interface 503 are independently implemented, the communication interface 503, the memory 501 and the processor 502 can be connected through a bus and communicate with each other. The bus can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component) bus or an EISA (Extended Industry Standard Architecture) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, Figure 5 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0109] Optionally, in a specific implementation, if the memory 501, the processor 502 and the communication interface 503 are integrated on a chip, the memory 501, the processor 502 and the communication interface 503 can communicate with each other through an internal interface.

[0110] The processor 502 can be a CPU (Central Processing Unit) or an ASIC (Application Specific Integrated Circuit) or one or more integrated circuits configured to implement the embodiments of the present application.

[0111] The embodiments of the present application further provide a computer readable storage medium, which stores a computer program, and the program is executed by the processor to implement the above-mentioned method for positioning route leakage.

[0112] In the description of the application, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the application. In the description of the application, the illustrative description of the above terms is not necessarily directed to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in any one or N embodiments or examples. In addition, the person skilled in the art can combine and combine the different embodiments or examples described in the description and the features of the different embodiments or examples, without contradiction.

[0113] In addition, the terms "first", "second" are only for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include at least one of the features. In the description of the application, the meaning of "N" is at least two, for example, two, three, etc., unless otherwise specifically limited.

[0114] Any process or method descriptions in flow charts or otherwise described herein can be understood as representing code modules, segments, or portions of code that include one or more executable instructions for implementing specific logic functions (or steps) in the process, and the various embodiments of the application contemplate that the modules, segments, or portions of code may, in some embodiments, be implemented by hardware, software, firmware, or any combination thereof. The various embodiments of the application contemplate that the order in which some or all of the process blocks are described can be changed, and that some or all of the process blocks can be performed in parallel, in any order, including according to the functions involved, as will be understood by those skilled in the art.

[0115] It should be understood that portions of the application can be implemented in hardware, software, firmware, or combinations thereof. In the above embodiments, the N steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. As in another embodiment, if implemented in hardware, any of the following technologies known in the art or their combinations can be used: discrete logic circuit with logic gate circuit for implementing logic functions on data signals, application specific integrated circuit with suitable combination logic gate circuit, programmable gate array, field programmable gate array, etc.

[0116] Those skilled in the art of the art can understand that all or part of the steps carried out by the above-mentioned embodiment method can be completed by a program instructing the relevant hardware, and the program can be stored in a computer readable storage medium. The program includes one of the steps of the method embodiment or its combination when executed.

[0117] Although the embodiments of the present application have been shown and described above, it is understood that the above-described embodiments are exemplary and are not to be construed as limiting the present application, and that changes, modifications, substitutions and variations can be made by those skilled in the art without departing from the scope of the present application.

Claims

1. A method for locating route leaks, characterized in that: The following steps are involved: Get Border Gateway Protocol update messages; Extracting a code consisting of an autonomous system number from the update message, generating an autonomous system triplet based on the code, and extracting an autonomous system triplet feature corresponding to the autonomous system triplet; extracting the autonomous system triplet feature corresponding to the autonomous system triplet includes: using the autonomous system triplet as an index, querying a pre-established database, and outputting the autonomous system triplet feature; the database stores autonomous system features updated at preset intervals, wherein the autonomous system distance, autonomous system degree, and autonomous system type in the autonomous system features are updated via a first routing data source, the autonomous system address space in the autonomous system features are updated via a second routing data source and a third routing data source, and the autonomous system geographic location in the autonomous system features is updated via the first routing data source and a fourth routing data source; The autonomous system triplet and the corresponding autonomous system triplet features are input into the trained random forest classifier to output the actual location of the route leak.

2. The method according to claim 1, characterized in that The training of the random forest classifier includes: Acquire a route leakage event, wherein the route leakage event includes an autonomous system triplet in which route leakage occurs and an autonomous system triplet in which route leakage does not occur; Generate positive and negative samples according to the autonomous system triplet where route leakage occurs, the autonomous system triplet where route leakage does not occur, and their corresponding autonomous system triplet features; The random forest classifier is trained using the positive and negative samples until a training stop condition is met, thereby obtaining a trained random forest classifier.

3. The method according to claim 1, characterized in that Generating an autonomous system triplet according to the encoding includes: Identifying a preset code, a repeating number, and a target field in the code; The preset code is discarded or removed, the repeated number is deleted, and corresponding autonomous system triples are generated for the autonomous systems corresponding to the autonomous system numbers contained in the target field, wherein for the preset code that meets the preset conditions, the autonomous system triples corresponding to the code are discarded.

4. The method according to any one of claims 1 to 3, characterized in that After outputting the actual location of the route leak, it also includes: Generate route leakage alarm information and send the alarm information to a preset terminal.

5. A positioning device for route leakage, characterized in that: include: An acquisition module, used for acquiring update messages of the Border Gateway Protocol; an extraction module configured to extract a code consisting of an autonomous system number from the update message, generate an autonomous system triplet based on the code, and extract an autonomous system triplet feature corresponding to the autonomous system triplet; the extraction module further configured to query a pre-established database using the autonomous system triplet as an index and output the autonomous system triplet feature; the database storing autonomous system features updated at preset intervals, wherein the autonomous system distance, autonomous system degree, and autonomous system type in the autonomous system features are updated via a first routing data source, the autonomous system address space in the autonomous system features are updated via second and third routing data sources, and the autonomous system geographic location in the autonomous system features is updated via the first and fourth routing data sources; The output module is used to input the autonomous system triplet and the corresponding autonomous system triplet feature into the trained random forest classifier, and output the actual location of the route leakage.

6. The device according to claim 5, characterized in that The output module is further configured to: Acquire a route leakage event, wherein the route leakage event includes an autonomous system triplet in which route leakage occurs and an autonomous system triplet in which route leakage does not occur; Generate positive and negative samples according to the autonomous system triplet where route leakage occurs, the autonomous system triplet where route leakage does not occur, and their corresponding autonomous system triplet features; The random forest classifier is trained using the positive and negative samples until a training stop condition is met, thereby obtaining a trained random forest classifier.

7. The device according to claim 5, characterized in that The extraction module is further configured to: Identifying a preset code, a repeating number, and a target field in the code; The preset code is discarded or removed, the repeated number is deleted, and corresponding autonomous system triples are generated for the autonomous systems corresponding to the autonomous system numbers contained in the target field, wherein for the preset code that meets the preset conditions, the autonomous system triples corresponding to the code are discarded.

8. The device according to any one of claims 5 to 7, characterized in that: Also includes: The sending module is used to generate route leakage alarm information after outputting the actual location of the route leakage, and send the alarm information to a preset terminal.

9. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method for locating route leakage according to any one of claims 1 to 4.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the method for locating route leakage according to any one of claims 1 to 4.

Images