Internet autonomous system type mapping method based on correlation topology network dynamic characteristics

Abstract

The application relates to an Internet autonomous domain type mapping method related to the dynamic characteristics of a topology network and belongs to the field of computer and information science. First, autonomous domain registration information is obtained through a whois database; second, BERT is used to extract semantic features of the registration information, and meanwhile, the similarity between different autonomous domains is calculated according to specific autonomous domain attributes in the registration information; then, an autonomous domain topology network is generated in combination with the specific autonomous domain attributes and the similarity between the autonomous domains, and time attention mechanism is used to extract dynamic characteristics of the topology network; finally, semantic features and topology network dynamic characteristics are fused to perform Internet autonomous domain type mapping. In view of the problem that the autonomous domain registration information is incomplete, an autonomous domain topology network dynamic characteristic extraction method is proposed, and the accuracy of Internet autonomous domain type mapping is improved.

Description

TECHNICAL FIELD

[0001] The application relates to an Internet autonomous domain type mapping method related to a topological network dynamic feature and belongs to the field of computer and information science. BACKGROUND

[0002] With the increase of the size and complexity of the Internet and the deepening of the influence on political and economic interests, the autonomous system plays an increasingly key role in the stable operation of the Internet. The autonomous system or autonomous domain (AS) refers to the combination of all IP networks and routers under the jurisdiction of one or more entities in the Internet, which perform common routing policies on the Internet. An autonomous system usually belongs to an Internet service provider, a network information center, an Internet exchange center, an Internet data center, a content distribution network service provider, a university, an organization with multiple networks and independent connections. Autonomous domain type mapping is an important step in network space mapping, which helps to plan network structure, develop emergency plans, detect inter-domain routing attacks, divide network space security boundaries, and evaluate routing security situation. It is of great significance to research.

[0003] Currently, the research on the attributes of the autonomous domain system mainly focuses on network topology, business relationship, industry classification and routing mapping, and the existing autonomous domain type mapping methods are limited to the static attributes of the autonomous domain, including the registration authority of the autonomous domain, description, country of origin, geographical location, network size, business relationship and connection relationship. Due to the different registration authorities of the autonomous domain, there are incomplete data and data ambiguity, resulting in that the autonomous domain type mapping of large-scale Internet service providers, network information centers and Internet distribution networks has high accuracy rate, while the autonomous domain type mapping of small-scale Internet service providers, universities and organizations has low accuracy rate.

[0004] In summary, the existing autonomous domain type mapping methods mainly have the following problems: (1) due to the incomplete data and data ambiguity of the registration information, the accuracy rate of the autonomous domain type mapping of small-scale Internet service providers, universities and organizations is low; (2) the existing methods only limit the research on the static features of the autonomous domain topology such as connection relationship and business relationship, and do not consider the semantic relationship of different autonomous domain attributes and dynamic features. SUMMARY

[0005] The purpose of the present application is to solve the problem that the registration information used by the existing methods has incomplete data and data ambiguity, and does not consider the semantic relationship of different autonomous domain attributes and the dynamic features of the autonomous domain topology network, resulting in low accuracy rate of the autonomous domain type mapping of small-scale autonomous domains.

[0006] The principle involved in the present application is: first, the autonomous domain registration information is obtained through the whois database; second, the semantic features of the registration information are extracted using BERT, and the similarity between different autonomous domains is calculated according to the specific autonomous domain attributes in the registration information; then, the autonomous domain topology network is generated combining the specific autonomous domain attributes and the similarity between autonomous domains, and the dynamic features of the topology network are extracted using the time attention mechanism; finally, the semantic features and the dynamic features of the topology network are fused for internet autonomous domain type mapping.

[0007] The technical solution of the present application is realized by the following steps:

[0008] Step 1, first, the autonomous domain registration information is obtained through the whois database, and the semantic feature vectors c of the registration authority and the description information in the registration information are extracted using BERT.

[0009] Step 2, the dynamic feature vectors t of the topology network are obtained using the autonomous domain topology network combining the specific autonomous domain attributes and the similarity between autonomous domains.

[0010] Step 2.1, the semantic relationship between autonomous domains is calculated using the autonomous domain attribute information, and the autonomous domain attribute similarity matrix is obtained.

[0011] Step 2.2, the autonomous domain topology network is generated combining the specific autonomous domain attributes and the similarity between autonomous domains, and the dynamic features of the topology network are extracted using the time attention mechanism.

[0012] Step 3, the semantic features and the dynamic features of the topology network are fused for internet autonomous domain type mapping.

[0013] Step 3.1, the correlation vector is calculated according to the semantic feature vector and the dynamic feature vector of the topology network.

[0014] Step 3.2, the autonomous domain feature vector s is obtained combining the correlation vector.

[0015] Step 3.3, the autonomous domain type mapping is realized by the autonomous domain feature vector s through the linear classifier.

[0016] Advantages

[0017] The present application proposes and uses a dynamic feature extraction method of autonomous domain topology network to improve the accuracy of internet autonomous domain type mapping in view of the problem of incomplete autonomous domain registration information. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 The principle diagram of the internet autonomous domain type mapping method of the present application associated with the dynamic features of the topology network. DETAILED DESCRIPTION

[0019] For better illustrating the purposes and advantages of the present application, the embodiments of the method of the present application are further explained in detail below with examples.

[0020] In the experimental data, the autonomous domain topology data comes from Traceroute data and BGP routing data collected through RouteViews and RIPERIS, daily updates and retains historical autonomous domain topology relationship data, and constructs dynamic autonomous domain topology relationship; the autonomous domain registration information data comes from the whois database. The autonomous domain type mapping experimental data is shown in Table 1.

[0021] Table 1. Autonomous domain type mapping experimental data

[0022]

[0023] The experiment uses precision (Precision) to evaluate the results of autonomous domain type mapping, and the accuracy calculation method is shown in formula (1):

[0024]

[0025] Among them, TP is actually positive, and is predicted to be positive; TN is actually negative, and is predicted to be negative; FP is actually negative, and is predicted to be positive; TN is actually positive, and is predicted to be negative.

[0026] The specific process is as follows:

[0027] Step 1, first obtain the autonomous domain registration information through the whois database, and use BERT to extract the semantic feature vector c of the registration organization and description information in the registration information.

[0028] Step 2, use the autonomous domain topology network combined with the similarity between the specific autonomous domain attribute and the autonomous domain to obtain the dynamic feature vector t of the topology network.

[0029] Step 2.1, in order to fully utilize the attribute information of the autonomous domain to explore its potential association, the semantic relationship between autonomous domains is calculated using autonomous domain attribute information quantification index to obtain the autonomous domain attribute similarity matrix.

[0030] Quantify the autonomous domain attribute information. The registration date, status, geographic location, autonomous domain level, connection number and IP number 6 types of attribute indexes in the autonomous domain attribute information are normalized. The definition and calculation method are shown in Table 1.

[0031] Table 1 Definition of autonomous domain attribute information quantification index

[0032]

[0033]

[0034] Computing inter-domain semantic relationship. The semantic relationship between domains is obtained by computing the similarity of domain attribute information quantization indicators. The similarity of attribute quantization indicators is captured from the entire domain network, which can discover potential connections that cannot be provided by topology information. Given a domain network G = (V, E, R k ), R k is the attribute information quantization indicator vector of the domain, the similarity value is obtained by computing the dot product of two domain attribute information quantization indicator vectors according to formula (2) (3), and the domain attribute similarity matrix P ∈ R m×m is obtained by computing the similarity of all domain attributes, m represents the total number of domains, P ij = 1 indicates that the dot product result sim i,j is greater than the set threshold Ф, the attribute information of domain i and domain j is similar, otherwise P ij = 0.

[0035]

[0036]

[0037] Step 2.2, generate a domain topology network by combining specific domain attributes and inter-domain similarity, obtain a domain network G = (V, E, T, R), where V is a set of domain nodes in the domain network, E is a set of inter-domain connection relationships, T ∈ R m×m is a relationship network obtained by combining the adjacency matrix and the domain attribute similarity matrix, R ∈ R m×l is the domain attribute information quantization indicator matrix, m represents the total number of domains, and l represents the number of domain attribute indicators. A mapping function is defined. The mapping function f represents the topology structure feature representation of the domain.

[0038] The neighborhood information set of domain v on the relationship network T is obtained by using the sampling strategy The learning of domain topology structure feature representation is regarded as a maximum likelihood optimization problem, and the network topology structure feature vector of domain v at time t is obtained according to the objective functions of formula (4) (5) (6)

[0039]

[0040]

[0041]

[0042] The time attention mechanism is used to extract the dynamic features of the topology network, reflecting the time evolution of the autonomous domain topology structure at different historical snapshots, and more comprehensively representing the characteristics of the topology structure.

[0043] Record The matrix composed of the autonomous domain topology feature vectors of node v at any time represents the time changes of the graph structure at multiple time steps, and learns the correlation between various representations of nodes at different time steps through the time self-attention layer.

[0044] The time attention value is calculated according to formula (7).

[0045]

[0046] Where D is the dimension of the node feature vector at each time, M ij The element value in the mask matrix is as formula (8), M ij So that any time can only pay attention to the time before it, and cannot pay attention to the time after it.

[0047]

[0048] The normalized time attention value is obtained by using the softmax function according to formula (9).

[0049]

[0050] The multi-head attention mechanism is used to aggregate the features of all times to obtain the autonomous domain topology network dynamic feature vector t.

[0051] Step 3, fuse the autonomous domain semantic feature and the topology network dynamic feature to obtain the final feature vector.

[0052] Step 3.1, calculate the semantic feature vector c i of the autonomous domain i according to formula (10). j And the correlation of each autonomous domain topology network dynamic feature vector t

[0053]

[0054] The correlation vectors c' and t' are calculated according to formulas (11) and (12).

[0055]

[0056]

[0057] Step 3.2, in order to mine the correlation between semantic features and topological network dynamic features, the c and c', t and t' vectors are spliced, the features are compressed through a max-pooling layer, and a semantic feature vector of the fusion correlation is obtained and a topological network dynamic feature vector will be spliced and to obtain an autonomous domain feature vector s.

[0058] Step 3.3, the autonomous domain feature vector s is subjected to a linear classifier to realize autonomous domain type mapping.

[0059] Test results: 2000 autonomous domains were randomly selected for this test, of which 1600 were used as a training set and 400 were used as a test set. The accuracy of the model is: 100% for large Internet service providers, 100% for network information centers, 95.5% for Internet exchange centers, 93.2% for Internet data centers, 90.5% for content distribution network service providers, 86.4% for small Internet service providers, 85.2% for colleges and universities, and 87.3% for other organizations. For small-scale autonomous domain type mapping such as small Internet service providers, colleges and universities, and organizations, the model has good effect.

[0060] The above specific description further details the purpose, technical solutions and beneficial effects of the application. It should be understood that the above description is only a specific embodiment of the application and is not intended to limit the protection scope of the application. Any modification, equivalent replacement, improvement, etc. within the spirit and principles of the application should be included in the protection scope of the application.

Claims

1. A method for mapping Internet autonomous system types based on the dynamic characteristics of associated topological networks, characterized in that... The method includes the following steps: Step 1: First, obtain autonomous system registration information from the WHOIS database, and then use BERT to extract semantic feature vectors of the registration authority and description information in the registration information; Step 2: Obtain the dynamic feature vector of the autonomous system topology network by combining specific autonomous system attributes and the similarity between autonomous systems. First, use the autonomous system attribute information quantification index to calculate the semantic relationship between autonomous systems and obtain the autonomous system attribute similarity matrix. Then, combine the specific autonomous system attributes and the similarity between autonomous systems to generate the autonomous system topology network. Finally, use the time attention mechanism to obtain the dynamic feature vector of the autonomous system topology network. Step 3: Calculate the correlation between the semantic feature vector and the dynamic topological feature vector to obtain the correlation vector. Then, concatenate the correlation vector with the semantic features and the dynamic topological features, and perform feature compression through a max pooling layer to obtain the fused feature vector. Input the fused feature vector into a linear classifier to achieve autonomous system type mapping.

2. The Internet Autonomous System Type Mapping Method for Dynamic Characteristics of Associated Topology Networks according to claim 1, characterized in that: Step 2 uses the autonomous domain attribute information quantification index to calculate the semantic relationships between autonomous domains, given an autonomous domain network G = (V, E, R). k ), R k It is a vector of quantitative indicators for the attribute information of autonomous systems, where V is the set of autonomous system nodes in the autonomous system network, E is the set of connections between autonomous systems, and R∈R m×l This is a matrix of quantified indexes for autonomous system attributes, where m represents the total number of autonomous systems and l represents the number of attribute indicators for each autonomous system. The similarity value is obtained by calculating the dot product of the quantified index vectors of two autonomous system attributes. The similarity matrix P∈R is obtained by calculating the similarity between the attribute information of all autonomous systems. m×m P ij =1 indicates the dot product result sim i,j If the value is greater than the set threshold Ф, the attribute information of autonomous region i and autonomous region j is similar; otherwise, P... ij =0, where i and j represent two different autonomous regions belonging to the entire autonomous region.

Images