A network topology model construction method based on IP address multi-dimensional feature clustering

Abstract

The application discloses a network topology model construction method based on IP address multi-dimensional feature clustering, which comprises the following steps: detecting IP address sets of a target network from a given detection source set, obtaining IP path data and processing to obtain an IP level topology graph; calculating prefix distance, link hop count and link delay for any link in the IP level topology graph; clustering IP nodes in the IP level topology graph according to link distance to form IP node clusters which do not intersect with each other; aggregating IP nodes belonging to the same cluster in the IP node cluster to form network prefix nodes and constructing an initial prefix level topology; and correcting prefix nodes with a containing relationship in the prefix level topology to obtain a prefix level topology in which all nodes satisfy mutual exclusivity. The application starts from an IP level topology, analyzes attribute features and connection relationships of IP addresses from multiple dimensions, and generates a network topology model which can more accurately capture network topology structure features.

Description

Technical Field

[0001] This invention relates to the field of cyberspace mapping technology, and in particular to a method for constructing a network topology model based on multidimensional feature clustering of IP addresses. Background Technology

[0002] A comprehensive and in-depth understanding of the structural characteristics and dynamic evolution trends of network topology is helpful for optimizing network protocols, developing new network applications, ensuring network performance, and identifying vulnerable areas. However, since its inception, the Internet has possessed distributed and autonomous characteristics, and has now developed into a complex mega-system with an extremely large scale, distinct hierarchical structure, complex and diverse local structures, constantly changing routing states, and a lack of centralized control mechanisms. Therefore, even today, the detection, reconstruction, and analysis of network topology remain a hot topic of interest.

[0003] Arranged in order of increasing node granularity in network topology models, the mainstream topology description models currently include four levels: Autonomous System (AS) level, Point of Presence (PoP) level, Router level, and IP level. These models depict network topology at different granularities, resulting in network topology maps with varying "resolutions," each with its own advantages and disadvantages.

[0004] (1) In an AS-level topology, each node corresponds to an autonomous system, and each link corresponds to the business service relationship between autonomous systems. A large autonomous system may contain millions of IP addresses, covering multiple countries or regions around the world. Therefore, this model describes the network topology at a very coarse granularity at a macro level. However, because the granularity of the nodes is too coarse, the "resolution" of the AS-level network topology is extremely low, and a large amount of effective information is hidden inside the AS nodes and fails to be represented in the topology model.

[0005] (2) In a PoP-level topology, each node corresponds to an access point of an operator in a certain city, and each link corresponds to the connection relationship between access points. An access point is usually formed by multiple routing and switching devices tightly connected in a fixed pattern. Therefore, this model focuses on the connection relationship between the operator's Internet access points, emphasizing the topological structure of the Internet infrastructure, and does not focus on the logical structure of the entire network space.

[0006] (3) In router-level topology, each node corresponds to a router or terminal device, while in IP-level topology, each node is an IP address, and the links correspond to the communication links between devices and between IP interfaces, respectively. Therefore, these two models describe the network topology at a very fine granular level. However, due to the enormous number of devices and IPs in the Internet, high-value network topology features are scattered and difficult to extract.

[0007] In real-world networks, the structural characteristics of different regions vary significantly. The four characterization models mentioned above, which generate network topologies with their fixed node granularity, fail to adequately reveal the characteristics of different network regions. To address this, the paper "Topology Modeling via Cluster Graphs" first proposed finding an appropriate granularity between ASs and routers to characterize network topologies from a logical structural perspective. This paper proposes obtaining IP-level topologies through traceroute measurement, then using network prefixes appearing in BGP routing data as the clustering standard for IP addresses. IP addresses in the IP-level topology are aggregated into coarser-grained network prefixes according to the longest matching principle, thus obtaining the so-called "prefix-level topology." In the prefix-level topology, each node is a CIDR network prefix in the form of "192.168.1.0 / 24," with the prefix size determined by the BGP data. Therefore, the "resolution" of each node is more flexible, mitigating some of the shortcomings of traditional models. However, this method relies entirely on BGP routing data for IP address clustering results, which has the following drawbacks.

[0008] First, the size of the clustered network prefix is ​​highly dependent on the location of BGP data collection: (1) Improper collection location may cause the network prefix to be too large due to multiple route aggregations, or too small due to no route aggregation; (2) Insufficient collection points may cause BGP data to not fully cover routable IPv4 addresses, resulting in some IPs not being clustered into the corresponding prefix.

[0009] Secondly, in the prefix-level topology obtained after clustering, multiple inclusion relationships may still exist between prefix nodes, meaning that the prefixes do not satisfy mutual exclusion, which brings difficulties to the subsequent topological structure feature analysis. For example, 203.0.0.0 / 10 and 203.0.0.0 / 12 can both appear as nodes in the prefix-level topology, but the latter is a subset of the former and does not satisfy mutual exclusion. Summary of the Invention

[0010] To address the aforementioned issues, this invention proposes a network topology model construction method based on multi-dimensional feature clustering of IP addresses. Starting from IP-level topology, it analyzes the attribute characteristics and connectivity relationships of IP addresses from multiple dimensions to generate a network topology model that more accurately captures the structural features of the network topology. Furthermore, this invention generates a prefix-level network topology solely based on the features of IP path measurement data, eliminating the reliance of existing methods on prior knowledge such as BGP data. Simultaneously, it ensures the mutual exclusivity of nodes in the generated prefix-level topology through techniques such as inclusion relationship correction, thus possessing greater value for topology feature analysis and utilization.

[0011] The technical solution adopted in this invention is as follows:

[0012] A method for constructing a network topology model based on multidimensional feature clustering of IP addresses includes the following steps:

[0013] S1. Probe the IP address set of the target network from the given set of probe sources, obtain IP path data, and process it to obtain an IP-level topology map;

[0014] S2. For any link in the IP-level topology graph, calculate the prefix distance between the IP addresses at both ends of the link based on the binary representation of the IP address, calculate the link hop count based on the hop distance between the IP addresses at both ends of the link in all probe paths, and calculate the link latency based on the round-trip latency of the IP addresses at both ends of the link relative to each probe source.

[0015] S3. Using the prefix distance, link hop count, and link delay as feature vectors reflecting link distance, cluster the IP nodes in the IP-level topology graph according to the link distance to form non-overlapping IP node clusters;

[0016] S4. Aggregate IP nodes belonging to the same cluster in the IP node cluster to form network prefix nodes and construct an initial prefix-level topology;

[0017] S5. Correct the prefix nodes in the prefix-level topology that have an inclusion relationship to obtain a prefix-level topology in which all nodes satisfy mutual exclusion, thus forming the final network topology model.

[0018] Furthermore, in step S1, for the set of detection sources S = {s1, s2, ..., s...} I The set of IP addresses of the target network D = {d1, d2, ..., d} J}, assign all detected IP paths to P = {p1, p2, ..., p K Let p = (s, r1, r2, ..., r3) denote the IP path from the probe source s∈S to the probe target d∈D. n ,d), where r1,r2,…,r n All are IP addresses or anonymous nodes traversed by path p. Anonymous nodes appear as "*" in the probe results. For each non-anonymous node r in path p other than the probe source s, the probe results also include the round-trip time (RTT) from the probe source s to r. After obtaining all IP paths P, the IP-level topology graph is obtained and represented by a graph model.

[0019] Further, step S1 includes the following sub-steps:

[0020] S101. All non-anonymous nodes in the path constitute a node set V, identified by the node's IP address;

[0021] S102. If node u and node v in the node set V both appear on a certain path, and there are no other non-anonymous nodes between node u and node v, then establish an edge between node u and node v, denoted by (u,v)∈E. The edge in E is also called an IP link.

[0022] Further, in step S2, calculating the prefix distance between the IP addresses at both ends of the link based on the binary representation of the IP address includes the following sub-steps:

[0023] S211. For any link (u,v)∈E in the IP-level topology diagram, convert the IP addresses u and v into 32-bit binary numbers;

[0024] S212. Compare each bit of the binary number in order from most significant bit to least significant bit (i.e., from left to right). If the first different bit is located at the d-th bit from the right, then the prefix distance d between u and v is... f (u,v)=d.

[0025] Further, in step S2, the calculation of the link hop count based on the hop distance of the IP addresses at both ends of the link across all probe paths includes the following sub-steps:

[0026] S221. For any link (u,v)∈E in the IP-level topology graph, let P(u,v)∈P represent the set of paths passing through link (u,v). For p∈P(u,v), respectively use... and Indicates the index of u and v in p;

[0027] S222. Calculation and The absolute value of the difference That is, the hop distance between u and v in p;

[0028] S223. For all paths P(u,v) that pass through (u,v), calculate the minimum number of hops for u and v among all such paths:

[0029]

[0030] Further, in step S2, the calculation of link delay based on the IP addresses at both ends of the link relative to the round-trip delay of each probe source includes the following sub-steps:

[0031] S231. For any link (u,v)∈E in the IP-level topology graph, let P(u,v)∈P represent the set of paths passing through link (u,v), and let... This represents the subset of paths in the path set whose source node is s; for p∈P(u,v|s), respectively, using and This represents the round-trip time from the source node s of p to u and v;

[0032] S232. Calculate the average round-trip delay from source node s to u and v respectively:

[0033]

[0034]

[0035] Where #P(u,v|s) represents the number of paths contained in the path subset P(u,v|s);

[0036] S233. Calculate the link (u,v) delay based on measurements from source node s:

[0037]

[0038] in, and These represent the average round-trip delays from source node s to u and v, respectively.

[0039] S234. Calculate the link (u,v) delay based on measurements from all probe sources S:

[0040]

[0041] Where #S represents the total number of detection sources.

[0042] Furthermore, step S3 includes the following sub-steps:

[0043] S301. For any link e = (u, v) ∈ E in the graph model G = (V, E), use vector d e =d(u,v)=d f (u,v),d h (u,v),d t [u,v)] represents the link distance vector, where d f (u,v) represents the prefix distance, d h (u,v) represents the link hop count, d t (u,v) represents the link delay;

[0044] S302. Vector d is calculated according to the following formula. e The link distance d is obtained by weighting the three components in the equation. e :

[0045]

[0046] Among them, w f +w h +w t=1, the link distance d of link e = (u,v) e It reflects the similarity between nodes u and v at both ends of the link; the smaller the distance, the greater the similarity.

[0047] S303. A weighted community discovery method is used, based on the link distance d of each link. e Clustering the nodes in the graph model G yields multiple non-overlapping IP node clusters.

[0048] Further, step S4 includes the following sub-steps:

[0049] S401. Using set C = {c1, c2, ..., c...} k} represents any cluster of IP nodes, from which any IP is selected and its relationship with all other IP nodes c in C is calculated. i Let the maximum value of all k-1 prefix distances be δ, where i = 2, 3, ..., k;

[0050] S402. Let m = 32 - δ, where m is the mask of the smallest network prefix containing all IP addresses in C. Keep the leftmost m bits of the binary form of c1 unchanged, set the remaining δ bits on the right to 0, convert it to decimal form, and use m as the subnet mask to form the CIDR prefix.

[0051] S403. After constructing the CIDR prefix, if there are two groups of IP nodes belonging to different prefixes and there is an IP link between them, then create an edge between the prefix nodes corresponding to these two groups of IP nodes, thereby constructing a prefix-level topology with prefixes as nodes and the created edge as a link.

[0052] Furthermore, in step S5, if two prefix nodes f1 and f2 have an inclusion relationship and f1 contains f2, then f2 must be a proper subset of f1. Therefore, f2 is merged into f1, and the edges originally associated with f2 are also associated with f1. This step is repeated until all nodes in the prefix-level topology are no longer mutually inclusive.

[0053] Furthermore, in step S1, the IP address set of the target network is probed from the given set of probe sources using the Traceroute routing tool.

[0054] The beneficial effects of this invention are as follows:

[0055] (1) Compared with existing topology characterization models, this invention makes full use of the structural features of IP-level topology to automatically generate prefix-level topology. The size of the prefix node is fully adaptive, thus it can better characterize the structural features of different regions in the network.

[0056] (2) Compared with existing prefix-level topology construction methods, this invention does not rely on prior knowledge such as BGP routing data in the process of constructing prefix-level topology;

[0057] (3) By modifying the inclusion relationship between prefix nodes, this invention makes the nodes in the final prefix-level topology non-intersecting, which is beneficial to the subsequent structural feature analysis. Attached Figure Description

[0058] Figure 1 This is a schematic diagram of the overall process of a network topology model construction method based on multidimensional feature clustering of IP addresses proposed in this invention.

[0059] Figure 2 This is a schematic diagram of IP path data obtained in an embodiment of the present invention.

[0060] Figure 3 This is a schematic diagram of the IP-level topology constructed according to an embodiment of the present invention.

[0061] Figure 4 This refers to the IP node clusters and corresponding network prefixes obtained after clustering IP nodes in an embodiment of the present invention.

[0062] Figure 5 This is a schematic diagram of the prefix-level topology constructed according to an embodiment of the present invention. Detailed Implementation

[0063] To provide a clearer understanding of the technical features, objectives, and effects of the present invention, specific embodiments are now described. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention; that is, the described embodiments are only a part of the embodiments of the invention, not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0064] Example 1

[0065] This embodiment provides a method for constructing a network topology model based on multi-dimensional feature clustering of IP addresses, such as Figure 1 As shown, it includes the following steps:

[0066] S1. Probe the IP address set of the target network from the given set of probe sources, obtain IP path data, and process it to obtain an IP-level topology map;

[0067] S2. For any link in the IP-level topology graph, calculate the prefix distance between the IP addresses at both ends of the link based on the binary representation of the IP address, calculate the link hop count based on the hop distance of the IP addresses at both ends of the link in all probe paths, and calculate the link latency based on the round-trip latency of the IP addresses at both ends of the link relative to each probe source.

[0068] S3. Using prefix distance, link hop count, and link delay as feature vectors reflecting link distance, cluster IP nodes in the IP-level topology graph according to link distance to form disjoint IP node clusters;

[0069] S4. Aggregate IP nodes belonging to the same cluster within the IP node cluster to form network prefix nodes and construct the initial prefix-level topology;

[0070] S5. Correct the prefix nodes that have inclusion relationships in the prefix-level topology to obtain a prefix-level topology in which all nodes satisfy mutual exclusion, thus forming the final network topology model.

[0071] In step S1, for the set of detection sources S = {s1, s2, ..., s} I The set of IP addresses of the target network D = {d1, d2, ..., d} J}, assign all detected IP paths to P = {p1, p2, ..., p K Let p = (s, r1, r2, ..., r3) denote the IP path from the probe source s∈S to the probe target d∈D. n ,d), where r1, r2, ..., r n All IP paths p are either IP addresses or anonymous nodes traversed by the path p. Anonymous nodes appear as "*" in the probe results. For each non-anonymous node r in path p, excluding the probe source s, the probe results also include the round-trip time (RTT) from the probe source s to r. After obtaining all IP paths p, the IP-level topology graph is obtained, represented by the graph model G = (V, E). Step S1 specifically includes the following sub-steps:

[0072] S101. All non-anonymous nodes in the path constitute a node set V, identified by the node's IP address;

[0073] S102. If node u and node v in node set V both appear on a certain path, and there are no other non-anonymous nodes between node u and node v, then establish an edge between node u and node v, denoted by (u, v) ∈ E. The edge in E is also called an IP link.

[0074] Preferably, the set of IP addresses of the target network can be probed from a given set of probe sources using the Traceroute routing tool.

[0075] In step S2, the method for calculating the prefix distance includes the following sub-steps:

[0076] S211. For any link (u, v) ∈ E in the IP-level topology graph, convert the IP addresses u and v into 32-bit binary numbers;

[0077] S212. Compare each bit of the binary number from most significant bit to least significant bit (from left to right). If the first different bit is located at the d-th bit from the right (counting from 1), then the prefix distance d between u and v is... f (u, v) = d.

[0078] The prefix distance between IP addresses reflects the minimum size of the prefix required to include two IP addresses within the same network prefix. For example, 10.0.0.1 and 10.0.1.1, converted to binary, are: 0000101000000000 0000000 0 00000001 and 00001010 0000000 0000000 1 00000001, compared from left to right, the first different bit is the 9th bit from the right, so the prefix distance between 10.0.0.1 and 10.0.1.1 is 9, and the smallest network prefix that can contain them is 10.0.0.0 / 23.

[0079] In step S2, the method for calculating the link hop count includes the following sub-steps:

[0080] S221. For any link (u,v)∈E in the IP-level topology graph, let P(u,v)∈P represent the set of paths passing through link (u,v). For p∈P(u,v), use... and Indicates the index of u and v in p;

[0081] S222. Calculation and The absolute value of the difference That is, the jump distance between u and v in o;

[0082] S223. For all paths P(u,v) that pass through (u,v), calculate the minimum number of hops for u and v among all such paths:

[0083]

[0084] In step S2, the method for calculating link delay includes the following sub-steps:

[0085] S231. For any link (u,v)∈E in an IP-level topology graph, let P(u,v)∈P represent the set of paths passing through link (u,v), and let... This represents the subset of paths in the path set whose source node is s; for p∈P(u,v|s), respectively, using and This represents the round-trip time from the source node s of p to u and v;

[0086] S232. Calculate the average round-trip delay from source node s to u and v respectively:

[0087]

[0088]

[0089] Where #P(u,v|s) represents the number of paths contained in the path subset P(u,v|s);

[0090] S233. Calculate the link (u,v) delay based on measurements from source node s:

[0091]

[0092] in, and These represent the average round-trip delays from source node s to u and v, respectively.

[0093] S234. Calculate the link (u, v) delay based on measurements from all probe sources S:

[0094]

[0095] Where #S represents the total number of detection sources.

[0096] It should be noted that the round-trip delay from source node s to u and v is essentially two random variables, and the distribution is reflected by multiple measurements obtained from multiple probe paths. Although the above steps calculate the link delay based on the average of the measurement results from multiple probe paths, any calculation method used to measure the distance between the two distributions can be applied to this scheme without any innovative modifications.

[0097] Preferably, step S3 includes the following sub-steps:

[0098] S301. For any link e = (u, v) ∈ E in the graph model G = (V, E), use vector d e =d(u,v)=[d f (u, v), d h (u, v), d t [(u, v)] represents the link distance vector, where d f(u, v) is the prefix distance, d h (u, v) represents the link hop count, d t (u, v) represents the link delay;

[0099] S302. Vector d is calculated according to the following formula. e The link distance d is obtained by weighting the three components in the equation. e :

[0100]

[0101] Among them, w f +w h +w t =1, the link distance d of link e = (u, v) e It reflects the similarity between nodes u and v at both ends of the link; the smaller the distance, the greater the similarity.

[0102] S303. A weighted community discovery method is used, based on the link distance d of each link. e Clustering the nodes in the graph model G yields multiple disjoint IP node clusters. Any weighted community discovery method can be used, such as the Leuven algorithm, ensuring that the different IP node clusters are mutually exclusive.

[0103] Preferably, step S4 includes the following sub-steps:

[0104] S401. Using set C = {c1, c2, ..., c...} k} represents any cluster of IP nodes, from which any IP is selected and its relationship with all other IP nodes c in C is calculated. i Let the maximum value of all k-1 prefix distances be δ, where i = 2, 3, ..., k;

[0105] S402. Let m = 32 - δ, where m is the mask of the smallest network prefix containing all IP addresses in C. Keep the leftmost m bits of the binary form of c1 unchanged, set the remaining δ bits on the right to 0, convert it to decimal form, and use m as the subnet mask to form the CIDR prefix.

[0106] S403. After constructing the CIDR prefix, if there are two groups of IP nodes belonging to different prefixes and there is an IP link between them, then create an edge between the prefix nodes corresponding to these two groups of IP nodes, thereby constructing a prefix-level topology with prefixes as nodes and the created edge as a link.

[0107] Preferably, in step S5, if two prefix nodes f1 and f2 have an inclusion relationship and f1 contains f2, then f2 must be a proper subset of f1. F2 is merged into f1, and the edges originally associated with f2 are also associated with f1. This step is repeated until all nodes in the prefix-level topology are no longer mutually inclusive.

[0108] Example 2

[0109] This embodiment is based on embodiment 1:

[0110] This embodiment provides a method for constructing a network topology model based on multidimensional feature clustering of IP addresses, including the following steps:

[0111] Step (1) involves probing and obtaining IP path data, extracting IP nodes and links, and generating an IP-level topology map, such as... Figure 2 and Figure 3 As shown, this step specifically includes:

[0112] Step (1.1) Obtain the IP address set D = {d1, d2, ..., dn} of the target network. J}, in the detection source S = {s1, s2, ..., s I Using the traceroute tool independently, path probing is performed on each IP address in D as the target, obtaining IP path data P = {p1, p2, ..., p...} K}

[0113] In this embodiment, the target IP address set D contains 3 IPs and the probe source S contains 1 IP, namely D = {61.231.64.74, 122.117.229.75, 210.66.86.109} and S = {165.230.49.113}.

[0114] In this embodiment, the path set obtained after IP path probing contains 3 IP paths, specifically as follows: Figure 2 As shown. Hops 9 and 10 of path 1 and 12 of path 3 are anonymous nodes, indicated by *. The round-trip time of each hop node relative to the probe source under each path is in microseconds (µs), located to the right of the corresponding IP address.

[0115] Step (1.2) converts the IP path data into an IP-level topology graph G = (V, E), where the nodes of the graph are the IP addresses that appear on each path, and the edges of the graph connect adjacent IPs that appear on the path.

[0116] In this embodiment, the IP-level topology diagram constructed from 3 IP paths is as follows: Figure 3As shown. Taking the non-anonymous node 172.28.1.33 as an example, it appears in the IP path, so it is treated as a node of G. Other non-anonymous nodes are treated similarly. Taking the node pairs (172.28.1.33, 172.29.18.10) and (157.130.245.42, 220.128.7.118) in path 1 as an example: 172.28.1.33 and 172.29.18.10 appear consecutively, and there are obviously no anonymous nodes between them. Therefore, (172.28.1.33, 172.29.18.10) appears as an edge of G; although 157.130.245.42 and 220.128.7.118 do not appear consecutively, there are no other non-anonymous nodes between them. Therefore, (157.130.245.42, 220.128.7.118) also appears as an edge of G.

[0117] Step (2): For each edge in the graph obtained in step (1), calculate the prefix distance between the two IPs of all edges, as well as the hop count and latency of the link, and assign a weighted distance to each link in the IP-level topology graph.

[0118] In this embodiment, taking the edge (172.28.1.33, 172.29.18.10) as an example, the IP addresses at both ends, after being converted to binary numbers, are 10101100.0001110 respectively. 0 .00000001.00100001 and 10101100.0001110 1 .00010010.00001010, the first distinct bit is located at the 17th bit from the right, so its prefix distance is 17.

[0119] In this embodiment, since there are anonymous nodes in paths 1 and 3, the link hop counts of the edge (157.130.245.42, 220.128.7.118) obtained by parsing path 1 and the edge (139.175.56.142, 139.175.56.201) obtained by parsing path 3 are 3 and 2 respectively, and the link hop count of all other edges is 1.

[0120] In this embodiment, taking (172.28.1.33, 172.29.18.14) as an example, this link appears in both path 2 and path 3. The round-trip time (RTT) of IPs 172.28.1.33 and 172.29.18.14 relative to the probe source in path 2 and path 3 are 197, 2109 and 126, 1588 (in µs), respectively. Therefore, the average delay corresponding to the link (172.28.1.33, 172.29.18.14) is [(2109-197)+(1588-126)] / 2=1687µs, or 1.687ms.

[0121] Step (3): Based on the link path, the IP nodes are clustered using the weighted community discovery method to obtain IP node clusters.

[0122] In this embodiment, after clustering all IP nodes using a clustering algorithm, 12 IP node clusters are obtained. The source IP and the three target IPs each form their own node cluster, while the IPs appearing as relay nodes are distributed across eight different node clusters, as detailed below. Figure 4 As shown. It should be noted that although the IPs contained in the first node cluster are all private IPs located between 172.16.0.0 and 172.31.255.255, this does not affect the effectiveness of the method proposed in this invention.

[0123] Step (4) aggregates the IP node clusters into prefix nodes, merges prefix nodes that have an inclusion relationship, and generates a prefix-level topology.

[0124] In this embodiment, the generated prefix-level topology is as follows: Figure 5 As shown in the diagram, taking node cluster 1 as an example, it contains 9 IP addresses, with the smallest corresponding network prefix being 172.28.0.0 / 19. Therefore, in the generated prefix-level topology, 172.28.0.0 / 19 is one of the nodes.

[0125] In this embodiment, it is important to note that while node cluster 3 contains only one IP address (63.65.75.237), as its relay node IP, it is paired with at least one other IP address in the network to form a 31-bit subnet. Therefore, the minimum network prefix corresponding to node cluster 3 is 63.65.75.236 / 31, not 63.65.75.237 / 32. Node cluster 7 follows a similar pattern.

[0126] In this embodiment, the network prefixes generated directly based on the clustering results do not contain any other prefixes, so there is no need to merge prefix nodes that have an inclusion relationship.

[0127] It should be noted that, for the sake of simplicity, the foregoing method embodiments are described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

Claims

1. A method for constructing a network topology model based on multidimensional feature clustering of IP addresses, characterized in that, Includes the following steps: S1. Probe the IP address set of the target network from the given set of probe sources, obtain IP path data, and process it to obtain an IP-level topology map; S2. For any link in the IP-level topology graph, calculate the prefix distance between the IP addresses at both ends of the link based on the binary representation of the IP address, calculate the link hop count based on the hop distance between the IP addresses at both ends of the link in all probe paths, and calculate the link latency based on the round-trip latency of the IP addresses at both ends of the link relative to each probe source. S3. Using the prefix distance, link hop count, and link delay as feature vectors reflecting link distance, cluster the IP nodes in the IP-level topology graph according to the link distance to form non-overlapping IP node clusters; S4. Aggregate IP nodes belonging to the same cluster in the IP node cluster to form network prefix nodes and construct an initial prefix-level topology; S5. Correct the prefix nodes in the prefix-level topology that have an inclusion relationship to obtain a prefix-level topology in which all nodes satisfy mutual exclusion, thus forming the final network topology model; Step S4 includes the following sub-steps: S401. Using sets Given any cluster of IP nodes, select any IP from it and calculate its relationship with... All other IP nodes Prefix distance between them, record all The maximum value of the prefix distance is ,in ; S402. Note , That is, to include The mask of the smallest network prefix for all IP addresses in the network will From left to right in binary form The position remains unchanged, and the remaining position on the right is... All bits are set to 0, converted to decimal form and represented as follows As a subnet mask, it forms the CIDR prefix; S403. After constructing the CIDR prefix, if there are two groups of IP nodes belonging to different prefixes and there is an IP link between them, then create an edge between the prefix nodes corresponding to these two groups of IP nodes, thereby constructing a prefix-level topology with prefixes as nodes and the created edge as a link.

2. The network topology model construction method based on IP address multidimensional feature clustering according to claim 1, characterized in that, In step S1, for the set of detection sources and the set of IP addresses of the target network Use all detected IP paths It indicates that the detection source To detect the target The IP path is denoted as ,in All are paths The IP addresses or anonymous nodes that were passed through, and the anonymous nodes were represented in the probe results as " "Appears; for path" Except for the detection source Each non-anonymous node outside The detection results also include information from the detection source. arrive Round-trip time (RTT); obtain all IP paths After processing, an IP-level topology graph is obtained, which is represented by a graph model.

3. The network topology model construction method based on IP address multidimensional feature clustering according to claim 2, characterized in that, Step S1 includes the following sub-steps: S101. All non-anonymous nodes in the path constitute a node set. The node's IP address is used as the identifier; S102. If the node set Nodes in and nodes Both appear on a certain path, and the nodes and nodes If there are no other non-anonymous nodes in between, then in the node and nodes Establish an edge between them, using express, The edges in the IP are also called IP links.

4. The method for constructing a network topology model based on multi-dimensional feature clustering of IP addresses according to claim 1, characterized in that, In step S2, calculating the prefix distance between the IP addresses at both ends of the link based on the binary representation of the IP address includes the following sub-steps: S211. For any link in the IP-level topology diagram IP address and Convert to a 32-bit binary number; S212. Compare each bit of the binary number in order from most significant bit to least significant bit (i.e., from left to right). If the first distinct bit is located at the rightmost bit, then... Position, then and Prefix distance between .

5. The method for constructing a network topology model based on multidimensional feature clustering of IP addresses according to claim 1, characterized in that, In step S2, the calculation of the link hop count based on the hop distance of the IP addresses at both ends of the link across all probe paths includes the following sub-steps: S221. For any link in the IP-level topology diagram ,use Indicates passing through the link The set of paths, for , respectively and express and exist The serial number appearing in the text; S222. Calculation and That is and exist The number of jumps in the distance; S223. For all those who have passed through path ,calculate and Minimum number of hops across all paths: 。 6. The method for constructing a network topology model based on multidimensional feature clustering of IP addresses according to claim 1, characterized in that, In step S2, calculating the link delay based on the IP addresses at both ends of the link relative to the round-trip delay of each probe source includes the following sub-steps: S231. For any link in the IP-level topology diagram ,use Indicates passing through the link The set of paths, using This indicates that the source node in this path set is A subset of paths; for , respectively and express source node arrive and Round-trip delay; S232. Calculate the source node separately. arrive and Average round-trip time: in, Represents a subset of paths The number of paths included; S233. Computation based on source node Measured link Delay: in, and Representing the source node respectively arrive and The average round-trip time delay; S234. Calculation based on all detection sources Measured link Delay: in, It represents the total number of detection sources.

7. The method for constructing a network topology model based on multidimensional feature clustering of IP addresses according to claim 1, characterized in that, Step S3 includes the following sub-steps: S301. For graphical models any link in Using vectors Represents the link distance vector, where Prefix distance, This represents the link hop count. For link latency; S302. The vector is converted according to the following formula. The link distance is obtained by weighting the three components in the equation. : in, ,link Link distance Reflects the nodes at both ends of the link and The smaller the distance, the greater the similarity. S303. A weighted community discovery method is used, based on the link distance of each link. For graphical models The nodes in the cluster are clustered to obtain multiple non-overlapping IP node clusters.

8. The method for constructing a network topology model based on multidimensional feature clustering of IP addresses according to claim 1, characterized in that, In step S5, if two prefix nodes There is an inclusion relationship and Include ,but It must be proper subsets of, merge into In the middle, originally with The associated edges are also associated with Repeat this step until all nodes in the prefix-level topology are no longer mutually exclusive.

9. The method for constructing a network topology model based on multidimensional feature clustering of IP addresses according to any one of claims 1-8, characterized in that, In step S1, the IP address set of the target network is probed from the given set of probe sources using the Traceroute routing tool.

Images