Threat construction method and device for BGP network, electronic equipment and storage medium

Abstract

This invention provides a threat construction method, apparatus, electronic device, and storage medium for BGP networks. It identifies a target link and detects multiple potentially available paths threatening that target link. A bidirectional available path pool is constructed based on these paths. Threat path groups for generating threat strategies are selected from the bidirectional available path pool based on the threat direction. The contribution of each threat path in the threat path group is coordinated to determine the microservice request content of each threat path to threaten the target link. By constructing the required threats, researchers can be provided with effective research evidence, effectively verifying the security mechanisms of BGP networks and promoting the further development of BGP network security.

Description

Technical Field

[0001] This invention relates to the field of cyberspace security technology, and in particular to a threat construction method, apparatus, electronic device, and storage medium for BGP networks. Background Technology

[0002] BGP (Border Gateway Protocol) networks are a crucial component of the Internet, providing fundamental and critical connectivity functions, ensuring data transmission between different autonomous systems, and are an important part of achieving global interconnection. The widespread application of BGP has also promoted global business and social communication, making an indispensable contribution to the development and progress of modern society. At the same time, the various security mechanisms in BGP networks are also a key guarantee of Internet security; however, facing unknown threats in BGP networks, existing security mechanisms appear powerless. Due to the lack of threat reference samples, testing of security mechanisms cannot be comprehensive, and the effectiveness of BGP network security mechanisms cannot be verified and improved. Summary of the Invention

[0003] This invention provides a threat construction method, apparatus, electronic device, and storage medium for BGP networks, which addresses the deficiency that the effectiveness of BGP network security mechanisms cannot be verified and improved due to the lack of threat reference samples.

[0004] This invention provides a threat construction method for BGP networks, comprising:

[0005] Identify the target link and detect multiple potentially available paths that threaten the target link;

[0006] Construct a bidirectional available path pool based on the multiple potentially available paths;

[0007] Threat path groups for generating threat strategies are selected from the bidirectional available path pool based on the threat direction;

[0008] The contribution of each threat path in the threat path group is coordinated to determine the microservice request content of each threat path to threaten the target link based on the contribution of each threat path.

[0009] According to a threat construction method for BGP networks provided by the present invention, the step of detecting multiple potentially available paths threatening the target link includes:

[0010] Extract key information from the network layer in the BGP network, including the network layer topology around the target link;

[0011] Based on the network layer topology around the target link, a breadth-first traversal search is performed starting from both sides of the target link;

[0012] Store and traverse nodes at different depths, and find the node whose role is a border router in the expanded node set;

[0013] Based on the extension relationship corresponding to the border router nodes, a complete transmission path is constructed in reverse, and each complete transmission path is regarded as a potential available path.

[0014] According to a threat construction method for BGP networks provided by the present invention, the step of selecting a group of threat paths for generating threat policies from the bidirectional available path pool based on the threat direction includes:

[0015] Key information of the application layer in the BGP network is extracted. The key information of the application layer includes multiple microservice dependency chains, each of which is determined according to the logical relationship of normal business response.

[0016] Based on the routing and load balancing policies of the current network area, a bidirectional available path through the target link is selected from multiple paths with the same starting point.

[0017] Based on the threat direction, multiple threat paths in the corresponding direction are selected from the bidirectional available path pool to generate a threat path group. The threat paths should be covered by microservice dependency chains with high relevance.

[0018] According to a threat construction method for BGP networks provided by the present invention, coordinating the contribution of each threat path in the threat path group includes:

[0019] The network layer topology around the target link is transformed into a tree structure, with the target link as the root node, and child nodes and leaf nodes of different depths are constructed downwards along the threat path and all available paths.

[0020] The upper limit of the coordinated working traffic for the threat path group is determined based on the bandwidth of the target link;

[0021] The allocated workload is distributed layer by layer from the root node according to the upper limit of the coordinated workload of the threat path group, ensuring that the allocated workload of any node is equal to the sum of the allocated workload of all its child nodes. During the allocation process, the allocated workload of the child node is compared with the remaining bandwidth of the current link, and the minimum value of the two is selected until it is allocated to the leaf nodes of all threat paths, so as to obtain the contribution of each threat path according to the transmission node of each threat path.

[0022] According to a threat construction method for BGP networks provided by the present invention, the step of determining the upper limit of the coordinated working traffic of the threat path group based on the bandwidth of the target link includes:

[0023] The upper limit of the coordinated working traffic of the threat path group = target link bandwidth * expansion factor;

[0024] The expansion coefficient is greater than 1 to offset the transmission loss of the coordinated working flow.

[0025] The threat construction method for BGP networks provided by the present invention further includes:

[0026] Determine the request initiation time of the microservice so that microservice traffic on different threat paths can work together to reach the target link based on the initiation time of the microservice request.

[0027] According to a threat construction method for BGP networks provided by the present invention, the method for determining the request initiation time of the microservice includes:

[0028] Obtain the time of threat occurrence and the latency of one-way interactions in each microservice dependency chain, including the latency of user requests reaching the first node and the transmission latency of nodes in the chain;

[0029] The request initiation time of a microservice is calculated based on the threat occurrence time and the latency of one-way interaction in each microservice dependency chain. The microservice request initiation time = threat occurrence time - latency of user request arriving at the first node - transmission latency of nodes in the chain.

[0030] The present invention also provides a threat construction apparatus for BGP networks, comprising:

[0031] The detection module is used to determine the target link and detect multiple potentially available paths that threaten the target link;

[0032] The construction module is used to construct a bidirectional available path pool based on the multiple potentially available paths;

[0033] The filtering module is used to filter out threat path groups for generating threat strategies from the bidirectional available path pool based on the threat direction;

[0034] The coordination module is used to coordinate the contribution of each threat path in the threat path group, so as to determine the microservice request content of each threat path to implement threats on the target link based on the contribution of each threat path.

[0035] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the threat construction method for BGP networks described above.

[0036] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the threat construction method for BGP networks described in any of the preceding claims.

[0037] The present invention provides a threat construction method, apparatus, electronic device, and storage medium for BGP networks. By identifying a target link, it detects multiple potentially available paths on the target link; constructs a bidirectional available path pool based on these paths; selects a group of threat paths from the bidirectional available path pool to generate threat strategies based on the threat direction; and coordinates the contribution of each threat path in the threat path group to determine the microservice request content of each threat path to threaten the target link. By constructing the required threats, it can provide researchers with effective research evidence, effectively verify the security mechanisms of BGP networks, and promote the further development of BGP network security. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0039] Figure 1 This is one of the flowcharts illustrating the threat construction method for BGP networks provided by this invention;

[0040] Figure 2 This is the second flowchart illustrating the threat construction method for BGP networks provided by this invention;

[0041] Figure 3 This is a schematic diagram illustrating a threat scenario involving malicious organization of microservice traffic, as provided by the present invention.

[0042] Figure 4 This is a schematic diagram of the bidirectional available path pool construction provided by the present invention;

[0043] Figure 5 This is the third flowchart of the threat construction method for BGP networks provided by the present invention;

[0044] Figure 6 This is a schematic diagram illustrating the generation of an implementable threat strategy provided by the present invention;

[0045] Figure 7 This is the fourth flowchart of the threat construction method for BGP networks provided by the present invention;

[0046] Figure 8 This is a schematic diagram of the threat construction device for BGP networks provided by the present invention;

[0047] Figure 9 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0049] Figure 1 A flowchart of a threat construction method for BGP networks provided in an embodiment of the present invention is shown below. Figure 1 As shown, the threat construction method for BGP networks provided in this embodiment of the invention includes:

[0050] Step 101: Identify the target link and detect multiple potentially available paths threatening the target link;

[0051] In this embodiment of the invention, after determining the target area network structure and target link, a breadth-first search is performed from both ends of the target link, and available paths are determined based on node role information and microservice dependency chains.

[0052] Step 102: Construct a bidirectional available path pool based on multiple potentially available paths;

[0053] In this embodiment of the invention, suitable available paths are selected from the identified available paths of the target link based on the routing policies and load balancing mechanisms of the relevant networks. A bidirectional (uplink and downlink) available path pool for the target link is then constructed based on the traffic direction of the available paths. Suitable available paths should be as short as possible, have low propagation delays, and preferably have a high probability of passing through the target link.

[0054] Step 103: Select threat path groups from the bidirectional available path pool based on the threat direction to generate threat strategies;

[0055] In this embodiment of the invention, threat paths for generating threat strategies are selected from a bidirectional available path pool. Using constraints such as topology and microservice resources as input conditions, the coordination workload of the entire set of threat paths is calculated. The calculation of the coordination workload can be further customized according to specific needs to produce the threat effects desired by researchers.

[0056] Step 104: Coordinate the contribution of each threat path in the threat path group to determine the microservice request content of each threat path to implement threats on the target link based on the contribution of each threat path.

[0057] By targeting the target link through the microservice request content of each threat path, it is possible to block specific BGP links and thus affect the network's communication performance, thereby posing a threat to the target link.

[0058] The microservice request content is based on the predictability of microservice traffic, and completes the calculated coordination workload. It generates a set of implementable threat strategies to reproduce the threat of microservice traffic to BGP networks, providing researchers with further analysis and research opportunities.

[0059] Due to the unique generation mechanism of microservice traffic, BGP networks are more vulnerable to impacts. Therefore, research on methods to organize the threats posed by microservice traffic to BGP links can provide more research support for mitigating the impact of microservice traffic on BGP networks, encourage network practitioners and researchers to pay attention to this threat and problem, actively conduct research on relevant protective measures, and further optimize the existing BGP network operation mechanism.

[0060] In existing BGP network research, due to the lack of threat reference samples, the testing of security mechanisms in BGP networks cannot be complete, and the effectiveness of BGP network security mechanisms cannot be verified and improved.

[0061] The threat construction method for BGP networks provided in this invention identifies a target link and detects multiple potentially available paths on that target link. It then constructs a bidirectional available path pool based on these paths. Next, it selects a group of threat paths from the bidirectional available path pool based on the threat direction to generate threat strategies. Finally, it coordinates the contribution of each threat path in the threat path group to determine the microservice request content of each threat path to threaten the target link. By constructing the required threats, this method provides researchers with effective research evidence before newer and more complex potential threats emerge, effectively verifies the security mechanisms of BGP networks, and promotes the further development of BGP network security.

[0062] Based on any of the above embodiments, such as Figure 2As shown, the multiple potentially available paths for detecting threat targets in the above steps specifically include:

[0063] Step 201: Extract key information of the network layer in the BGP network. The key information of the network layer includes the network layer topology around the target link.

[0064] Threat traffic primarily originates from the normal business interactions and responses of microservices. This threat traffic is predictable, and microservices, deployed across the internet, stably support normal application operations. Therefore, the key conditions for constructing threats through coordinated microservice traffic are information about the microservice chain and the main backbone topology information between service nodes in the network layer. Key information at the network layer includes:

[0065] a) Microservice Traffic: Modern large-scale internet applications are increasingly meeting more complex business and logic requirements, thus internet applications are gradually shifting from a fixed, single system design structure to a microservice architecture. For internet applications under a microservice architecture, microservice traffic supports normal business responses. Traffic generated by user business requests is triggered by user behavior. Subsequent microservices, in order to complete the response to this business request, perform a series of complex interactions that follow specific business logic; these subsequent microservice traffic are spontaneously generated. The former is called explicit traffic in microservice traffic, and the subsequent traffic is called implicit traffic, the definition of which depends on whether the microservice traffic is directly triggered by the user. This method organizes and orchestrates implicit traffic in microservice traffic to target specific links, and the business logic interactions followed during microservice traffic transmission are called microservice dependency chains. Figure 3 Taking the microservice traffic shown in the application layer as an example, ① and ④ are explicit traffic, while ②, ③, and ⑤ are implicit traffic, which are triggered by ① and ④ respectively and generated by themselves.

[0066] b) Microservice Dependency Chain: Due to the stability requirements of modern large-scale Internet applications, several microservices typically respond to specific business requests according to a certain logical order and pattern, and the response process is sequential and dependent. Therefore, a microservice dependency chain is defined to describe this logical relationship. Figure 3 Taking the microservice dependency chain as an example, for business 1, the logical relationship of a normal business response can be described as chain1 = {s} A →s C →s D}, where chain1 represents the response business 1, s A This indicates microservice A, and business requests and responses are processed in the order of microservices A, B, and C.

[0067] c) Network Layer Topology: Application layer microservice interactions are supported by the underlying network infrastructure and microservice traffic transmission at the network layer. In modern large-scale Internet applications, closely related microservices may be deployed in different autonomous systems (AS), usually due to development and deployment requirements. This necessitates that BGP inter-domain links carry microservice traffic. To accurately influence and target specific link, this method requires extracting the regional network topology around the target link, including service node devices and boundaries within each AS, as well as key forwarding node devices between ASs. Figure 1 Taking a threat scenario as an example, the network layer topology can be denoted as G = {V, E}, where V = {ser} A ,ser B Let {,...,rot1,rot2,...,brot1,brot2,...} be a set of nodes, and E = {link} tar The set of links is ,link1,...}. The set of nodes V contains ser A This represents the node where microservice A resides, rot1 represents inter-domain forwarding device 1, and brot1 represents border forwarding device 1. The link set E contains links... tar The target link is represented by `link1`, which represents link 1. There is a potential mapping relationship between the network layer topology and the application layer.

[0068] In summary, by extracting key information from the application layer and network layer, the accuracy and completeness of the extracted information can be guaranteed, resulting in a set containing n microservice dependency chains, C = {chain1, ..., chain2}. n The network layer topology G = {V, E} surrounding the target link provides crucial information, laying the groundwork for subsequent threat modeling.

[0069] Step 202: Based on the network layer topology around the target link, perform a breadth-first traversal search starting from both sides of the target link;

[0070] Step 203: Store and traverse the nodes at different depths, and find the node whose role is a border router in the expanded node set;

[0071] Step 204: Construct complete transmission paths in reverse based on the extension relationships corresponding to the border router nodes, and treat each complete transmission path as a potential available path.

[0072] Based on the extracted network layer topology G, from the target link tarA breadth-first search is performed starting from both sides. To achieve this, a key parameter, `extend`, is introduced to extend the search depth. Nodes at different depths are stored and traversed. Nodes acting as border routers are found in the extended node set. Based on the extension relationships, a complete path is constructed in reverse, thus forming a potential usable path. An example of the mining process of this invention is shown below. Figure 4 As shown in the image. Figure 4 (a) link tar =DE. Based on the topology shown in the diagram, when extend = 1, the left extension set of the target link is left_ext = {B, I, F}, and the right extension set is right_ext = {C}. At this time, there is no usable path. When extend = 2, left_ext = {B, I, F, H, A, P, J, G}, and right_ext = {C, K, A}. At this time, the usable path is path. I→K ={I,D,E,C,K},path H→K ={H,B,D,E,C,K},path I→K '={I,B,D,E,C,K},path I→K ={I,F,D,E,C,K} and path J→K ={J,F,D,E,C,K}. This expansion process should continue until the target number of available paths is reached, or until a specified depth is reached.

[0073] The threat construction method provided in this embodiment of the invention can fully adapt to the network topology constraints around the target link, and attack the specific target link without affecting non-target links. It utilizes the predictability of microservice traffic to organize and coordinate traffic generated by different microservices to converge on the specific target link.

[0074] Based on any of the above embodiments, such as Figure 5 As shown, the step above, which involves selecting a group of threat paths from the bidirectional available path pool based on the threat direction, specifically includes:

[0075] Step 501: Extract key information of the application layer in the BGP network. The key information of the application layer includes multiple microservice dependency chains. Each microservice dependency chain is determined according to the logical relationship of normal business response.

[0076] Step 502: Based on the routing policy and load balancing policy of the current network area, select a bidirectional available path through the target link from multiple paths with the same starting point;

[0077] After discovering available paths, a large number of available paths are obtained, denoted as AvailPaths = {path1, path2, ...}. Then, based on the routing and load balancing policies of the current network area, the path with the highest probability of passing through the target link is selected from multiple paths starting from the same point. For example... Figure 4 As shown, there are three available paths, all starting from I→K, but their specific traffic transmission paths are different. Based on the current network area, we have P(link) tar path I→K )P'(link tar path I→K ')≈P""link" tar path I→K If '', then only the path is retained. I→K Choosing high-probability available paths can ensure the effectiveness of threat construction to some extent, but it will significantly reduce the number of available paths after filtering, potentially leading to insufficient manpower and failing to create a significant threat. When the threat effect is not obvious, the filtering of available paths can be adjusted; for example, choosing paths with short transmission latency can achieve a relatively obvious threat effect. Figure 4 As shown, the target link is constructed. tar =DE's downpath pool is DownPathPool={path I→K ,path H→K ,path J→K Similarly, the UpPathPool is constructed.

[0078] Step 503: Select multiple threat paths from the bidirectional available path pool according to the threat direction to generate a threat path group. The threat paths should be covered by the microservice dependency chain with high correlation.

[0079] Based on the established bidirectional available path pool, threat paths are selected as needed. These threat paths should be covered by stable service dependency chains. Modern large-scale internet applications, due to diverse business needs, have certain time- or region-sensitive service dependency chains. For example, microservice support available at specific times or in specific regions may be considered sensitive. When selecting threat paths from the available path pool, those available paths covered by stable microservice dependency chains should be chosen. Figure 6 As shown in (a), two stable microservice dependency chains are obtained, chain1 = {s A →s C →s D} and chain2 = {s B →s DThe corresponding network layer node interaction chains are {I→H→J→K} and {I→H→K}, therefore the threat path selected from the downlink path pool is path. J→K ={J,F,D,E,C,K} and path H→K ={H,B,D,E,C,K}.

[0080] In this embodiment of the invention, a complete pool of available paths is constructed based on routing strategies and load balancing strategies. Uplink and downlink available path pools are defined by the traffic direction on the target link to facilitate subsequent threat path screening.

[0081] Based on any of the above embodiments, such as Figure 7 As shown, the contribution of each threat path in the coordinated threat path group in the above steps specifically includes:

[0082] Step 701: Convert the network layer topology around the target link into a tree structure, with the target link as the root node, and build child nodes and leaf nodes of different depths downward along the threat path and all available paths.

[0083] Step 702: Determine the upper limit of the coordinated working traffic for the threat path group based on the bandwidth of the target link;

[0084] In this embodiment of the invention, determining the upper limit of the coordinated working traffic of the threat path group based on the bandwidth of the target link includes:

[0085] The upper limit of coordinated traffic for threat path groups = target link bandwidth * expansion factor;

[0086] An expansion coefficient greater than 1 is used to offset transmission losses in coordinating working traffic.

[0087] To ensure the effectiveness of the threat construction method, the actual microservice traffic reaching the target link and the calculated coordination workload are slightly reduced. Therefore, a key parameter, the inflation coefficient, is introduced. Its value is typically greater than 1, for example, 1.1. This coefficient is used to initialize the allocatable workload of the target link, offsetting the potential loss of coordination workload to some extent. This key parameter is an empirical value. By constructing tree structures in both the uplink and downlink directions, the upper limit of the coordination workload for each threat path can be obtained through a branch constraint algorithm. Values ​​are selected within this upper limit to achieve the desired total traffic volume for the target link without prematurely blocking non-target links.

[0088] Step 703: Distribute the allocated workload from the root node down layer by layer according to the upper limit of the coordinated workload of the threat path group, ensuring that the allocated workload of any node is equal to the sum of the allocated workload of all its child nodes; during the allocation process, compare the allocated workload of the child node with the remaining bandwidth of the current flow link, select the minimum value of the two, until it is allocated to the leaf nodes of all threat paths, so as to obtain the contribution of each threat path according to the transmission node of each threat path.

[0089] In this embodiment of the invention, a branch constraint algorithm is used to organize the topology into a tree structure. Taking the target link as the root node, child nodes and leaf nodes of different depths are constructed downwards along the threat path and all available paths. Then, the allocatable workload of the root node is distributed layer by layer downwards, ensuring that the allocatable workload asi of any node m at any level is... m It equals all its child nodes asi i The sum of the distributable workload, i.e., asi m =∑asi i During the allocation process, the allocatable workload asi of child node i is... i With the current flow link m→i Remaining bandwidth (restband) m→i Compare the two values, select the minimum value, and accumulate the remaining bandwidth (restband). m→i The upper limit of the coordination workload can be calculated from top to bottom, up to the microservice traffic initiation point that is allocated to all threat paths.

[0090] In some embodiments of the present invention, the threat construction method for BGP networks further includes:

[0091] Determine the request initiation time of microservices so that microservice traffic on different threat paths can work together to reach the target link based on the initiation time of microservice requests.

[0092] Methods for determining the request initiation time of microservices include:

[0093] Obtain the time of threat occurrence and the latency of one-way interactions in each microservice dependency chain, including the latency of user requests reaching the first node and the transmission latency of nodes in the chain;

[0094] The request initiation time of a microservice is calculated based on the time of threat occurrence and the latency of one-way interaction in each microservice dependency chain. Microservice request initiation time = threat occurrence time - latency of user request arriving at the first node - transmission latency of nodes in the chain.

[0095] A complete and implementable threat strategy requires identifying information including threat paths, strategy implementation time, microservice requests, and coordination traffic. It also aims to ensure effective coordination of microservice traffic to a specific target link. An implementable threat strategy is denoted as S = (path, t, req, flow), which includes the threat path (path), strategy implementation time (t), and the coordination traffic size (flow) generated by microservice requests. A branch constraint algorithm is used to determine the upper limit of the working traffic for each threat path. Furthermore, the coordination traffic (flow) generated by the same microservice chain under different req values ​​will vary; the maximum value within the upper limit is selected. To determine the implementation time (t) in the implementable threat strategy, the latency of a one-way interaction in each microservice dependency chain is first given, such as... Figure 6 As shown in (b), the experimental representation of each dependency in chain1 is as follows: in For user requests to reach Ser A The latency; while threat strategy S2 corresponds to microservice dependency chain chain1, when the threat occurrence time is determined to be t. threat When the implementation time t in the threat strategy is t = t threat -t1-t2. For example... Figure 6 As shown in (c), the final implementable strategy can be determined as S1 = (path) H→K ,t threat -t4,req2,flow2) and S2 = (path) J→K ,t threat -t1-t2,req1,flow1).

[0096] This invention leverages the microservice dependency chains and predictability of microservice traffic in modern large-scale internet applications to cause traffic to converge and create threats on specific BGP links. Addressing the challenge researchers face when assessing BGP link security issues—specifically, the difficulty in effectively coordinating threat traffic sources, such as microservice traffic, to formulate implementable strategies for threat verification—this invention proposes a path-aware approach and designs a reasonable, customizable resource allocation method. Without affecting non-target links, it targets specific target links, creating rare but impactful threats, providing researchers with an effective blueprint for BGP security issues. The main steps of this method include:

[0097] (1) Extract key information about microservice dependency chains and resources in the application layer, and use the predictability of microservice traffic to organize and coordinate microservice traffic; extract key information such as topology and node roles in the network layer to ensure that the threat construction method can fully adapt to the network topology constraints around the target link, and attack the specific target link without affecting non-target links.

[0098] (2) Determine the available path by breadth-first traversal, introduce the expansion depth, and obtain the node role information based on the expansion depth. Starting from the nodes on both sides of the target link, mine nodes at different depths and record the expansion relationship. Construct a complete available path to the target link through nodes that match the role information until the specified depth or number of available paths is reached.

[0099] (3) Filter available paths to construct a bidirectional available path pool for the target link. Define the uplink and downlink directions based on the direction of traffic transmission on the target link. Based on routing policies and load balancing strategies in the current network area, filter available paths with a high probability of passing through the target link from multiple available paths to construct a bidirectional available path pool for the target link.

[0100] (4) Select threat paths from the bidirectional available path pool as paths for generating threat strategies. Based on stable microservice dependency chains, select the required number of threat paths from the bidirectional available path pool. The threat paths should be covered by relatively stable microservice dependency chains to ensure the effectiveness of the threat strategies.

[0101] (5) Calculate coordination workload using the branch constraint algorithm. Based on the topology and microservice resource constraints around the target link, a tree structure with the target link as the root node is constructed. The allocatable workload of each node on the threat path is calculated from top to bottom using the branch constraint algorithm. An expansion coefficient is introduced to offset the coordination workload that may be lost. Finally, the upper limit of the coordination workload of each threat path is obtained.

[0102] (6) Generate a complete and actionable threat strategy. The threat strategy includes attributes such as threat path, implementation time, microservice request and coordination traffic. Based on the threat occurrence time, the implementation time of the strategy is determined; based on the request and traffic correspondence of the microservice dependency chain, the maximum value is selected within the upper limit of the coordination workload, and finally a complete set of actionable threat strategies is determined.

[0103] This invention provides a threat construction method for BGP networks. Leveraging the unique generation mechanism and predictability of microservice traffic, and based on the widespread deployment of microservice applications and complex microservice interactions, it addresses the challenge of researchers directly and collaboratively organizing microservice traffic by designing an implementable threat construction method. On one hand, it is path-aware, utilizing the predictability of microservice traffic to mine available paths from the target link and construct a bidirectional available path pool, overcoming the difficulty of guaranteeing traffic paths in previous traffic engineering methods. On the other hand, it considers the topology's constraints on traffic convergence when organizing microservice traffic, guiding organized microservice traffic to the target path, reducing the impact on non-target paths, and minimizing losses caused by premature convergence of microservice traffic. By constructing the required threats, it can provide researchers with an effective research blueprint, promoting further research on BGP network security.

[0104] The threat construction apparatus for BGP networks provided by the present invention will be described below. The threat construction apparatus for BGP networks described below can be referred to in correspondence with the threat construction method for BGP networks described above.

[0105] Figure 8 A schematic diagram of a threat construction apparatus for BGP networks provided in an embodiment of the present invention, as shown below. Figure 8 As shown, the threat construction apparatus for BGP networks provided in this embodiment of the invention includes:

[0106] The detection module 801 is used to determine the target link and detect multiple potentially available paths that threaten the target link;

[0107] Module 802 is used to build a bidirectional available path pool based on multiple potentially available paths;

[0108] The filtering module 803 is used to filter out threat path groups for generating threat strategies from the bidirectional available path pool based on the threat direction.

[0109] The coordination module 804 is used to coordinate the contribution of each threat path in the threat path group to determine the microservice request content of each threat path to implement threats on the target link based on the contribution of each threat path.

[0110] The threat construction apparatus for BGP networks provided in this invention identifies a target link and detects multiple potentially available paths on that target link. It then constructs a bidirectional available path pool based on these paths. Next, it selects a group of threat paths from the bidirectional available path pool to generate threat strategies based on the threat direction. Finally, it coordinates the contribution of each threat path in the threat path group to determine the microservice request content of each threat path to threaten the target link. By constructing the required threats, this apparatus provides researchers with effective research evidence before newer and more complex potential threats emerge, effectively verifies the security mechanisms of BGP networks, and promotes the further development of BGP network security.

[0111] Figure 9 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 9 As shown, the electronic device may include a processor 910, a communications interface 920, a memory 930, and a communication bus 940. The processor 910, communications interface 920, and memory 930 communicate with each other via the communication bus 940. The processor 910 can invoke logical instructions in the memory 930 to execute a threat construction method for BGP networks. This method includes: determining a target link; probing multiple potentially available paths for the target link; constructing a bidirectional available path pool based on the multiple potentially available paths; selecting a threat path group from the bidirectional available path pool based on the threat direction to generate a threat strategy; and coordinating the contribution of each threat path in the threat path group to determine the microservice request content of each threat path to threaten the target link based on the contribution of each threat path.

[0112] Furthermore, the logical instructions in the aforementioned memory 930 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0113] On the other hand, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, is implemented to perform the threat construction method for BGP networks provided by the methods described above. The method includes: determining a target link; probing multiple potentially available paths that threaten the target link; constructing a bidirectional available path pool based on the multiple potentially available paths; selecting a group of threat paths from the bidirectional available path pool based on the threat direction for generating a threat strategy; and coordinating the contribution of each threat path in the threat path group to determine the microservice request content of each threat path to threaten the target link based on the contribution of each threat path.

[0114] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0115] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0116] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A threat construction method for BGP networks, characterized in that, include: Identify the target link and detect multiple potentially available paths that threaten the target link, including: extracting key information from the network layer in the BGP network, the key information of the network layer including the network layer topology around the target link; Construct a bidirectional available path pool based on the multiple potentially available paths; Threat path groups for generating threat strategies are selected from the bidirectional available path pool based on the threat direction; The contribution of each threat path in the threat path group is coordinated to determine the microservice request content of each threat path to implement threats on the target link based on the contribution of each threat path; The coordination of the contribution of each threat path in the threat path group includes: The network layer topology around the target link is transformed into a tree structure, with the target link as the root node, and child nodes and leaf nodes of different depths are constructed downwards along the threat path and all available paths. The upper limit of the coordinated working traffic for the threat path group is determined based on the bandwidth of the target link; The allocated workload is distributed layer by layer from the root node according to the upper limit of the coordinated workload of the threat path group, ensuring that the allocated workload of any node is equal to the sum of the allocated workload of all its child nodes. During the allocation process, the allocated workload of the child node is compared with the remaining bandwidth of the current link, and the minimum value of the two is selected until it is allocated to the leaf nodes of all threat paths, so as to obtain the contribution of each threat path according to the transmission node of each threat path.

2. The threat construction method for BGP networks according to claim 1, characterized in that, The detection of multiple potentially available paths to the target link that threatens the target also includes: Based on the network layer topology around the target link, a breadth-first traversal search is performed starting from both sides of the target link; Store and traverse nodes at different depths, and find the node whose role is a border router in the expanded node set; Based on the extension relationship corresponding to the border router nodes, a complete transmission path is constructed in reverse, and each complete transmission path is regarded as a potential available path.

3. The threat construction method for BGP networks according to claim 1, characterized in that, The step of selecting a group of threat paths from the bidirectional available path pool to generate a threat strategy based on the threat direction includes: Key information of the application layer in the BGP network is extracted. The key information of the application layer includes multiple microservice dependency chains, each of which is determined according to the logical relationship of normal business response. Based on the routing and load balancing policies of the current network area, a bidirectional available path through the target link is selected from multiple paths with the same starting point. Based on the threat direction, multiple threat paths in the corresponding direction are selected from the bidirectional available path pool to generate a threat path group. The threat paths should be covered by microservice dependency chains with high relevance.

4. The threat construction method for BGP networks according to claim 3, characterized in that, The step of determining the upper limit of the coordinated working traffic of the threat path group based on the bandwidth of the target link includes: The upper limit of the coordinated working traffic of the threat path group = target link bandwidth * expansion factor; The expansion coefficient is greater than 1, which is used to offset the transmission loss of the coordinated working flow.

5. The threat construction method for BGP networks according to claim 4, characterized in that, Also includes: Determine the request initiation time of the microservice so that microservice traffic on different threat paths can work together to reach the target link based on the request initiation time of the microservice.

6. The threat construction method for BGP networks according to claim 5, characterized in that, The method for determining the request initiation time of the microservice includes: Obtain the time of threat occurrence and the latency of one-way interactions in each microservice dependency chain, including the latency of user requests reaching the first node and the transmission latency of nodes in the chain; The request initiation time of a microservice is calculated based on the threat occurrence time and the latency of one-way interaction in each microservice dependency chain. The microservice request initiation time = threat occurrence time - latency of user request arriving at the first node - transmission latency of nodes in the chain.

7. A threat construction device for BGP networks, characterized in that, include: The detection module is used to determine the target link and detect multiple potentially available paths that threaten the target link, including: extracting key information of the network layer in the BGP network, wherein the key information of the network layer includes the network layer topology around the target link; The construction module is used to construct a bidirectional available path pool based on the multiple potentially available paths; The filtering module is used to filter out threat path groups for generating threat strategies from the bidirectional available path pool based on the threat direction; A coordination module is used to coordinate the contribution of each threat path in the threat path group, so as to determine the microservice request content of each threat path to implement threats on the target link based on the contribution of each threat path; the coordination of the contribution of each threat path in the threat path group includes: The network layer topology around the target link is transformed into a tree structure, with the target link as the root node, and child nodes and leaf nodes of different depths are constructed downwards along the threat path and all available paths. The upper limit of the coordinated working traffic for the threat path group is determined based on the bandwidth of the target link; The allocated workload is distributed layer by layer from the root node according to the upper limit of the coordinated workload of the threat path group, ensuring that the allocated workload of any node is equal to the sum of the allocated workload of all its child nodes. During the allocation process, the allocated workload of the child node is compared with the remaining bandwidth of the current link, and the minimum value of the two is selected until it is allocated to the leaf nodes of all threat paths, so as to obtain the contribution of each threat path according to the transmission node of each threat path.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the threat construction method for BGP networks as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the threat construction method for BGP networks as described in any one of claims 1 to 6.

Images