A method, apparatus, and electronic device for determining the legality of route announcements

Abstract

An embodiment of the present invention discloses a method, device, electronic device and storage medium for determining the legality of route announcements, which relates to the field of computer technology and can improve the efficiency of detecting the legality of route announcements. The method includes receiving a first route announcement; wherein, the origin autonomous system in the first route announcement is identified as an unauthorized holder of an Internet protocol address prefix; generating a first credibility feature vector based on the first route announcement; obtaining a first feature vector according to the first credibility feature vector; wherein, the similarity between the first feature vector and the first credibility feature vector meets a preset condition; the first feature vector is pre-generated according to border gateway protocol historical data; performing a first detection step corresponding to the first feature vector to verify whether the first credibility feature vector belongs to the first feature vector; and determining the legality of the first route announcement according to the verification result.

Description

Technical Field

[0001] This application relates to the field of computer technology, and particularly to a method, apparatus, electronic device, and storage medium for determining the legality of route announcements. Background Art

[0002] Currently, the Internet and the networks of larger network service providers are divided into a large number of autonomous systems (ASs), and the ASs define the management areas and routing policies applicable within the ASs. Today's Internet consists of more than 70,000 autonomous systems, and these autonomous systems exchange routing update information through the Border Gateway Protocol (BGP). The BGP protocol runs on the border routers of each autonomous system, and it completes inter-domain routing through the AS-level routing reachability information exchanged between the border routers of each autonomous system, thereby enabling the reachability of network information between each autonomous system. According to the BGP protocol, the border router of each autonomous system will periodically send route announcements to its neighbors during operation, and in the said route announcements, there are announcements and cancellations of the latest IP address prefix information. After receiving these route announcements, the routers in other autonomous systems will select the optimal route according to the network prefix information therein.

[0003] However, the security mechanism was not fully considered when the BGP protocol was formulated, and the corresponding protection mechanism is not fully enabled during the current operation of the BGP protocol, which makes there be potential or real security threats in the current Internet.

[0004] To address the above-mentioned security threats, it is possible to judge the data authenticated by the route source through the Resource Public Key Infrastructure (RPKI) data. Specifically, the Internet number resources are bound to the public key through certificates, such as the authorization relationship between the autonomous system number and the IP address. We can use this authorization information to verify the legality of route announcements. However, due to problems such as non-standard maintenance and untimely update of RPKI data, many unlicensed route announcements detected are actually legal, where an unlicensed route announcement refers to a route announcement in which, according to the RPKI data, the origin autonomous system is identified as an unlicensed holder of the Internet protocol address prefix.

[0005] In order to more accurately determine the legitimacy of route announcements, a commonly used method at present is to detect the duration of multi-origin conflicts for the received unauthorized route announcements to obtain a detection result. At the same time, analyze the characteristics of the AS to obtain an analysis result. If both the above detection result and analysis result indicate that the route announcement is unauthorized, then determine that the unauthorized route announcement is unauthorized; otherwise, determine that the unauthorized route announcement is legal. However, the current determination method has technical problems of cumbersome steps and low efficiency.

[0006] Therefore, how to improve the efficiency of detecting the legitimacy of route announcements has become a technical problem urgently to be solved in the current field. Summary of the Invention

[0007] In view of this, embodiments of the present invention provide a method, apparatus, electronic device, and storage medium for determining the legitimacy of route announcements, which can improve the efficiency of detecting the legitimacy of route announcements.

[0008] In a first aspect, an embodiment of the present invention provides a method for determining the legitimacy of route announcements, including: receiving a first route announcement; wherein the origin autonomous system in the first route announcement is identified as an unauthorized holder of an Internet protocol address prefix; generating a first credibility feature vector based on the first route announcement; obtaining a first feature vector according to the first credibility feature vector; wherein the similarity between the first feature vector and the first credibility feature vector meets a preset condition; the first feature vector is pre-generated according to border gateway protocol historical data; performing a first detection step corresponding to the first feature vector to verify whether the first credibility feature vector belongs to the first feature vector; and determining the legitimacy of the first route announcement according to the verification result.

[0009] Optionally, the generating a first credibility feature vector based on the first route announcement includes: performing a credibility analysis on the Internet protocol address prefix and the origin autonomous system in the first route announcement to obtain a first credibility value corresponding to the Internet protocol address prefix and a second credibility value corresponding to the origin autonomous system; and generating a first credibility feature vector according to the first credibility value and the second credibility value.

[0010] Optionally, the obtaining a first feature vector according to the first credibility feature vector includes: comparing the first credibility feature vector with a preset feature vector to obtain a first feature vector with the smallest angular deviation from the first credibility feature vector; wherein the number of the preset feature vectors is at least two.

[0011] Optionally, determining the legality of the first route announcement according to the verification result includes: if the first credibility feature vector belongs to the first feature vector, determining that the first route announcement is legal; if the first credibility feature vector does not belong to the first feature vector, determining that the first route announcement is unauthorized.

[0012] Optionally, after determining that the first route announcement is unauthorized if the first credibility feature vector does not belong to the first feature vector, the method further includes: sending an alarm message.

[0013] In a second aspect, an embodiment of the present invention provides a device for determining the legality of a route announcement, including: a receiving module, configured to receive a first route announcement; wherein, the origin autonomous system in the first route announcement is identified as an unauthorized holder of an Internet protocol address prefix; a generating module, configured to generate a first credibility feature vector based on the first route announcement; an obtaining module, configured to obtain a first feature vector according to the first credibility feature vector; wherein, the similarity between the first feature vector and the first credibility feature vector meets a preset condition; the first feature vector is pre-generated according to Border Gateway Protocol historical data; an execution module, configured to execute a first detection step corresponding to the first feature vector to verify whether the first credibility feature vector belongs to the first feature vector; a determining module, configured to determine the legality of the first route announcement according to the verification result.

[0014] Optionally, the generating module includes: an analysis unit, configured to perform credibility analysis on the Internet protocol address prefix and the origin autonomous system in the first route announcement to obtain a first credibility value corresponding to the Internet protocol address prefix and a second credibility value corresponding to the origin autonomous system; a generating unit, configured to generate a first credibility feature vector according to the first credibility value and the second credibility value.

[0015] Optionally, the obtaining module is specifically configured to: compare the first credibility feature vector with a preset feature vector, and obtain a first feature vector with the smallest angular deviation from the first credibility feature vector; wherein, the number of the preset feature vectors is at least two.

[0016] Optionally, the determining module is specifically configured to: if the first credibility feature vector belongs to the first feature vector, determine that the first route announcement is legal; if the first credibility feature vector does not belong to the first feature vector, determine that the first route announcement is unauthorized.

[0017] Optionally, the device further includes: an alarm module, configured to send an alarm message after determining that the first route announcement is unauthorized.

[0018] In a third aspect, an embodiment of the present invention further provides an electronic device, which includes: a housing, a processor, a memory, a circuit board, and a power supply circuit. Among them, the circuit board is arranged inside the space enclosed by the housing, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to each circuit or device of the above-mentioned electronic device; the memory is used to store executable program codes; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, and is used to execute any one of the routing announcement legality determination methods provided by the embodiments of the present invention.

[0019] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement any one of the routing announcement legality determination methods provided by the embodiments of the present invention.

[0020] The routing announcement legality determination method, device, electronic device, and storage medium provided by the embodiments of the present invention can generate a first credibility feature vector according to the first routing announcement, and obtain a first feature vector whose similarity with the first credibility feature vector meets a preset condition. Then, by executing the first detection step corresponding to the first feature vector, it can be verified whether the first credibility feature vector belongs to the first feature vector, and further, the legality of the first routing announcement can be determined according to the verification result. Compared with the prior art, the implementation steps of the embodiments of the present invention are simple, so the efficiency of detecting the legality of routing announcements can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the following drawings are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0022] Figure 1 It is a schematic flowchart of a method for determining the legality of a routing announcement provided by an embodiment of the present invention;

[0023] Figure 2 It is a schematic diagram of an application scenario of a method for determining the legality of a routing announcement provided by an embodiment of the present invention;

[0024] Figure 3 It is a schematic diagram for comparing feature vectors of a routing announcement provided by an embodiment of the present invention;

[0025] Figure 4Schematic structural diagram of a routing announcement legality determination device provided by an embodiment of the present invention;

[0026] Figure 5 Schematic structural diagram of an electronic device provided by an embodiment of the present application. Detailed implementation manners

[0027] The embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0028] It should be clear that the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts belong to the scope of protection of the present invention.

[0029] In the first aspect, as Figure 1 shown, the routing announcement legality determination method provided by the embodiments of the present invention may include:

[0030] S11. Receive a first routing announcement; wherein, the originating autonomous system in the first routing announcement is identified as an unauthorized holder of an Internet protocol address prefix;

[0031] In this step, when the originating autonomous system in the routing announcement is an unauthorized holder of an Internet protocol address prefix, that is, an IP address prefix hijacking occurs, which will cause great harm to the Internet. A routing origin verification system can be deployed in a computer to detect whether the originating autonomous system in each routing announcement is a legal (authorized) holder of an Internet protocol address prefix, so as to obtain a first routing announcement (abbreviated as an unauthorized routing announcement) in which the originating autonomous system is identified as an unauthorized holder of an Internet protocol address prefix.

[0032] S12. Generate a first credibility feature vector based on the first routing announcement;

[0033] In this step, according to the information in the unauthorized routing announcement, a first credibility feature vector can be generated, and the first credibility feature vector is used to characterize the credibility of the relevant information in the unauthorized routing announcement.

[0034] S13. Obtain a first feature vector according to the first credibility feature vector; wherein, the similarity between the first feature vector and the first credibility feature vector meets a preset condition; the first feature vector is pre-generated according to border gateway protocol historical data;

[0035] In this step, a first feature vector whose similarity with the first credibility feature vector meets a preset condition can be obtained. That the similarity meets the preset condition indicates that the first credibility feature vector may belong to the first feature vector, and the higher the similarity, the greater the possibility.

[0036] Due to certain reasons, a legitimate route announcement may be misidentified as an unauthorized route announcement. The first eigenvector can be generated in advance based on such a reason. The following are examples of the above reasons, which can be found in a multi-dimensional database storing BGP historical data, such as Figure 2As shown below. The first example is that a certain AS assigns its sub-prefixes to its customers but does not issue route origin authorization (ROA) to the customers. The second example is that a certain AS announces its routes to its provider, and for unified management, the provider changes the origin AS in the announcement to its own AS and forwards it. The third example is that a certain AS establishes a static route with its neighbor AS or is connected to the same Internet exchange center. Therefore, when the neighbor AS announces routes to this AS, it does not add its own AS to the AS path through the BGP protocol, resulting in an incorrect origin AS. The fourth example occurs in the BGP anycast technology. Since BGP anycast assigns the same IP address to multiple servers, these servers are deployed on different routers in different geographical locations, which may lead to multi-origin conflicts. The fifth example is a problem with the ROA data itself. Due to the expiration of the ROA data or some problems during issuance, the ROA data issued by some institutions may fail to pass verification, so misjudgment occurs during actual route origin verification. The sixth example is that this type of reason occurs in ASs with special functions, such as DDoS protection institutions or institutions conducting scientific research experiments. The behavior of such ASs may lead to multi-origin conflicts. The seventh example is that this type of reason occurs in route aggregation failure or traffic engineering. For example, a certain AS obtains a ROA with a relatively small maximum length. However, when announcing externally, this AS announces multiple sub-prefixes that exceed the maximum length in its ROA data for load balancing, which will result in an unauthorized route announcement for the verification result. The eighth example is that this type of reason occurs when an institution has multiple ASs and IP address prefixes, but only authorizes one of the ASs when issuing ROA. However, it is still legal for this institution to use other ASs to announce its prefixes. The ninth example is that this type of reason occurs when a certain AS obtains a newly allocated address, so relevant data cannot be found in the historical data and ROA data. The detection scheme for this type of reason is to detect the similarity between this IP address and the existing prefixes of this AS. Since IP addresses are usually allocated continuously, the similarity between newly allocated IP addresses and existing IP addresses is usually high. The tenth example is that this type of reason occurs in the transaction of IP addresses or the transfer of institutional organizations. For example, an IP address is sold by the first AS to the second AS, but the ROA data is not updated in time. Therefore, when the second AS announces this IP address externally, it will be judged as unauthorized. The eleventh example is that this type of reason occurs when a certain IP address prefix changes to a new provider, and the provider directly announces itself as the origin AS in the route announcement.

[0037] S14, perform the first detection step corresponding to the first eigenvector to verify whether the first credibility eigenvector belongs to the first eigenvector;

[0038] In this step, there is a corresponding detection step for each eigenvector. By executing the detection step corresponding to the first eigenvector, it can be verified whether the first credibility eigenvector belongs to the first eigenvector. For example, in the above 11 examples, when the first eigenvector is the eigenvector corresponding to any one of the first to sixth examples, the first detection step is to check whether there is such a route announcement in the BGP historical data. If it exists, it indicates that the first credibility eigenvector belongs to the first eigenvector; if not, it indicates that the first credibility eigenvector does not belong to the first eigenvector. When the first eigenvector is the eigenvector corresponding to the seventh example, the first detection step is to check whether the autonomous system number in the route announcement is the same as the autonomous system number in the ROA, or set the maximum length in the ROA data to the maximum. When the first eigenvector is the eigenvector corresponding to the eighth example, the first detection step is to detect whether the AS in the route announcement and the AS in the ROA belong to the same organization, which can be specifically detected through the AS organization data passed by CAIDA. When the first eigenvector is the eigenvector corresponding to the ninth example, the first detection step is to detect the edit distance between this IP address and the existing prefix of this AS because the allocation of IP addresses is usually continuous. When the first eigenvector is the eigenvector corresponding to the tenth example, the first detection step is to detect whether this transaction is recorded in the Internet registration authority data (including the IP address and autonomous system number allocation data maintained by it). When the first eigenvector is the eigenvector corresponding to the eleventh example, the first detection step is to detect whether the origin AS is a network service provider and whether the distance between the AS in the route announcement and the AS in the ROA is less than a preset threshold.

[0039] S15. Determine the legality of the first route announcement according to the verification result.

[0040] In this step, when the first credibility eigenvector belongs to the first eigenvector, it can be determined that the first route announcement is misjudged as unauthorized and is actually legal; otherwise, it can be determined that the first route announcement is unauthorized.

[0041] The method for determining the legality of a route announcement provided by the embodiment of the present invention can generate a first credibility eigenvector according to the first route announcement, and obtain a first eigenvector whose similarity with it meets a preset condition according to the first credibility eigenvector. Then, by executing the first detection step corresponding to the first eigenvector, it can be verified whether the first credibility eigenvector belongs to the first eigenvector, and further, the legality of the first route announcement can be determined according to the verification result. Compared with the prior art, the implementation steps of the embodiment of the present invention are simple, so the efficiency of detecting the legality of a route announcement can be improved.

[0042] Optionally, in an embodiment of the present invention, generating the first credibility feature vector based on the first route announcement includes: performing credibility analysis on the Internet Protocol address prefix and the origin autonomous system in the first route announcement to obtain a first credibility value corresponding to the Internet Protocol address prefix and a second credibility value corresponding to the origin autonomous system; and generating a first credibility feature vector according to the first credibility value and the second credibility value.

[0043] In an embodiment of the present invention, credibility analysis can be performed on the Internet Protocol address prefix in the first route announcement. In one example, a pre-trained neural network model can be used to perform credibility analysis on the IP address prefix. Specifically, the credibility value (i.e., the first credibility value) corresponding to the IP address prefix can be calculated according to the appearance duration and visibility of the IP address prefix. Similarly, credibility analysis can also be performed on the origin autonomous system in the first route announcement. In one example, for the origin AS, in a pre-generated neural network model, according to information such as the size of the customer domain of the origin AS, the proportion of the actually used prefix in the prefix of the ROA, whether it has joined security organizations such as the Internet Routing Security Specification, and whether ROV is deployed, the credibility value (i.e., the second credibility value) corresponding to the origin autonomous system can be calculated, as Figure 2 shown, and the content referred to by the feature analysis part is this part. It should be noted that the training samples of the pre-generated neural network model can be IP address prefixes and origin ASs with known high or low credibility.

[0044] After obtaining the first credibility value and the second credibility value, a first credibility feature vector can be generated according to the two. In one example, a first credibility feature vector can be generated with the first credibility value as the horizontal axis coordinate value and the second credibility value as the vertical axis coordinate value. It can also be generated with the second credibility value as the horizontal axis coordinate value and the first credibility value as the vertical axis coordinate value.

[0045] Optionally, in an embodiment of the present invention, obtaining the first feature vector according to the first credibility feature vector may include: comparing the first credibility feature vector with a preset feature vector to obtain a first feature vector with the smallest angular deviation from the first credibility feature vector; where the number of the preset feature vectors is at least two.

[0046] In an embodiment of the present invention, each preset feature vector also includes two items of information: the credibility value corresponding to the IP address prefix and the credibility value corresponding to the origin autonomous system. When there are multiple preset feature vectors, the angular deviation between the first credibility feature vector and each preset feature vector is calculated respectively, and the first feature vector with the smallest angular deviation from the first credibility feature vector is selected therefrom. In one example, as Figure 3As shown, the coordinate values of the first credibility feature vector are (x1, y1), the coordinate values of a certain preset feature vector are (x2, y2), and the θ angle shown in the figure is the angular deviation between the two. The first feature vector selected by the above method is the feature vector that the first credibility feature vector is most likely to belong to.

[0047] Optionally, in an embodiment of the present invention, determining the legality of the first route announcement according to the verification result may include: if the first credibility feature vector belongs to the first feature vector, determining that the first route announcement is legal; if the first credibility feature vector does not belong to the first feature vector, determining that the first route announcement is unauthorized.

[0048] In an embodiment of the present invention, when it is determined that the first credibility feature vector belongs to the first feature vector, it indicates that the first route announcement is misjudged as unauthorized, so it can be determined that the first route announcement is legal. On the contrary, when the first credibility feature vector does not belong to the first feature vector, it indicates that the first route announcement is not misjudged as unauthorized, so it can be determined that the first route announcement is unauthorized.

[0049] Optionally, in an embodiment of the present invention, after if the first credibility feature vector does not belong to the first feature vector, determining that the first route announcement is unauthorized, the method further includes: sending an alarm message.

[0050] In an embodiment of the present invention, when the first route announcement is unauthorized, it indicates that there is a relatively serious security risk, so an alarm message can be sent to remind the user to adopt appropriate security measures, thereby reducing the security risk in a timely manner.

[0051] In addition, for the sake of understanding, the reasons for which a legal route announcement is determined to be unauthorized are described below, mainly including the following six types: A. Load balancing: An AS may obtain a ROA with a relatively small maximum length. However, when announcing externally, this AS announces multiple sub-prefixes that exceed the maximum length of its ROA for load balancing purposes, which will result in an unauthorized verification result; B. Aggregation failure: This situation is roughly the same as situation A. The difference is that the announced sub-prefixes should have been ultimately aggregated, but the aggregation fails during the actual propagation process. This will result in the verification of each sub-prefix, and thus it is determined to be unauthorized; C. Unauthorized multi-origin: An AS may allocate its sub-prefixes to its customers, but does not issue ROAs for the customers. Since the customers have more than one provider, when announcing this prefix to other providers, it is determined to be unauthorized because no ROA is issued for it; D. Unauthorized single-origin: An AS may allocate its sub-prefixes to its customers, but does not issue ROAs for the customers. Under normal circumstances, if no ROA is issued for it, when this customer announces this prefix to this provider, this provider should change the origin AS to itself. Failure to do so will result in the announcement being determined to be unauthorized; E. Unauthorized provider: An AS itself has a prefix and the corresponding ROA. However, when announcing a routing message to its provider, this provider changes the origin AS to itself and announces it, which will result in an unauthorized determination result; F. Unauthorized address transaction: An AS sells its prefix to another AS, but does not modify its ROA data, which will result in the other AS being determined to be unauthorized when announcing this prefix externally.

[0052] In a second aspect, as Figure 4 shown, the legality determination device 2 for route announcements provided by an embodiment of the present invention may include: a receiving module 21, configured to receive a first route announcement; wherein, the origin autonomous system in the first route announcement is determined to be an unauthorized holder of an Internet protocol address prefix; a generating module 22, configured to generate a first credibility feature vector based on the first route announcement; an obtaining module 23, configured to obtain a first feature vector according to the first credibility feature vector; wherein, the similarity between the first feature vector and the first credibility feature vector meets a preset condition; the first feature vector is pre-generated according to border gateway protocol historical data; an execution module 24, configured to execute a first detection step corresponding to the first feature vector to verify whether the first credibility feature vector belongs to the first feature vector; a determination module 25, configured to determine the legality of the first route announcement according to the verification result.

[0053] The legality determination device for route announcements provided by an embodiment of the present invention can generate a first credibility feature vector based on a first route announcement, and obtain a first feature vector whose similarity to the first credibility feature vector meets a preset condition. Then, by performing a first detection step corresponding to the first feature vector, it can be verified whether the first credibility feature vector belongs to the first feature vector, and thus, based on the verification result, the legality of the first route announcement can be determined. Compared with the prior art, the implementation steps of the embodiment of the present invention are simple, so the efficiency of detecting the legality of route announcements can be improved.

[0054] Optionally, in an embodiment of the present invention, the generating module 22 includes: an analysis unit configured to perform credibility analysis on the Internet Protocol address prefix and the origin autonomous system in the first route announcement to obtain a first credibility value corresponding to the Internet Protocol address prefix and a second credibility value corresponding to the origin autonomous system; and a generating unit configured to generate a first credibility feature vector according to the first credibility value and the second credibility value.

[0055] Optionally, in an embodiment of the present invention, the obtaining module 23 is specifically configured to: compare the first credibility feature vector with preset feature vectors, and obtain a first feature vector with the smallest angular deviation from the first credibility feature vector; wherein the number of the preset feature vectors is at least two.

[0056] Optionally, in an embodiment of the present invention, the determining module 24 is specifically configured to: if the first credibility feature vector belongs to the first feature vector, determine that the first route announcement is legal; if the first credibility feature vector does not belong to the first feature vector, determine that the first route announcement is unauthorized.

[0057] Optionally, in an embodiment of the present invention, the device further includes: an alarm module configured to send an alarm message after determining that the first route announcement is unauthorized.

[0058] In a third aspect, an embodiment of the present invention further provides an electronic device, which can improve the efficiency of detecting the legality of route announcements.

[0059] Such as Figure 5As shown in the figure, the electronic device provided by the embodiment of the present invention may include: a housing 51, a processor 52, a memory 53, a circuit board 54, and a power supply circuit 55. Among them, the circuit board 54 is arranged inside the space surrounded by the housing 51, and the processor 52 and the memory 53 are arranged on the circuit board 54; the power supply circuit 55 is used to supply power to each circuit or device of the above-mentioned electronic device; the memory 53 is used to store executable program codes; the processor 52 runs the program corresponding to the executable program code by reading the executable program code stored in the memory 53, and is used to execute the legality determination method of route announcement provided in any of the foregoing embodiments.

[0060] For the specific execution process of the above steps by the processor 52 and the further steps executed by the processor 52 by running the executable program code, reference may be made to the description of the foregoing embodiments, and details will not be repeated here.

[0061] The above-mentioned electronic devices exist in various forms, including but not limited to:

[0062] (1) Mobile communication devices: These devices are characterized by having mobile communication functions and mainly aim to provide voice and data communication. Such terminals include: smart phones (such as iPhone), multimedia phones, functional phones, and low-end phones, etc.

[0063] (2) Ultra-mobile personal computer devices: These devices belong to the category of personal computers, have computing and processing functions, and generally also have the characteristics of mobile Internet access. Such terminals include: PDA, MID, and UMPC devices, etc., such as iPad.

[0064] (3) Servers: Devices that provide computing services. The composition of a server includes a processor, a hard disk, a memory, a system bus, etc. Servers are similar to general computer architectures, but due to the need to provide highly reliable services, they have higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0065] (4) Other electronic devices with data interaction functions.

[0066] Fourthly, the embodiment of the present invention further provides a computer-readable storage medium. The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement any one of the legality determination methods of route announcement provided in the foregoing embodiments. Therefore, the corresponding technical effects can also be achieved. Details have been described in detail above and will not be repeated here.

[0067] It should be noted that in this text, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprising", "including" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not expressly listed, or also includes elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "comprising a..." does not exclude the presence of additional identical elements in the process, method, article or device comprising said element.

[0068] Each embodiment in this specification is described in a related manner. For the same or similar parts between the embodiments, reference can be made to each other. Each embodiment focuses on the differences from other embodiments.

[0069] In particular, for the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple. For the relevant parts, reference can be made to the partial description of the method embodiments.

[0070] For the convenience of description, the above device is described by dividing it into various units / modules according to functions. Of course, when implementing the present invention, the functions of each unit / module can be realized in the same or multiple software and / or hardware.

[0071] Those of ordinary skill in the art can understand that all or part of the processes of implementing the methods in the above embodiments can be completed by instructing relevant hardware through a computer program. The program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the above method embodiments. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0072] The above is only the specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any change or replacement that can be easily thought of by those skilled in the art within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims

1. A method for determining the legitimacy of a routing announcement, characterized in that: include: receiving a first routing announcement; wherein an originating autonomous system in the first routing announcement is identified as an unauthorized holder of an Internet Protocol address prefix; Generating a first credibility feature vector based on the first routing announcement includes: performing credibility analysis on the Internet Protocol address prefix and the originating autonomous system in the first routing announcement to obtain a first credibility value corresponding to the Internet Protocol address prefix and a second credibility value corresponding to the originating autonomous system; and generating the first credibility feature vector based on the first credibility value and the second credibility value; Obtaining a first feature vector based on the first credibility feature vector; wherein the similarity between the first feature vector and the first credibility feature vector satisfies a preset condition; and the first feature vector is pre-generated based on border gateway protocol historical data; executing a first detection step corresponding to the first feature vector to verify whether the first credibility feature vector belongs to the first feature vector; The validity of the first routing announcement is determined based on the verification result.

2. The method according to claim 1, characterized in that The obtaining of a first feature vector according to the first credibility feature vector includes: The first credibility feature vector is compared with a preset feature vector to obtain a first feature vector having the smallest angular deviation from the first credibility feature vector; wherein the number of the preset feature vectors is at least two.

3. The method according to claim 1, characterized in that Determining the legitimacy of the first routing announcement based on the verification result includes: If the first credibility feature vector belongs to the first feature vector, determining that the first routing announcement is legal; If the first credibility feature vector does not belong to the first feature vector, the first routing announcement is determined to be unauthorized.

4. The method according to claim 3, characterized in that If the first credibility feature vector does not belong to the first feature vector, after determining that the first routing declaration is unauthorized, the method further includes: issuing an alarm message.

5. A device for determining the legitimacy of a routing announcement, characterized in that: include: a receiving module configured to receive a first routing announcement; wherein the originating autonomous system in the first routing announcement is identified as an unauthorized holder of an Internet Protocol address prefix; a generating module, configured to generate a first credibility feature vector based on the first routing announcement, comprising: an analyzing unit, configured to perform credibility analysis on the Internet Protocol address prefix and the originating autonomous system in the first routing announcement to obtain a first credibility value corresponding to the Internet Protocol address prefix and a second credibility value corresponding to the originating autonomous system; and a generating unit, configured to generate the first credibility feature vector based on the first credibility value and the second credibility value; an acquisition module, configured to acquire a first feature vector based on the first credibility feature vector; wherein the similarity between the first feature vector and the first credibility feature vector satisfies a preset condition; and the first feature vector is pre-generated based on historical data of the Border Gateway Protocol; an execution module, configured to execute a first detection step corresponding to the first feature vector to verify whether the first credibility feature vector belongs to the first feature vector; A determination module is used to determine the legitimacy of the first routing announcement based on the verification result.

6. The device according to claim 5, characterized in that The acquisition module is specifically configured to compare the first credibility feature vector with preset feature vectors to acquire a first feature vector having the smallest angular deviation from the first credibility feature vector; wherein the number of the preset feature vectors is at least two.

7. The device according to claim 5, characterized in that The determination module is specifically configured to: determine that the first routing declaration is legal if the first credibility feature vector belongs to the first feature vector; and determine that the first routing declaration is unauthorized if the first credibility feature vector does not belong to the first feature vector.

8. The device according to claim 7, characterized in that The device further includes: an alarm module, configured to issue an alarm message after determining that the first routing declaration is unauthorized.

9. An electronic device, characterized in that: The electronic device includes: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the housing, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, and is used to execute the method for determining the legitimacy of the routing announcement described in any one of claims 1 to 4.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method for determining the legitimacy of routing announcements according to any one of claims 1 to 4.

Images