Method for detecting prefix hijacking anomaly based on dynamic graph and related device

Abstract

The application provides a prefix hijacking anomaly detection method based on a dynamic graph and related equipment. The method comprises the following steps: constructing a border gateway protocol heterogeneous graph based on first packet data in an acquired start time window and second packet data in a to-be-detected time window; setting different self-loop relationships for different node types in the second heterogeneous graph, and obtaining a first embedding vector matrix based on the self-loop relationships; extracting changes of the first embedding vector matrix in a time dimension to obtain a second embedding vector matrix; flattening the second embedding vector matrix as an input of a multilayer perception machine to output a detection result. By constructing a BGP heterogeneous topology graph in combination with the characteristics of prefix hijacking, the graph characteristics of the BGP network are fully mined on the basis of the characteristics of prefix hijacking. In addition, the autonomous domain network naturally has a topology characteristic, and the characteristic is effectively extracted through a BGP heterogeneous graph convolution network, so that the effectiveness of detection is ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of border gateway protocol, in particular to a prefix hijacking anomaly detection method based on dynamic graph and related equipment. BACKGROUND

[0002] Current prefix hijacking detection algorithms either manually design prefix hijacking features according to domain knowledge to establish a knowledge base to detect whether there is a prefix hijacking anomaly in the future network, or extract features through a deep neural network to check prefix hijacking anomalies. On the one hand, manually designed prefix hijacking features have timeliness, and on the other hand, they may lose original information of the network, such as network topology. Although deep learning can automatically extract features, it cannot effectively combine prefix hijacking anomaly features, so it cannot effectively distinguish prefix hijacking anomalies from other anomalies in the Border Gateway Protocol (BGP) network, such as route leakage and route interruption. SUMMARY

[0003] Therefore, the present application aims to provide a prefix hijacking anomaly detection method based on dynamic graph and related equipment.

[0004] To achieve the above purpose, the present application provides a prefix hijacking anomaly detection method based on dynamic graph, comprising:

[0005] constructing a border gateway protocol heterogeneous graph based on the obtained first message data in the start time window and the second message data in the to-be-detected time window;

[0006] setting different self-loop relationships for different node types in the second heterogeneous graph, and obtaining a first embedding vector matrix based on the self-loop relationships;

[0007] extracting changes of the first embedding vector matrix in the time dimension to obtain a second embedding vector matrix;

[0008] flattening the second embedding vector matrix as an input of a multi-layer perception machine to output a detection result.

[0009] In a possible implementation manner, the constructing a border gateway protocol heterogeneous graph based on the obtained first message data in the start time window and the second message data in the to-be-detected time window comprises:

[0010] obtaining first message data in a start time window and second message data in a to-be-detected time window;

[0011] constructing a first heterogeneous graph based on the first message data;

[0012] The first heterogeneous graph is constructed based on the first message data.

[0013] In a possible implementation, the first heterogeneous graph is constructed based on the first message data, including:

[0014] traversing each autonomous domain path in the first message data;

[0015] in response to the first autonomous domain in the autonomous domain path being not the last autonomous domain, determining whether the first autonomous domain and a second autonomous domain are the same, the second autonomous domain being the next autonomous domain of the first autonomous domain;

[0016] in response to the first autonomous domain and the second autonomous domain being different, establishing an undirected edge between the first autonomous domain and the second autonomous domain;

[0017] in response to the first autonomous domain in the autonomous domain path being the last autonomous domain, establishing two directed edges between the first autonomous domain and a prefix announced by the first autonomous domain, and adding one to a network resource attribute of the first autonomous domain.

[0018] In a possible implementation, the BGP heterogeneous graph is constructed based on the first heterogeneous graph and the second message data, including:

[0019] dividing the second message data into multiple parts according to a preset time interval;

[0020] for each part of the second message data, constructing a second heterogeneous graph based on the first heterogeneous graph;

[0021] summarizing each second heterogeneous graph to obtain the BGP heterogeneous graph.

[0022] In a possible implementation, the different self-loop relationships are set for different node types in the second heterogeneous graph, and a first embedding vector matrix is obtained based on the self-loop relationships, including:

[0023] for different node types in the second heterogeneous graph, at least one corresponding neighbor node is obtained;

[0024] based on at least one adjacency relationship between a node in the second heterogeneous graph and at least one corresponding neighbor node, at least one first weight matrix is configured, the number of the adjacency relationship being consistent with the number of the first weight matrix;

[0025] different self-loop relationships are set for the types of the nodes respectively, and a second weight matrix is configured based on the self-loop relationships;

[0026] transform node features of at least one of the neighbor nodes based on the first weight matrix to obtain at least one first representation vector corresponding to the type of the adjacent relationship, and transform node features of the node based on the second weight matrix to obtain a second representation vector corresponding to the type of the self-loop relationship;

[0027] add the at least one first representation vector and the second representation vector to obtain a comprehensive node representation;

[0028] process the node representation by using an activation function to obtain the first embedding vector matrix.

[0029] In a possible implementation, the extracting of the variation of the first embedding vector matrix in the time dimension to obtain the second embedding vector matrix includes:

[0030] extracting the variation of the first embedding vector matrix in the time dimension by using a long short-term memory artificial neural network to obtain the second embedding vector matrix.

[0031] In a possible implementation, the flattening of the second embedding vector matrix as an input of the multi-layer perception to output a detection result includes:

[0032] flattening the second embedding vector matrix to obtain a column matrix;

[0033] inputting the column matrix into the multi-layer perception, and in response to an output result of the multi-layer perception being less than a preset threshold, the detection result is that there is no prefix hijacking anomaly;

[0034] in response to the output result of the multi-layer perception being not less than the preset threshold, the detection result is that there is a prefix hijacking anomaly.

[0035] Based on the same inventive concept, the embodiments of the present application also provide a device for detecting a prefix hijacking anomaly based on a dynamic graph, which includes:

[0036] a construction module configured to construct a border gateway protocol heterogeneous graph based on first packet data in a start time window and second packet data in a to-be-detected time window;

[0037] a setting module configured to set different self-loop relationships for different node types in the second heterogeneous graph, and obtain a first embedding vector matrix based on the self-loop relationships;

[0038] an extracting module configured to extract a variation of the first embedding vector matrix in the time dimension to obtain a second embedding vector matrix;

[0039] The output module is configured to flatten the second embedding vector matrix as an input of a multi-layer perception machine, and output a detection result.

[0040] Based on the same inventive concept, the embodiments of the present application also provide an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method for detecting prefix hijacking anomaly based on a dynamic graph according to any one of the above.

[0041] Based on the same inventive concept, the embodiments of the present application also provide a non-transitory computer readable storage medium, which stores computer instructions for causing the computer to execute the method for detecting prefix hijacking anomaly based on a dynamic graph according to any one of the above.

[0042] As can be seen from the above, the method for detecting prefix hijacking anomaly based on a dynamic graph and the related device provided by the present application are based on the first packet data in the starting time window and the second packet data in the to-be-detected time window to construct a border gateway protocol heterogeneous graph; different self-loop relationships are set for different node types in the second heterogeneous graph, and a first embedding vector matrix is obtained based on the self-loop relationships; the change of the first embedding vector matrix in the time dimension is extracted to obtain a second embedding vector matrix; the second embedding vector matrix is flattened as an input of a multi-layer perception machine, and a detection result is output. By constructing a BGP heterogeneous topology graph in combination with the characteristics of prefix hijacking, the graph features of the BGP network are fully mined on the basis of the characteristics of prefix hijacking. Secondly, the autonomous domain network naturally has a topology feature, and this feature is effectively extracted by the BGP heterogeneous graph convolution network, thereby ensuring the effectiveness of the detection. BRIEF DESCRIPTION OF DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the present application or related art, the following will briefly introduce the drawings needed to be used in the embodiments or related art descriptions. Obviously, the drawings in the following description are only embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0044] Figure 1 The flowchart of the method for detecting prefix hijacking anomaly based on a dynamic graph of the embodiments of the present application;

[0045] Figure 2 The overall flowchart of the method for detecting prefix hijacking anomaly based on a dynamic graph of the embodiments of the present application;

[0046] Figure 3 The heterogeneous graph of the embodiments of the present application;

[0047] Figure 4 a sharing feature space schematic diagram of an embodiment of the present application;

[0048] Figure 5 a prefix hijacking anomaly detection device structure schematic diagram based on a dynamic graph of an embodiment of the present application;

[0049] Figure 6 an electronic device structure schematic diagram of an embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application is further described in detail below with reference to the embodiments and the accompanying drawings.

[0051] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should be understood as the general meaning understood by those skilled in the art to which the embodiments of the present application belong. The terms “first”, “second” and the like used in the embodiments of the present application do not represent any order, quantity or importance, but are only used to distinguish different components. The terms “include” or “contain” and the like mean that the elements or objects before the terms cover the elements or objects listed after the terms and their equivalents, and do not exclude other elements or objects. The terms “connect” or “connected” and the like are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. The terms “up”, “down”, “left”, “right” and the like are only used to represent relative positional relationships, and when the absolute positions of the described objects change, the relative positional relationships may also change accordingly.

[0052] As described in the background section, current prefix hijacking detection algorithms either manually design prefix hijacking features according to domain knowledge to establish a knowledge base to detect whether there is a prefix hijacking anomaly in future networks, or extract features through a deep neural network to check prefix hijacking anomalies. On the one hand, manually designed prefix hijacking features have timeliness, and on the other hand, they may lose original information of the network, such as network topology structure. Although deep learning can automatically extract features, it cannot effectively combine prefix hijacking anomaly features, so it cannot effectively distinguish prefix hijacking anomalies from other anomalies in the Border Gateway Protocol (BGP) network, such as route leaks and route interruptions.

[0053] With the above considerations, the embodiment of the present application proposes a prefix hijacking anomaly detection method based on dynamic graph. A border gateway protocol heterogeneous graph is constructed based on the first packet data obtained within the start time window and the second packet data within the time window to be detected. Different self-loop relationships are set for different node types in the second heterogeneous graph, and a first embedding vector matrix is obtained based on the self-loop relationship. The change of the first embedding vector matrix in the time dimension is extracted to obtain a second embedding vector matrix. The second embedding vector matrix is flattened as the input of a multi-layer perception machine, and the detection result is output. By combining the characteristics of prefix hijacking to construct a BGP heterogeneous topology graph, the graph features of the BGP network are fully mined based on the characteristics of prefix hijacking. Secondly, the autonomous domain network naturally has topological features, and the features are effectively extracted by the BGP heterogeneous graph convolution network, ensuring the effectiveness of the detection.

[0054] In the following, the technical solutions of the embodiments of the present application will be described in detail through specific examples.

[0055] First, explain the meaning of some terms:

[0056] A graph neural network is a neural network used to learn graph structure data, extract and mine features and patterns in graph structure data. The graph structure data is composed of nodes and edges. The node represents an entity or object, and the edge represents the relationship between the nodes.

[0057] Prefix hijacking detection is a network security technology designed to monitor and detect prefix hijacking attacks in the Internet routing system. Prefix hijacking is a malicious behavior in which an attacker routes a legitimate IP address prefix to a malicious network under their control in order to steal or monitor network traffic passing through the prefix. The goal of prefix hijacking detection is to protect the security and privacy of Internet communications, preventing attackers from hijacking traffic for eavesdropping, man-in-the-middle attacks, or tampering with sensitive information. This technology plays a key role in maintaining the security of the global Internet infrastructure.

[0058] Reference Figure 1 The prefix hijacking anomaly detection method based on dynamic graph of the embodiment of the present application includes the following steps:

[0059] Step S101, constructing a border gateway protocol heterogeneous graph based on the first packet data obtained within the start time window and the second packet data within the time window to be detected;

[0060] Step S102, setting different self-loop relationships for different node types in the second heterogeneous graph, and obtaining a first embedding vector matrix based on the self-loop relationship;

[0061] Step S103, extracting the changes of the first embedding vector matrix in the time dimension to obtain a second embedding vector matrix;

[0062] Step S104, flattening the second embedding vector matrix as the input of the multi-layer perception machine, and outputting the detection result.

[0063] Reference Figure 2 The figure shows the overall flow of the prefix hijacking anomaly detection method based on dynamic graphs according to the embodiments of the present application.

[0064] As Figure 2 shown, the four basic components are: feature conversion layer, BGP relationship graph convolutional neural network, recurrent neural network layer, and prediction layer. The feature conversion layer module serves as a preprocessing stage to convert the features of autonomous system nodes and IP prefix nodes in the BGP heterogeneous graph, so that the two different types of nodes can share the same feature space, preparing for the aggregation process of BRGCN. BRGCN includes two steps: feature aggregation of adjacent nodes and feature aggregation of nodes themselves, which is responsible for converting the node attribute features in a series of time-series BGP heterogeneous graphs into low-dimensional vectors for learning more semantic information of the nodes. The recurrent neural network layer models the node feature sequence learned by BRGCN, aiming to capture the changes of the node feature sequence in the time dimension. The prediction layer receives the changes in the time dimension learned by the recurrent neural network layer as input to determine whether a prefix hijacking anomaly has occurred.

[0065] To achieve the above-mentioned application, the main technical scheme is:

[0066] From the perspectives of node type selection, node relationship design, and node feature extraction, the BGP network at different times is modeled into a BGP heterogeneous graph.

[0067] Node feature conversion.

[0068] BGP relationship graph convolutional network processes the BGP heterogeneous graph.

[0069] Recurrent neural network captures the changes of the node feature sequence in the time dimension.

[0070] Multi-layer perception machine predicts whether a prefix hijacking anomaly has occurred.

[0071] For step S101, in some embodiments, the first message data in the starting time window and the second message data in the to-be-detected time window are used to construct a border gateway protocol heterogeneous graph, including: obtaining the first message data in the starting time window and the second message data in the to-be-detected time window; constructing a first heterogeneous graph based on the first message data; and constructing the border gateway protocol heterogeneous graph based on the first heterogeneous graph and the second message data.

[0072] Reference Figure 3 , which is a heterogeneous graph diagram of an embodiment of the present application.

[0073] As Figure 3 shown, a schematic of a heterogeneous graph and a schematic of a suspected hijacked heterogeneous graph are given. Wherein AS represents an autonomous domain, and Prefix represents a prefix.

[0074] The foregoing steps specifically include:

[0075] Collect BGP anomaly event information from the BGPStream website. The specific operation is to traverse the anomaly event list, save the type, start time, end time and anomaly AS of the anomaly event.

[0076] The data collection time is divided into a start time window and a sampling time window. The sampling time window is the time window in which we are interested in the changes in Internet routing, which is set to 1 hour, i.e. 30 minutes before the start of the anomaly event and 30 minutes after the start of the anomaly event. Since BGP is an incremental protocol, the sampling time window only contains a small part of the Internet routing. Therefore, the present application sets the start time window to 10 hours as the initial topology of the Internet to build the initial information of the Internet. If we want to focus on the Internet routing data from 17:00 on January 1, 2024 to 18:00 on January 1, 2024, the present application will collect the Internet routing data from 7:00 on January 1, 2024 to 18:00 on January 1, 2024.

[0077] According to the data collection time, collect the route update packets of the public observation point. The collected routing data is divided into start data and sampling data. And use the bgpdump tool to parse the collected route update packets from MRT format to readable format.

[0078] Traverse the anomaly event list, and for each anomaly event, repeat the above steps.

[0079] In some embodiments, the first heterogeneous graph is constructed based on the first message data, including: traversing each autonomous domain path in the first message data; in response to traversing to a first autonomous domain in the autonomous domain path which is not the last autonomous domain, determining whether the first autonomous domain and a second autonomous domain are the same; the second autonomous domain is the next autonomous domain of the first autonomous domain; in response to the first autonomous domain and the second autonomous domain being different, establishing an undirected edge between the first autonomous domain and the second autonomous domain; in response to traversing to the first autonomous domain in the autonomous domain path being the last autonomous domain, establishing two directed edges between the first autonomous domain and the prefix announced by the first autonomous domain, and adding one to the network resource attribute of the first autonomous domain.

[0080] In the embodiments of the present application, the initial BGP heterogeneous graph is constructed according to the start-up data. The BGP heterogeneous graph contains two types of nodes: autonomous system nodes and IP prefix nodes, and contains three types of relationships: connection between autonomous systems, autonomous system announcing IP prefix and IP prefix depending on autonomous system. The start-up data is composed of a plurality of update files, each update file contains a plurality of BGP routing information, and each piece of BGP routing information contains an AS path to a specific network prefix. All update messages contained in the start-up data are traversed. The specific processing is as follows: from the first AS in the AS path to the last AS, first determine whether the last AS is traversed, if not, determine whether the AS and the next AS are the same, if the same, skip, if different, establish an undirected edge between the two ASs; if it is the last AS, two directed edges are established between the AS and the announced prefix: AS->Prefix, Prefix->AS. And the network resource attribute of the AS is added by 1.

[0081] In some embodiments, the constructing the BGP heterogeneous graph based on the first heterogeneous graph and the second message data comprises: dividing the second message data into multiple parts according to a preset time interval; for each part of the second message data, constructing a second heterogeneous graph based on the first heterogeneous graph; and aggregating each part of the second heterogeneous graph to obtain the BGP heterogeneous graph.

[0082] In the embodiments, the time-series BGP heterogeneous graph is constructed according to the sampling data. Set the time interval T and the sampling time S, and divide the sampling data into S / T parts. Each part of the sampling data is based on the initial BGP heterogeneous graph and performs the following operations: the sampling data is composed of a plurality of update files, each update file contains a plurality of BGP routing information, and each piece of BGP routing information contains an AS path to a specific network prefix. All BGP routing information contained in the start-up data is traversed. The specific processing is as follows: from the first AS in the AS path to the last AS, first determine whether the last AS is traversed, if not, determine whether the AS and the next AS are the same, if the same, skip, if different, establish an undirected edge between the two ASs; if it is the last AS, two directed edges are established between the AS and the announced prefix: AS->Prefix, Prefix->AS. And the network resource attribute of the AS is added by 1. In general, if the sampling time is 60 minutes and the time interval is 1 minute, 60 / 1=60 BGP heterogeneous graphs will be obtained.

[0083] The resource quantity of the IP prefix node is set to 1. The node characteristic attribute of AS and Prefix is set. The specific processing is as follows: the node characteristic attribute of AS is set to 1, and the node characteristic attribute of Prefix is set to 0.

[0084] Repeat the above steps for each abnormal event. If the abnormal event is prefix hijacking, the resulting time-series BGP heterograph is marked as abnormal; if the abnormal event is leak or outage, the resulting time-series BGP heterograph is marked as normal.

[0085] Save the abnormal AS and time-series BGP heterograph. The specific processing is as follows: initialize an empty dictionary for saving the abnormal AS and time-series BGP heterograph. Traverse the abnormal event list: for each abnormal event, extract the abnormal AS and time-series BGP heterograph of the abnormal event, and take the abnormal AS as the Key of the dictionary and the time-series BGP heterograph as the Value of the dictionary.

[0086] Further, the node needs to be converted for features:

[0087] Since the nodes have heterogeneity, different types of nodes have different semantic features, and even different feature dimensions. The attribute features of the autonomous system nodes and the IP prefix nodes in the BGP relationship network also have different semantics. The features of the autonomous system nodes include node type and network resource number. The features of the IP prefix nodes include node type and resource number. Therefore, for each type of node, the embodiments of the present application convert the features of different nodes into a shared feature space through a specific linear transformation.

[0088] Reference Figure 4 is a schematic diagram of the shared feature space of the embodiments of the present application.

[0089] The linear conversion is shown in the following formula:

[0090]

[0091] wherein, represents the original feature of the node, represents the feature after linear conversion, represents the trainable feature conversion matrix of the node whose node type is f v (v i ) node.

[0092] For step S102, in some embodiments, the different self-loop relationships are set for different node types in the second heterogeneous graph, and the first embedding vector matrix is obtained based on the self-loop relationships, including: for different node types in the second heterogeneous graph, at least one corresponding neighbor node is obtained; based on at least one kind of adjacency relationship between the node in the second heterogeneous graph and at least one of the corresponding neighbor nodes, at least one first weight matrix consistent with the number of adjacency relationships is configured; different self-loop relationships are set for the types of the node respectively, and a second weight matrix is configured based on the self-loop relationships; the node features of at least one of the neighbor nodes are transformed based on the first weight matrix, to obtain at least one first representation vector corresponding to the type of the adjacency relationship, and the node features of the node are transformed based on the second weight matrix, to obtain a second representation vector corresponding to the type of the self-loop relationship; at least one of the first representation vector and the second representation vector is summed to obtain a comprehensive node representation; the node representation is processed by using an activation function to obtain the first embedding vector matrix. As shown in Figure 4 Autonomous system nodes and IP prefix nodes share a feature space after linear transformation corresponding to their types.

[0093] Specifically,

[0094] The heterogeneous graph obtained by the foregoing steps is taken as an input of a BGP relationship graph convolution network, for extracting high-dimensional features of abnormal nodes. The specific method is as follows: the time sequence BGP heterogeneous graph corresponding to the current abnormal event is taken as a batch input of the BGP relationship graph neural network by traversing the abnormal event list, and each batch has S / T BGP heterogeneous graphs. After the BGP relationship graph convolution network outputs a result, the embedding vector of the abnormal node is selected from each BGP heterogeneous graph, and a total of S / T embedding vectors are obtained to form an embedding matrix.

[0095] The specific design of node updating in the BGP relationship graph neural network is as follows:

[0096] Collecting neighbor node embedding vectors: in the BGP relationship graph convolution network model, the neighbors of the node to be updated are collected according to different relationships, to ensure that each type of conversion mode can capture the differences of different relationships;

[0097] Different learnable weight matrices are set: a unique transformation mechanism is designed for each type of adjacency relationship, that is, a specific learnable weight matrix is ​​configured for each type of relationship, enhancing the model's adaptability to the characteristics of different relationships. In particular, node self-loops are a special type of relationship, and the model sets different self-loop relationships according to different node types. Therefore, for the two different types of nodes, autonomous systems and IP prefixes, the model is further refined, and specific weight matrices are set for their respective self-loop relationships, thereby accurately capturing the inherent characteristics and behavioral patterns of each type of node;

[0098] Relation type transformation: Transform each relation category separately to obtain representation vectors of features for different relation types;

[0099] Fusion representation vectors: By accumulating and normalizing these transformed representation vectors, the model effectively integrates information from multiple relationships to obtain a comprehensive node representation;

[0100] Activation function: By processing the synthesized node representation through an activation function, nonlinear elements are introduced to enhance the expressive power of the model.

[0101]

[0102] in, For node v i The updated status For node v i The state before the update. Represents node v i In relation The set of neighbors below. i,r It is the normalization constant. h i,t Represents node v i It is a t-type node, where σ represents the activation function. This represents the weight matrix corresponding to relation r. This represents the characteristics of the neighboring nodes of the current node under relation r. This represents the weight matrix corresponding to type t.

[0103] In some embodiments, extracting the changes of the first embedding vector matrix in the time dimension to obtain the second embedding vector matrix includes: using a long short-term memory artificial neural network to extract the changes of the first embedding vector matrix in the time dimension to obtain the second embedding vector matrix.

[0104] Specifically: The embedding matrix obtained in the previous steps is used as the input of LSTM to learn the changes of the feature sequence in the time dimension, and the t_embedding matrix is ​​obtained.

[0105] In some embodiments, the flattening the second embedding vector matrix as an input of the multi-layer perception and outputting a detection result comprises: flattening the second embedding vector matrix to obtain a column matrix; inputting the column matrix into the multi-layer perception; in response to an output result of the multi-layer perception being less than a preset threshold, the detection result is that there is no prefix hijacking anomaly; and in response to the output result of the multi-layer perception being not less than the preset threshold, the detection result is that there is a prefix hijacking anomaly.

[0106] Specifically, the t_embedding matrix obtained in step D is flattened to obtain a matrix with only one column as an input of the MLP, and the MLP outputs a value between 0 and 1. If the value is greater than 0.5, it indicates that there is a prefix hijacking anomaly. If the value is less than 0.5, it indicates that there is no prefix hijacking anomaly.

[0107] As can be seen from the above embodiments, the method for detecting prefix hijacking anomaly based on a dynamic graph according to the embodiments of the present application constructs a border gateway protocol heterogeneous graph based on the first packet data in the starting time window and the second packet data in the time window to be detected; sets different self-loop relationships for different node types in the second heterogeneous graph, and obtains a first embedding vector matrix based on the self-loop relationships; extracts changes of the first embedding vector matrix in the time dimension to obtain a second embedding vector matrix; and flattens the second embedding vector matrix as an input of a multi-layer perception, and outputs a detection result. By constructing a BGP heterogeneous topology graph in combination with the characteristics of prefix hijacking, and effectively extracting the characteristics of the autonomous domain network based on the characteristics of prefix hijacking, the graph characteristics of the BGP network are fully mined, and the effectiveness of the detection is ensured.

[0108] It should be noted that the method of the embodiments of the present application can be executed by a single device, such as a computer or a server, etc. The method of the embodiments can also be applied to a distributed scenario, and completed by multiple devices cooperating with each other. In this distributed scenario, one of the multiple devices can only execute one or more steps in the method of the embodiments of the present application, and the multiple devices can interact with each other to complete the method.

[0109] It should be noted that some embodiments of the present application have been described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in a different order than the order described above and still achieve desirable results. In addition, the processes depicted in the figures do not necessarily require the particular order shown, or sequential order, to achieve the desired results. In certain implementations, multitasking and parallel processing can be advantageous.

[0110] Corresponding to the method of any of the above embodiments, the application also provides a device for detecting prefix hijacking anomaly based on dynamic graph based on the same inventive concept.

[0111] Reference Figure 5 , the device for detecting prefix hijacking anomaly based on dynamic graph comprises:

[0112] The construction module 51 is configured to construct a border gateway protocol heterogeneous graph based on the first packet data in the obtained start time window and the second packet data in the to-be-detected time window;

[0113] The setting module 52 is configured to set different self-loop relationships for different node types in the second heterogeneous graph, and obtain a first embedding vector matrix based on the self-loop relationships;

[0114] The extraction module 53 is configured to extract changes of the first embedding vector matrix in the time dimension to obtain a second embedding vector matrix;

[0115] The output module 54 is configured to flatten the second embedding vector matrix as an input of a multi-layer perception machine and output a detection result.

[0116] For the convenience of description, the above device is described as various modules in function and is described respectively. Of course, the functions of the modules can be implemented in one or more software and / or hardware in the implementation of the application.

[0117] The device of the above embodiment is used to implement the corresponding method for detecting prefix hijacking anomaly based on dynamic graph in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be described here.

[0118] Corresponding to the method of any of the above embodiments, the application also provides an electronic device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the method for detecting prefix hijacking anomaly based on dynamic graph according to any of the above embodiments when executing the program.

[0119] Figure 6 A more specific hardware structure schematic diagram of an electronic device provided by the embodiment is shown, which can include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 for communication within the device.

[0120] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits, etc., for executing relevant programs to implement the technical solutions provided by the embodiments of the present specification.

[0121] The memory 1020 can be implemented by a ROM (Read Only Memory), a RAM (Random Access Memory), a static storage device, a dynamic storage device, etc. The memory 1020 can store an operating system and other application programs, and when the technical solutions provided by the embodiments of the present specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and called and executed by the processor 1010.

[0122] The input / output interface 1030 is configured to connect input / output modules to implement information input and output. The input / output modules can be configured as components in the device (not shown in the figure) or externally connected to the device to provide corresponding functions. The input devices can include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output devices can include a display, a speaker, a vibrator, an indicator light, etc.

[0123] The communication interface 1040 is configured to connect a communication module (not shown in the figure) to implement the communication interaction between the device and other devices. The communication module can realize communication through a wired manner (such as USB, network cable, etc.) or through a wireless manner (such as mobile network, WIFI, Bluetooth, etc.).

[0124] The bus 1050 includes a channel for transmitting information between various components (such as the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040) of the device.

[0125] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040, and the bus 1050, in the specific implementation process, the device can also include other components necessary for normal operation. In addition, those skilled in the art can understand that the above device can also only include the components necessary to implement the solutions of the embodiments of the present specification, and does not have to include all the components shown in the figure.

[0126] The electronic device of the above embodiment is used to implement the corresponding dynamic graph-based prefix hijacking anomaly detection method in any of the preceding embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0127] Based on the same inventive concept, corresponding to the method of any of the above embodiments, the present application also provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to perform the dynamic graph-based prefix hijacking anomaly detection method according to any of the above embodiments.

[0128] The computer-readable medium of the present embodiment includes permanent and non-permanent, removable and non-removable media, which can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette tape, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device.

[0129] The computer instructions stored in the storage medium of the above embodiment are used to cause the computer to perform the dynamic graph-based prefix hijacking anomaly detection method according to any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0130] Those skilled in the art should understand that the discussion of any of the above embodiments is only exemplary and is not intended to imply that the scope of the present application (including claims) is limited to these examples; under the idea of the present application, the above embodiments or technical features in different embodiments can also be combined, the steps can be implemented in any order, and there are many other changes of different aspects of the embodiments of the present application as described above. In order to be brief, they are not provided in detail.

[0131] Additionally, to simplify the description and discussion, and so as not to obscure the embodiments of the application being presented, the well-known functions or constructions of integrated circuit (IC) chips and other components can or can not be shown in the figures and will be omitted as not to unnecessarily obscure the embodiments of the application being presented. Moreover, the devices can be shown in block diagram form in order to avoid unnecessary obscurity of the present embodiments, and this also acknowledges the fact that the details in regard to the implementation of such block diagram devices are highly dependent on the platform within which the present embodiments are to be implemented (i.e., such details should be well within the purview of one of ordinary skill in the art). Where specific details are set forth in order to describe an illustrative embodiment of the application, it will be apparent to one of ordinary skill in the art that the embodiment of the application can be practiced without these specific details. In other instances, detailed descriptions of well-known methods, devices, and materials can be omitted so as not to obscure the description of the present embodiments of the application. It is intended that the specific embodiments disclosed herein are presented by way of example only and that the present application is not limited by the embodiments presented herein.

[0132] Although the present application has been described in connection with certain specific embodiments thereof, many modifications, changes, variations and substitutions will be apparent to those of ordinary skill in the art. For example, other memory architectures (e.g., dynamic RAM (DRAM)) can use the embodiments discussed.

[0133] It is therefore intended that the present application cover all such modifications, changes, variations and substitutions that fall within the broad scope of the appended claims. Accordingly, any one or more of the features, functions, structures, or other aspects of the embodiments described herein can be combined in any suitable manner to form additional embodiments, which are also within the scope of the present application. Thus, various additional embodiments of the present application are also intended to fall within the scope of the appended claims. In particular, with respect to the above description background, detailed description, and examples, each feature, function, structure, or other aspect of each embodiment can be combined with any other feature, function, structure, or other aspect of any other embodiment.

Claims

1. A method for detecting prefix hijacking anomaly based on dynamic graph, characterized in that, The method comprises the following steps: Based on the obtained first message data in the starting time window and the second message data in the to-be-detected time window, a border gateway protocol heterogeneous graph is constructed, including: obtaining the first message data in the starting time window and the second message data in the to-be-detected time window; based on the first message data, a first heterogeneous graph is constructed; the second message data is divided into multiple parts according to a preset time interval; for each part of the second message data, a second heterogeneous graph is constructed based on the first heterogeneous graph; each second heterogeneous graph is summarized to obtain the border gateway protocol heterogeneous graph; the border gateway protocol heterogeneous graph includes two types of nodes: autonomous system nodes and IP prefix nodes, and three types of relationships: connection between autonomous systems, autonomous system announcing IP prefix and IP prefix depending on autonomous system; Different self-loop relationships are set for different node types in the second heterogeneous graph, and a first embedding vector matrix is obtained based on the self-loop relationships, including: for different node types in the second heterogeneous graph, at least one corresponding neighbor node is obtained; based on at least one kind of adjacency relationship between the nodes in the second heterogeneous graph and at least one of the corresponding neighbor nodes, at least one first weight matrix consistent with the number of adjacency relationships is configured; different self-loop relationships are set for the types of nodes respectively, and a second weight matrix is configured based on the self-loop relationships; the node features of at least one of the neighbor nodes are transformed based on the first weight matrix, to obtain at least one first representation vector corresponding to the type of the adjacency relationship, and the node features of the node are transformed based on the second weight matrix, to obtain a second representation vector corresponding to the type of the self-loop relationship; at least one first representation vector and the second representation vector are added to obtain a comprehensive node representation; the node representation is processed by using an activation function to obtain the first embedding vector matrix; The changes of the first embedding vector matrix in the time dimension are extracted to obtain a second embedding vector matrix; The second embedding vector matrix is flattened as the input of a multilayer perceptron, and a detection result is output.

2. The method of claim 1, wherein, The first heterogeneous graph is constructed based on the first message data, including: Each autonomous domain path in the first message data is traversed; In response to the first autonomous domain in the autonomous domain path being not the last autonomous domain, it is judged whether the first autonomous domain and the second autonomous domain are the same; the second autonomous domain is the next autonomous domain of the first autonomous domain; In response to the first autonomous domain being different from the second autonomous domain, an undirected edge is established between the first autonomous domain and the second autonomous domain; In response to the first autonomous domain being the last autonomous domain in the autonomous domain path, two directed edges are established between the first autonomous domain and the prefix announced by the first autonomous domain, and the network resource attribute of the first autonomous domain is incremented by one.

3. The method of claim 1, wherein, The changes of the first embedding vector matrix in the time dimension are extracted to obtain a second embedding vector matrix, including: The change of the first embedding vector matrix in the time dimension is extracted by using a long short-term memory artificial neural network to obtain the second embedding vector matrix.

4. The method of claim 1, wherein, The second embedding vector matrix is flattened as input of the multi-layer perception, and a detection result is output. The second embedding vector matrix is flattened to obtain a column matrix. The column matrix is input into the multi-layer perception, and in response to the output result of the multi-layer perception being less than a preset threshold, the detection result is that there is no prefix hijacking anomaly. In response to the output result of the multi-layer perception being not less than the preset threshold, the detection result is that there is a prefix hijacking anomaly.

5. An apparatus for detecting prefix hijacking anomaly based on dynamic graph, characterized in that, Comprising: The construction module is configured to construct a border gateway protocol heterogeneous graph based on the first packet data in the starting time window and the second packet data in the to-be-detected time window, including: obtaining the first packet data in the starting time window and the second packet data in the to-be-detected time window; constructing a first heterogeneous graph based on the first packet data; dividing the second packet data into multiple parts according to a preset time interval; for each part of the second packet data, constructing a second heterogeneous graph based on the first heterogeneous graph; and aggregating each second heterogeneous graph to obtain the border gateway protocol heterogeneous graph; the border gateway protocol heterogeneous graph includes two types of nodes: autonomous system nodes and IP prefix nodes, and three types of relationships: connections between autonomous systems, autonomous system declared IP prefixes, and IP prefix dependent autonomous systems; The setting module is configured to set different self-loop relationships for different node types in the second heterogeneous graph, and obtain a first embedding vector matrix based on the self-loop relationships, including: for different node types in the second heterogeneous graph, obtaining at least one corresponding neighbor node; based on at least one adjacency relationship between the node in the second heterogeneous graph and at least one of the corresponding neighbor nodes, configuring at least one first weight matrix consistent with the number of adjacency relationships; setting different self-loop relationships for the types of nodes respectively, and configuring a second weight matrix based on the self-loop relationships; transforming the node features of at least one of the neighbor nodes based on the first weight matrix to obtain at least one first representation vector corresponding to the type of the adjacency relationship, and transforming the node features of the node based on the second weight matrix to obtain a second representation vector corresponding to the type of the self-loop relationship; adding at least one first representation vector and the second representation vector to obtain a comprehensive node representation; processing the node representation by using an activation function to obtain the first embedding vector matrix; The extraction module is configured to extract the change of the first embedding vector matrix in the time dimension to obtain a second embedding vector matrix. The output module is configured to flatten the second embedding vector matrix as input of a multi-layer perception, and output a detection result.

6. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the method of any one of claims 1 to 4 when executing the program.

7. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to make the computer execute the method of any one of claims 1 to 4.

Images