A method, apparatus, and related equipment for AS relation inference based on graph neural networks.

Abstract

This application provides a method, apparatus, and related equipment for AS (Alternate Gateway Protocol) relationship inference based on graph neural networks. The method includes: converting collected routing table messages into graph structure data of the Border Gateway Protocol; determining the AS organization mapping dataset, adding organization information to nodes in the graph structure data based on it, and pre-adding edge labels to some edges in the graph structure data after adding organization information to obtain a border gateway graph; extracting node features from the border gateway graph, determining the corresponding original graph, extracting network topology information from the original graph using a multidimensional graph convolutional network model, and fusing the node features and network topology information to obtain a fusion result; determining imbalanced labels (with and without edge labels) in the border gateway graph, and training the multidimensional graph convolutional network model using a semi-supervised learning strategy based on the imbalanced labels and the fusion result; using the trained multidimensional graph convolutional network model to output the edge categories corresponding to the border gateway graph, and determining AS relationships based on the edge categories.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to an AS relation inference method, apparatus and related equipment based on graph neural networks. Background Technology

[0002] Current Autonomous System (AS) relationship inference algorithms face the following challenges. First, with the rapid development of the internet and the deepening of hierarchical flattening, many data relationships between ASs deviate from traditional understanding. Existing data relationship inference algorithms rely excessively on assumptions about the internet topology and lack truly realistic datasets. Heuristic inference based on these assumptions can lead to unbounded errors and is no longer suitable for real-world needs. Second, current deep learning algorithms consider using word embeddings to infer data relationships in ASs. Using textual data cannot effectively utilize the graph structure features of the topology itself, and also suffers from weak interpretability and limited relationship types. Third, as the internet topology continues to change, AS relationships will also change. Inference algorithms need to be generalizable to adjust inferred relationships promptly, but current algorithms are primarily suitable for situations where the internet hierarchy is fixed and the strategy is singular. Summary of the Invention

[0003] In view of this, the purpose of this application is to propose an AS relation inference method, apparatus and related equipment based on graph neural networks to solve or partially solve the above-mentioned technical problems.

[0004] To achieve the above objectives, this application provides an AS relation inference method based on graph neural networks, comprising:

[0005] The collected routing table messages are converted into border gateway protocol graph structure data;

[0006] Determine the AS organization mapping dataset, add organization information to the nodes in the graph structure data based on the AS organization mapping dataset, and pre-add edge labels to some edges in the graph structure data after adding organization information to obtain the boundary gateway graph.

[0007] Node features are extracted from the boundary gateway graph, and the original graph of the boundary gateway graph is determined. A multidimensional graph convolutional network model is used to extract network topology information from the original graph. The node features and the network topology information are fused through an attention mechanism to obtain a fusion result.

[0008] The imbalanced labels with and without edge labels in the boundary gateway graph are determined. Based on the imbalanced labels and the fusion results, a semi-supervised learning strategy is used to train a multidimensional graph convolutional network model. The trained multidimensional graph convolutional network model outputs the edge categories corresponding to the boundary gateway graph, and the AS relationship is determined according to the edge categories.

[0009] Based on the same inventive concept, this disclosure also provides an AS relation inference device based on graph neural networks, comprising:

[0010] The graph structure conversion module is configured to convert the collected routing table messages into graph structure data for the Border Gateway Protocol.

[0011] The edge label generation module is configured to determine the AS organization mapping dataset, add organization information to the nodes in the graph structure data based on the AS organization mapping dataset, and pre-add edge labels to some edges in the graph structure data after adding organization information to obtain the boundary gateway graph.

[0012] The feature extraction and fusion module is configured to extract node features from the boundary gateway graph, determine the original graph of the boundary gateway graph, extract network topology information from the original graph using a multidimensional graph convolutional network model, and fuse the node features and the network topology information through an attention mechanism to obtain a fusion result.

[0013] The AS relationship transformation module is configured to determine the imbalanced labels with and without edge labels in the boundary gateway graph, and to train a multidimensional graph convolutional network model using a semi-supervised learning strategy based on the imbalanced labels and the fusion results. The trained multidimensional graph convolutional network model outputs the edge categories corresponding to the boundary gateway graph, and determines the AS relationship based on the edge categories.

[0014] Based on the same inventive concept, this disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable by the processor, wherein the processor implements the method described above when executing the computer program.

[0015] Based on the same inventive concept, this disclosure also provides a non-transitory computer-readable storage medium that stores computer instructions for causing a computer to perform the method described above.

[0016] Based on the same concept, this disclosure also provides a computer program product, including computer program instructions that, when run on a computer, cause the computer to perform the method described above.

[0017] As can be seen from the above, the AS relationship inference method, apparatus, and related equipment based on graph neural networks provided in this application can process routing table messages into graph-structured data, aggregate node features using a multidimensional graph convolutional network model, and classify directed edges by adding labels. Based on the classified edge categories, the data relationships between ASs can be inferred. When the network topology information changes, the parameters of the multidimensional graph convolutional network model can be dynamically adjusted, thus adapting to new network topology information for AS relationship inference, exhibiting good generalization ability. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in this application or related technologies, the drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1A This is a flowchart of the AS relation inference method based on graph neural networks according to an embodiment of this application;

[0020] Figure 1B This is a schematic diagram of the multidimensional graph convolutional network model structure according to an embodiment of this application;

[0021] Figure 1C This is a schematic diagram of the edge type inference structure according to an embodiment of this application;

[0022] Figure 2 This is a schematic diagram of the AS relation inference device based on graph neural network according to an embodiment of this application;

[0023] Figure 3 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with specific embodiments and the accompanying drawings.

[0025] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this application should have the ordinary meaning understood by one of ordinary skill in the art to which this application pertains. The terms "first," "second," and similar terms used in the embodiments of this application do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed after the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are only used to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0026] Based on the above background information, the relevant technologies will be described in detail below:

[0027] semi-supervised learning

[0028] Semi-supervised learning is a machine learning method that combines supervised and unsupervised learning. Its core idea is to fully utilize both labeled and unlabeled data to train the model, thereby improving its performance and generalization ability. The goal of semi-supervised learning is to enable the model to better generalize to new and unseen data by appropriately combining labeled and unlabeled data.

[0029] In semi-supervised learning, there are three commonly used basic assumptions to establish the relationship between predicted examples and learning objectives: the smoothness assumption, the clustering assumption, and the manifold assumption. Essentially, these three types of assumptions are consistent, only differing in their emphasis. Among them, the manifold assumption is more universal.

[0030] There are many methods for semi-supervised learning, including label propagation, autoencoders, generative adversarial networks (GANs), and semi-supervised graph neural networks. The characteristics of semi-supervised learning include high data utilization, strong generalization ability, robustness to label noise, and domain adaptability. Especially when dealing with the challenges of large-scale data and unlabeled data, semi-supervised learning will continue to play an important role.

[0031] Graph Neural Networks

[0032] Graph Neural Networks (GNNs) are a deep learning technique for processing graph data. The main goal of GNNs is to extend deep learning methods to the highly flexible domain of graph data, enabling models to understand and mine the complex relationships between nodes and edges in a graph. Graph data consists of nodes and edges; nodes represent entities or objects, and edges represent relationships between nodes. The simplest way to represent the graph structure is using an adjacency matrix, thus capturing the correlations between nodes and edges in the graph. Graph Neural Networks can better handle non-Euclidean data such as graph structures, avoiding the shortcomings of traditional neural networks in processing this type of data.

[0033] Graph Neural Networks (GNNs) are a type of connectivity model. Their core principle is to obtain dependencies in a graph through information exchange between nodes. GNNs update a node's state by looking at its neighbors at any depth. Currently, GNNs are generally classified into five main categories: Graph Convolution Networks (GCNs), Graph Attention Networks, Graph Autoencoders, Graph Generative Networks, and Graph Spatial-temporal Networks.

[0034] Graph Convolution Networks (GCNs)

[0035] Graph Convolutional Networks (GCNs) are deep learning models for processing graph-structured data. They generalize convolution operations from traditional data (such as images) to graph data. Essentially, they learn a function mapping f(.) through nodes v in the graph. i It can aggregate its own features x i With its neighbor features x j (j∈N(v i The node v generated by )) i Graph convolutional networks (GCNNs) provide novel representations with rich contextual information, enabling models to effectively understand and predict complex graph data. The core idea is to aggregate neighbor information of nodes through multiple layers of convolutional operations, thereby capturing the global structure and local features of the graph. GCNNs form the basis of many complex graph neural network models, including autoencoder-based models, generative models, and spatiotemporal networks.

[0036] Spatial-based GCN methods represent graph convolution as aggregating feature information from the neighborhood. While the graph convolutional network algorithm runs at the node level, the graph pooling module can be interleaved with the graph convolutional layers to coarsen the graph into higher-level substructures. This approach allows the model to progressively understand the complexity of the graph from the node level to higher-level substructures and generate more informative representations, thereby improving performance across various tasks.

[0037] AS Relationship Inference

[0038] AS (Autonomous System) relationship inference is a technique that infers data relationships based on routing policies between ASs to describe route declaration rules. Common AS roles include four main types: provider, client, peer, and sibling. Data relationships between two ASs are mainly categorized as: transport relationships (provider-client, client-provider), peer relationships, and sibling relationships. The valley-less principle is an abstraction of common economic strategies in networks, summarizing that routes from providers and peers can only be declared to clients, while the declaration of routes from clients is unrestricted. AS relationships are primarily used for inter-domain security detection, where the valley-less principle can be used to detect route leaks. However, AS relationships themselves are confidential, thus requiring a technique to infer these undisclosed data relationships. This technique plays a crucial role in detecting route leaks and maintaining the security of the global internet infrastructure.

[0039] The embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0040] This embodiment proposes an AS relation inference method based on graph neural networks, such as... Figure 1A As shown, the method includes:

[0041] Step 101: Convert the collected routing table messages into border gateway protocol graph structure data.

[0042] Step 102: Determine the AS organization mapping dataset, add organization information to the nodes in the graph structure data based on the AS organization mapping dataset, and pre-add edge labels to some edges in the graph structure data after adding organization information to obtain the Boundary Gateway Graph (BGP Graph).

[0043] Step 103: Extract node features from the boundary gateway graph and determine the original graph of the boundary gateway graph. Use a multidimensional graph convolutional network model to extract network topology information from the original graph. Then, fuse the node features and the network topology information through an attention mechanism to obtain a fusion result.

[0044] Step 104: Determine the imbalanced labels with and without edge labels in the boundary gateway graph, and train the multidimensional graph convolutional network model using a semi-supervised learning strategy based on the imbalanced labels and fusion results. Use the trained multidimensional graph convolutional network model to output the edge categories corresponding to the boundary gateway graph, and determine the AS relationship based on the edge categories.

[0045] The above scheme can process routing table messages into graph-structured data, aggregate node features using a multidimensional graph convolutional network model, and classify directed edges by adding labels. Based on the classified edge categories, the data relationships between ASs can be inferred. When the network topology changes, the parameters of the multidimensional graph convolutional network model can be dynamically adjusted, thus adapting to new network topology information and performing AS relationship inference, exhibiting good generalization ability.

[0046] In some embodiments, step 101 includes:

[0047] Step 1011: Download the routing table message from the public data collection platform RIPE according to the predetermined collection time.

[0048] In practice, routing table messages are downloaded from the publicly available data collection platform RIPE. The data collection period is set to the first three days of each month for routing table messages. Since the routing table messages are updated every 8 hours, a total of 9 message files can be collected within the collection window. If data for January 2023 needs to be collected, routing table data from 00:00 on January 1, 2023 to 23:59:59 on January 3, 2023 will be collected.

[0049] Step 1012: Use the border gateway processing tool to parse the format of the routing table message into a readable format to obtain a readable routing table message.

[0050] In practice, the border gateway processing (bgpdump) tool is used to parse the collected routing table messages from MRT format into a readable format.

[0051] Step 1013: Convert the readable routing table message data into graph structure data using the open-source graph deep learning framework DGL. The graph structure data includes nodes and directed edges between two adjacent nodes.

[0052] In practice, each file in the readable routing table message contains numerous BGP routing entries, and each entry contains an AS path leading to a specific network prefix. The entire routing table message data is traversed, with ASs translated into corresponding nodes. If two ASs are adjacent in at least one BGP route, a directed edge is constructed between them in the graph. Each node is weighted by the prefix counts initiated by that AS; a higher weight indicates that the AS possesses more prefixes. Furthermore, node V in the graph structure data also has an attribute named ASN that records the AS's ID.

[0053] In some embodiments, step 102 includes:

[0054] Step 1021: Obtain the AS organization mapping dataset corresponding to the collection time of the collected routing table packets, and add organization information to the nodes in the graph structure data based on the AS organization mapping dataset.

[0055] In practice, the AS-organization mapping dataset in CAIDA for the corresponding time period is obtained to add organizational information to the nodes belonging to the organization in the known graph structure data. Since sibling relationships only exist when two ASs belong to the same organization, this additional attribute increases the amount of information that the model can mine.

[0056] The collection time refers to the month corresponding to the time of the downloaded routing table message. For example, if the downloaded routing table message is data within the time range of 0:00 on January 1, 2023 to 23:59:59 on January 3, 2023, then the corresponding time is January 2023. That is, the AS-organization mapping dataset corresponding to January 2023 needs to be downloaded.

[0057] Step 1022: Input the routing table message into the AS_Rank algorithm model, the Problink algorithm model, and the Toposcope algorithm model respectively to obtain the first inference result output by the AS_Rank algorithm model, the second inference result output by the Problink algorithm model, and the third inference result output by the Toposcope algorithm model.

[0058] Step 1023: Select the consensus data of the first inference result, the second inference result, and the third inference result as the consensus result.

[0059] Step 1024: Determine the partial edges in the graph structure data after adding organizational information that correspond to the consensus result, and add edge labels to the partial edges in the graph structure data after adding organizational information according to the consensus result to obtain the boundary gateway graph.

[0060] In practice, since the consensus results do not include all business relationships between ASs, only some business relationships between ASs are included in the consensus results, only the edges corresponding to the edge types that exist in the consensus results are pre-labeled.

[0061] To maximize the reliability of existing edge labels, each edge type is represented as a unique vector, with the vector's dimension equal to the number of categories. This scheme ultimately yields a Boundary Gateway Graph (BGP graph) containing the above basic information.

[0062] In some embodiments, step 103 includes:

[0063] Step 1031: Determine the node feature map corresponding to the boundary gateway map, and extract node features using a multidimensional graph convolutional network model based on the node feature map to obtain node features, wherein each node feature corresponds to a node in the boundary gateway map.

[0064] Here, we use the k-nearest neighbor graph G generated from the node information in the boundary gateway graph. f As a node feature map, G f The adjacency matrix is ​​A f When performing adjacency information aggregation, the overall feature iteration formula is:

[0065]

[0066] in It is a normalized adjacency matrix. It is the adjacency matrix A f The degree matrix, H f i Let W represent the characteristic matrix of the i-th iteration. f i This is the hidden layer weight matrix at the i-th iteration. Finally, the output of the last layer of this GCN is represented as the node feature Z. F .

[0067] Step 1032: For the graph structure data after adding organizational information, use a multidimensional graph convolutional network model (such as...) Figure 1B (As shown) The network topology information is obtained by performing aggregation information processing, where each network topology information corresponds to a node in the boundary gateway map.

[0068] In practice, the original graph G obtained in step 1021 above, after adding organizational information, is used to represent the network topology graph. n Information aggregation is performed using a multidimensional graph convolutional network model, and the output network topology information Z of the last layer is obtained through a learning method similar to that of node feature maps. N .

[0069] Step 1033: The node features and network topology information corresponding to the adjacent nodes of each edge of the boundary gateway graph are spliced ​​and fused through an attention mechanism to obtain a fusion result.

[0070] In practice, it is necessary to make the node features and network topology information corresponding to each edge of the boundary gateway graph jointly represent the information mined in the boundary gateway graph. Therefore, an attention mechanism is introduced for fusion to represent the information at the corresponding node of the boundary gateway graph.

[0071] For the two node features Z F and network topology information Z N For a given node i, its representation in node characteristics and network topology information are respectively and Since the ultimate goal of this embodiment is to achieve edge classification, it is necessary to use the feature representations of the two nodes connected by an edge as the feature representation of the edge. The specific concatenation method is as follows: Figure 1C As shown, therefore, for a certain edge e, its two node features and They represent respectively and Introducing an attention mechanism to fuse two features can yield the following results: Weights in learning q represents the shared attention vector, T represents the matrix transpose, and W... F It is Z F The corresponding weight matrix, where b represents the bias. (The equation above is incomplete and requires further context.) Replace with You can get

[0072] Activated by softmax Similarly, we can obtain Therefore, the final edge feature (fusion result) is represented as Z = α N ·Z N +α F ·Z F .

[0073] In some embodiments, step 103 further includes:

[0074] Step 1034: Perform consistency constraint processing on the fusion result to obtain the optimization objective function corresponding to the multidimensional graph convolutional network model.

[0075] To ensure that the features learned by the multidimensional graph convolutional network model in the node feature graph and the structure graph of the network topology information are as similar as possible, a consistency constraint is introduced, defining two nodes x i x jThe cosine similarity is The output Z of the two graph convolutions F and Z N Using their similarity matrix S N and S F Similarity is used as a consistency constraint, and the loss function is defined as Γ. c =||S T -S F || 2 .

[0076] Since the ultimate goal is to perform a multi-class classification task on edges, a softmax classifier is designed to output the predicted probability values ​​for various edge categories, thereby determining the category label of the edge. W represents the weight matrix, Z represents the feature matrix, and b represents the bias. The output edge category label, such as 0, 1, 2, ...

[0077] Calculate the loss using the cross-entropy loss function. E represents the set of edges, e represents the edges taken out of it, C represents the set of edge categories, and Y represents the set of edge categories. e Indicates the edge category that already has a label. This represents the edge class of edge e output by the softmax classifier.

[0078] The objective function for model optimization is now Γ=Γ t +γΓ c , where γ is the hyperparameter corresponding to the consistency constraint.

[0079] In some embodiments, step 104 utilizes surrogate side labels to improve the learning effect under imbalanced data conditions: Since pre-labels cannot guarantee that the distribution of categories is balanced and meets the actual situation, it is necessary to consider the impact of imbalanced data on semi-supervised learning. Therefore, the information value that unlabeled data can provide in the classification case is considered, that is, surrogate labels are generated for some unlabeled data (i.e. features without side labels) according to the classification results, and the loss function of surrogate side labels is added to the optimized objective function to improve learning.

[0080] Step 104 specifically includes:

[0081] Step 1041: Train the multidimensional graph convolutional network model using the fusion result of the edges with edge labels in the boundary gateway graph, and continuously calculate the optimization target value based on the optimization objective function during the training process. Update the parameter weights of the multidimensional graph convolutional network model according to the optimization target value to obtain the first multidimensional graph convolutional network model after training.

[0082] Step 1042: Use the first multi-dimensional graph convolutional network model to assign corresponding proxy edge labels to the edges without edge labels in the border gateway graph, and mix the fusion results of the edges with proxy edge labels and the fusion results of the edges with edge labels to obtain a mixed result.

[0083] Step 1043: Use the mixed result to continue training the first multi-dimensional graph convolutional network model, calculate the first error of the fusion result of the edges with proxy edge labels and the second error of the fusion result of the edges with edge labels using the optimization objective function, and determine the loss function value based on the first error and the second error.

[0084] Step 1044: Adjust the parameters of the first multi-dimensional graph convolutional network model based on the loss function value.

[0085] Since proxy edge labels are added, at this time, it is necessary to separately calculate the losses of the errors of the fusion results of the edges with edge labels and the errors of the fusion results of the edges with proxy edge labels. The target optimization function is as follows where n represents the number of edges with labeled edge labels, n' represents the number of edges with proxy edge labels, m represents the value taken from n or n', f represents the output of the first multi-dimensional graph convolutional network model, represents the cross-entropy loss function value of the edges with labeled edge labels, represents the cross-entropy loss function value of the edges with proxy edge labels.

[0086] However, in order to balance the contributions of the errors (i.e., loss values) of the edges with proxy edge labels and the errors (i.e., loss values) of the edges with edge labels to the loss, α(t) is introduced, and its formula is expressed as:

[0087]

[0088] α f represents the maximum weight, T1 and T2 respectively represent two stages. When t < T1, it is the initial stage, and the edges with proxy edge labels do not participate in the evaluation of the loss value. At this time, the first multi-dimensional graph convolutional network model is completely trained through the edges with labeled edge labels. When t > T2, it is the fine-tuning stage, and the edges with proxy edge labels participate in the training of the first multi-dimensional graph convolutional network model through a maximum weight αf. When in the intermediate stage, that is, T1 <= t <= T2, the weight of the loss value of the edges with proxy edge labels is gradually increased.

[0089] As the training time increases, α(t) will linearly grow from zero to a certain saturation value α f , and the edges corresponding to the proxy edge labels will also be gradually released. Here, the Adam optimizer is used to update the parameters of the first multi-dimensional graph convolutional network model to reduce the loss function.

[0090] Step 1045: Based on the fusion result of the edges without edge labels, the adjusted first multidimensional graph convolutional network model is used to continuously assign corresponding proxy edge labels until all edges without edge labels are assigned corresponding proxy edge labels.

[0091] Step 1046: Determine the edge category based on the proxy edge label and the original edge label, convert the edge category into the form of AS, and map the node number corresponding to the boundary gateway graph to the AS.

[0092] Step 1047: Find the AS relationship corresponding to the edge category based on the node attributes in the graph structure data.

[0093] In practice, based on the category of the obtained directed edges (i.e. the edge category corresponding to the boundary gateway graph), it is also necessary to convert them into the form of AS1|AS2|relationship. This involves the mapping between node number and ASN. The corresponding ASN is found using the node attribute named "ASN" stored when constructing the boundary gateway graph, and the corresponding AS relationship (e.g., AS business relationship) is restored based on the edge category as the output.

[0094] Current methods for AS relationship inference rely on assumptions about the internet hierarchy and use heuristics for inference, which can easily lead to unbounded errors. Furthermore, with the rapid development of the internet and the increasing flattening of hierarchical structures, the previously heavily relied-upon hierarchical assumptions and empirical rules are no longer applicable. In addition, existing deep learning-based algorithms attempt to embed ASNs into low-dimensional vector spaces for classification using neural networks, but they can only achieve the most basic relationship inference with mediocre performance and lack strong interpretability. Therefore, this method is the first to attempt AS relationship inference using graph neural networks, representing a novel approach.

[0095] This method describes an AS (Alternate Server) relationship inference algorithm based on graph neural networks. First, it uses the consensus results of several classic data relationship inference algorithms as edge labels for some AS relationships. Then, it extracts organization information from the CAIDA AS-organization mapping dataset as a reference condition for whether two ASs can be siblings. This method processes BGP path information into graph structure data, uses a graph convolutional network of a graph neural network to aggregate adjacency information and classify directed edges (i.e., edge categories). Based on the classification probability values, the data relationship between ASs can be inferred. When the Internet topology (i.e., network topology information) changes, the parameters of the generation algorithm can be dynamically adjusted, thus adapting to new Internet topologies for AS relationship inference, resulting in good generalization ability.

[0096] It should be noted that the method in this embodiment can be executed by a single device, such as a computer or server. The method can also be applied in a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the method in this embodiment, and the multiple devices will interact with each other to complete the method described.

[0097] It should be noted that the above description describes some embodiments of this application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the above embodiments and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0098] Based on the same inventive concept, corresponding to any of the above embodiments, this application also provides an AS relation inference device based on graph neural networks.

[0099] refer to Figure 2 The device includes:

[0100] Graph structure conversion module 21 is configured to convert the collected routing table messages into graph structure data of the Border Gateway Protocol;

[0101] The edge label generation module 22 is configured to determine the AS organization mapping dataset, add organization information to the nodes in the graph structure data based on the AS organization mapping dataset, and pre-add edge labels to some edges in the graph structure data after adding organization information to obtain the boundary gateway graph.

[0102] The feature extraction and fusion module 23 is configured to extract node features from the boundary gateway map, determine the original graph of the boundary gateway map, extract network topology information from the original graph using a multidimensional graph convolutional network model, and fuse the node features and the network topology information through an attention mechanism to obtain a fusion result.

[0103] AS relation transformation module 24 is configured to determine the imbalanced labels with and without edge labels in the boundary gateway graph, and to train the multidimensional graph convolutional network model using a semi-supervised learning strategy based on the imbalanced labels and fusion results. The trained multidimensional graph convolutional network model outputs the edge categories corresponding to the boundary gateway graph, and determines the AS relation based on the edge categories.

[0104] In some embodiments, the graph structure conversion module 21 is further configured to:

[0105] Download routing table messages from the publicly available data collection platform RIPE according to the scheduled collection time;

[0106] The routing table message is parsed into a readable format using a border gateway processing tool to obtain a readable routing table message.

[0107] The readable routing table message data is converted into graph structure data using the open-source graph deep learning framework DGL. The graph structure data includes nodes and directed edges between two adjacent nodes.

[0108] In some embodiments, the side label generation module 22 is further configured to:

[0109] Obtain the AS organization mapping dataset corresponding to the collection time of the collected routing table packets, and add organization information to the nodes in the graph structure data based on the AS organization mapping dataset;

[0110] The routing table message is input into the AS_Rank algorithm model, the Problink algorithm model, and the Toposcope algorithm model respectively to obtain the first inference result output by the AS_Rank algorithm model, the second inference result output by the Problink algorithm model, and the third inference result output by the Toposcope algorithm model.

[0111] The consensus data of the first inference result, the second inference result, and the third inference result are selected as the consensus result;

[0112] Identify the edges in the graph structure data after adding organizational information that correspond to the consensus result, and add edge labels to the edges in the graph structure data after adding organizational information according to the consensus result to obtain the boundary gateway graph.

[0113] In some embodiments, the feature extraction and fusion module 23 is further configured to:

[0114] Determine the node feature map corresponding to the boundary gateway map, and use a multidimensional graph convolutional network model to extract node features based on the node feature map to obtain node features, wherein each node feature corresponds to a node in the boundary gateway map;

[0115] For the graph structure data after adding organizational information, a multidimensional graph convolutional network model is used to aggregate the information to obtain network topology information, where each piece of network topology information corresponds to a node in the boundary gateway graph;

[0116] The node features and network topology information corresponding to the adjacent nodes of each edge of the boundary gateway graph are spliced ​​and fused using an attention mechanism to obtain the fusion result.

[0117] In some embodiments, the feature extraction and fusion module 23 is further configured to:

[0118] The fusion result is subjected to consistency constraint processing to obtain the optimization objective function corresponding to the multidimensional graph convolutional network model.

[0119] In some embodiments, the AS relationship conversion module 24 is further configured to:

[0120] The multidimensional graph convolutional network model is trained using the fusion result of the edges with edge labels in the boundary gateway graph. During the training process, the optimization objective value is continuously calculated based on the optimization objective function. The parameter weights of the multidimensional graph convolutional network model are continuously updated according to the optimization objective value to obtain the first multidimensional graph convolutional network model after training.

[0121] The first multidimensional graph convolutional network model is used to assign corresponding proxy edge labels to the edges without edge labels in the boundary gateway graph. The fusion result of the edges with proxy edge labels and the fusion result of the edges with edge labels are mixed to obtain a fusion result.

[0122] The first multidimensional graph convolutional network model is further trained using the fusion result. The first error of the fusion result of the surrogate edge label and the second error of the fusion result of the edge with edge label are calculated using the optimization objective function. The loss function value is determined based on the first error and the second error.

[0123] The parameters of the first multidimensional graph convolutional network model are adjusted based on the loss function value;

[0124] Based on the fusion results of edges without edge labels, the adjusted first multidimensional graph convolutional network model is continuously used to assign corresponding proxy edge labels until all edges without edge labels are assigned corresponding proxy edge labels.

[0125] The edge category is determined based on the proxy edge label and the original edge label, the edge category is converted into the form of AS, and the node number corresponding to the boundary gateway graph is mapped to the AS.

[0126] Find the AS relationship corresponding to the edge category based on the node attributes in the graph structure data.

[0127] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, in implementing this application, the functions of each module can be implemented in one or more software and / or hardware.

[0128] The apparatus of the above embodiments is used to implement the corresponding method in any of the foregoing embodiments and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0129] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the methods described in any of the above embodiments.

[0130] Figure 3 This embodiment illustrates a more specific hardware structure of an electronic device, which may include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, memory 1020, input / output interface 1030, and communication interface 1040 are interconnected internally via the bus 1050.

[0131] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0132] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0133] The input / output interface 1030 is used to connect input / output modules to realize information input and output. Input / output modules can be configured as components within the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touchscreens, microphones, various sensors, etc., while output devices may include displays, speakers, vibrators, indicator lights, etc.

[0134] The communication interface 1040 is used to connect a communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0135] Bus 1050 includes a pathway for transmitting information between various components of the device, such as processor 1010, memory 1020, input / output interface 1030, and communication interface 1040.

[0136] It should be noted that although the above-described device only shows the processor 1010, memory 1020, input / output interface 1030, communication interface 1040, and bus 1050, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures.

[0137] The electronic devices described above are used to implement the corresponding methods in any of the foregoing embodiments and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0138] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this application also provides a non-transitory computer-readable storage medium that stores computer instructions for causing the computer to perform the methods described in any of the above embodiments.

[0139] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0140] The computer instructions stored in the storage medium of the above embodiments are used to cause the computer to perform the methods described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0141] Based on the same concept, corresponding to any of the above embodiments, this application also provides a computer program product, including computer program instructions, which, when run on a computer, cause the computer to perform the method described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0142] It is understood that before using the technical solutions of the various embodiments in this disclosure, users will be informed of the type, scope of use, and usage scenarios of the personal information involved in an appropriate manner, and user authorization will be obtained.

[0143] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose, based on the prompt message, whether to provide personal information to the software or hardware such as electronic devices, applications, servers, or storage media performing the operations of this disclosed technical solution.

[0144] As an optional but not limited implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0145] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0146] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this application (including the claims) is limited to these examples; within the framework of this application, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this application as described above, which are not provided in the details for the sake of brevity.

[0147] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of this application, the well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided drawings. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of this application, and this also takes into account the fact that the details of the implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of this application will be implemented (i.e., these details should be fully understood by those skilled in the art). While specific details (e.g., circuits) have been set forth to describe exemplary embodiments of this application, it will be apparent to those skilled in the art that the embodiments of this application can be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0148] Although this application has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0149] The embodiments of this application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the embodiments of this application should be included within the protection scope of this application.

Claims

1. An AS relation inference method based on graph neural networks, characterized in that, include: The collected routing table messages are converted into border gateway protocol graph structure data; Determine the AS organization mapping dataset, add organization information to the nodes in the graph structure data based on the AS organization mapping dataset, and pre-add edge labels to some edges in the graph structure data after adding organization information to obtain the boundary gateway graph. Node features are extracted from the boundary gateway graph, and the original graph of the boundary gateway graph is determined. A multidimensional graph convolutional network model is used to extract network topology information from the original graph. The node features and the network topology information are fused through an attention mechanism to obtain a fusion result. The imbalanced labels with and without edge labels in the boundary gateway graph are determined, and a multidimensional graph convolutional network model is trained using a semi-supervised learning strategy based on the imbalanced labels and fusion results. The trained multidimensional graph convolutional network model outputs the edge categories corresponding to the boundary gateway graph, and the AS relationship is determined based on the edge categories. The process involves determining imbalanced labels (with and without edge labels) in the boundary gateway graph, training a multidimensional graph convolutional network model using a semi-supervised learning strategy based on the imbalanced labels and the fusion results, and using the trained multidimensional graph convolutional network model to output the edge categories corresponding to the boundary gateway graph. The AS relationship is then determined based on these edge categories, including: The multidimensional graph convolutional network model is trained using the fusion result of the edges with edge labels in the boundary gateway graph. During the training process, the optimization objective value is continuously calculated based on the optimization objective function. The parameter weights of the multidimensional graph convolutional network model are continuously updated according to the optimization objective value to obtain the first multidimensional graph convolutional network model after training. The first multidimensional graph convolutional network model is used to assign corresponding proxy edge labels to the edges without edge labels in the boundary gateway graph. The fusion result of the edges with proxy edge labels and the fusion result of the edges with edge labels are mixed to obtain a fusion result. The first multidimensional graph convolutional network model is further trained using the fusion result. The first error of the fusion result of the surrogate edge label and the second error of the fusion result of the edge with edge label are calculated using the optimization objective function. The loss function value is determined based on the first error and the second error. The parameters of the first multidimensional graph convolutional network model are adjusted based on the loss function value; Based on the fusion results of edges without edge labels, the adjusted first multidimensional graph convolutional network model is continuously used to assign corresponding proxy edge labels until all edges without edge labels are assigned corresponding proxy edge labels. The edge category is determined based on the proxy edge label and the original edge label, the edge category is converted into the form of AS, and the node number corresponding to the boundary gateway graph is mapped to the AS. Find the AS relationship corresponding to the edge category based on the node attributes in the graph structure data.

2. The method according to claim 1, characterized in that, The conversion of the collected routing table messages into border gateway protocol graph structure data includes: Download routing table messages from the publicly available data collection platform RIPE according to the scheduled collection time; The routing table message is parsed into a readable format using a border gateway processing tool to obtain a readable routing table message. The readable routing table message data is converted into graph structure data using the open-source graph deep learning framework DGL. The graph structure data includes nodes and directed edges between two adjacent nodes.

3. The method according to claim 1, characterized in that, The process of determining the AS organization mapping dataset, adding organization information to nodes in the graph structure data based on the AS organization mapping dataset, and adding edge labels to some edges in the graph structure data after adding organization information to obtain a boundary gateway graph includes: Obtain the AS organization mapping dataset corresponding to the collection time of the collected routing table packets, and add organization information to the nodes in the graph structure data based on the AS organization mapping dataset; The routing table message is input into the AS_Rank algorithm model, the Problink algorithm model, and the Toposcope algorithm model respectively to obtain the first inference result output by the AS_Rank algorithm model, the second inference result output by the Problink algorithm model, and the third inference result output by the Toposcope algorithm model. The consensus data of the first inference result, the second inference result, and the third inference result are selected as the consensus result; Identify the edges in the graph structure data after adding organizational information that correspond to the consensus result, and add edge labels to the edges in the graph structure data after adding organizational information according to the consensus result to obtain the boundary gateway graph.

4. The method according to claim 3, characterized in that, The process of extracting node features from the boundary gateway map and determining the original graph of the boundary gateway map, extracting network topology information from the original graph using a multidimensional graph convolutional network model, and fusing the node features and the network topology information through an attention mechanism to obtain a fusion result includes: Determine the node feature map corresponding to the boundary gateway map, and use a multidimensional graph convolutional network model to extract node features based on the node feature map to obtain node features, wherein each node feature corresponds to a node in the boundary gateway map; For the graph structure data after adding organizational information, a multidimensional graph convolutional network model is used to aggregate the information to obtain network topology information, where each piece of network topology information corresponds to a node in the boundary gateway graph; The node features and network topology information corresponding to the adjacent nodes of each edge of the boundary gateway graph are spliced ​​and fused using an attention mechanism to obtain the fusion result.

5. The method according to claim 4, characterized in that, Also includes: The fusion result is subjected to consistency constraint processing to obtain the optimization objective function corresponding to the multidimensional graph convolutional network model.

6. An AS relation inference device based on graph neural networks, characterized in that, include: The graph structure conversion module is configured to convert the collected routing table messages into graph structure data for the Border Gateway Protocol. The edge label generation module is configured to determine the AS organization mapping dataset, add organization information to the nodes in the graph structure data based on the AS organization mapping dataset, and pre-add edge labels to some edges in the graph structure data after adding organization information to obtain the boundary gateway graph. The feature extraction and fusion module is configured to extract node features from the boundary gateway graph, determine the original graph of the boundary gateway graph, extract network topology information from the original graph using a multidimensional graph convolutional network model, and fuse the node features and the network topology information through an attention mechanism to obtain a fusion result. The AS relationship transformation module is configured to determine the imbalanced labels with and without edge labels in the boundary gateway graph, and to train the multidimensional graph convolutional network model using a semi-supervised learning strategy based on the imbalanced labels and fusion results. The trained multidimensional graph convolutional network model outputs the edge categories corresponding to the boundary gateway graph, and determines the AS relationship based on the edge categories. The AS relation transformation module is specifically configured as follows: The multidimensional graph convolutional network model is trained using the fusion result of the edges with edge labels in the boundary gateway graph. During the training process, the optimization objective value is continuously calculated based on the optimization objective function. The parameter weights of the multidimensional graph convolutional network model are continuously updated according to the optimization objective value to obtain the first multidimensional graph convolutional network model after training. The first multidimensional graph convolutional network model is used to assign corresponding proxy edge labels to the edges without edge labels in the boundary gateway graph. The fusion result of the edges with proxy edge labels and the fusion result of the edges with edge labels are mixed to obtain a fusion result. The first multidimensional graph convolutional network model is further trained using the fusion result. The first error of the fusion result of the surrogate edge label and the second error of the fusion result of the edge with edge label are calculated using the optimization objective function. The loss function value is determined based on the first error and the second error. The parameters of the first multidimensional graph convolutional network model are adjusted based on the loss function value; Based on the fusion results of edges without edge labels, the adjusted first multidimensional graph convolutional network model is continuously used to assign corresponding proxy edge labels until all edges without edge labels are assigned corresponding proxy edge labels. The edge category is determined based on the proxy edge label and the original edge label, the edge category is converted into the form of AS, and the node number corresponding to the boundary gateway graph is mapped to the AS. Find the AS relationship corresponding to the edge category based on the node attributes in the graph structure data.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1 to 5.

9. A computer program product comprising computer program instructions, characterized in that, When the computer program instructions are executed on a computer, the computer causes the computer to perform the method as described in any one of claims 1 to 5.

Images