Intelligent routing selection method, system, medium and device

Abstract

The present invention discloses an intelligent routing selection method, system, medium and device, wherein the method comprises a security scoring unit, a comprehensive scoring unit and a routing table updating unit, wherein the security scoring unit is connected to the comprehensive scoring unit in communication, and the comprehensive scoring unit is connected to the routing table updating unit in communication. The present invention generates a comprehensive routing priority score by performing a security assessment on routing nodes and combining the priority score in static routing to ensure that in the routing selection process, not only the communication efficiency of the node is considered, but also its security is fully assessed, and finally a routing path that is both efficient and secure is selected.

Description

Technical Field

[0001] The present invention relates to the field of routing technology, in particular to an intelligent routing selection method, system, medium and equipment. Background Art

[0002] In today's network environment, with the continuous evolution of various complex attack methods, network security issues have become particularly prominent. As the basic technology of network communication, static routing selection has excellent performance in stability and efficiency, but has significant deficiencies in security. Traditional static routing selection methods usually only determine the routing path based on a preset priority score, ignoring the assessment of the security of network nodes, and thus cannot effectively guarantee the security of routing when the network is subjected to multiple attacks. This problem is particularly prominent when facing complex network threats such as distributed denial of service (DDoS) attacks, address resolution protocol (ARP) spoofing, password attacks, and IP address hijacking attacks.

[0003] At present, there are some technical solutions that attempt to enhance network security by introducing dynamic routing selection or adding additional security mechanisms. However, these solutions often rely on dynamic topology adjustment of the network or complex security protocol implementation, which increases system complexity and operation and maintenance costs, and performs poorly when dealing with specific attack scenarios in static network environments. However, these dynamic routing protocols require frequent exchange of routing information, which may introduce additional network overhead and latency in large-scale networks. In addition, although some solutions improve network security by adding simple security checks to routing selection, these methods mostly rely on static rules and cannot effectively deal with increasingly complex attack methods, especially when the attack behavior is dynamic and diverse.

[0004] Existing static routing selection methods mainly rely on preset priority scores to determine routing paths. Although this method performs well in terms of stability and efficiency, it has obvious shortcomings in dealing with network security threats. First, traditional static routing lacks an assessment of the security status of network nodes, resulting in the inability to ensure the security of routing selection in the face of a variety of complex attacks (such as DDoS attacks, ARP spoofing, password attacks, and IP address hijacking). Due to the diversity and dynamism of these attack methods, the security status of network nodes will continue to change, and existing technologies cannot reflect these changes in real time, resulting in static routing in some cases may select nodes that are under attack, thereby increasing the security risk of the entire network.

[0005] Furthermore, even if some existing technologies try to improve security by introducing dynamic routing or adding simple security mechanisms, such methods either require frequent network topology adjustments, increasing system complexity and maintenance costs, or rely solely on static security rules and cannot effectively respond to dynamically changing attack behaviors. This shows that existing static routing selection methods have inherent defects in security assessment and cannot adapt to the increasingly complex threat landscape in modern network environments. Summary of the invention

[0006] To this end, the technical problem to be solved by the present invention is to provide an intelligent routing selection method, system, medium and device, which generates a comprehensive routing priority score by performing a security assessment on the routing nodes and combining the priority score in the static routing to ensure that in the routing selection process, not only the communication efficiency of the node is considered, but also its security is fully evaluated, and finally a routing path that is both efficient and secure is selected.

[0007] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0008] An intelligent routing selection method comprises the following steps:

[0009] S100) Perform security assessment on each route in the routing network. The specific steps are as follows:

[0010] S101) Collecting traffic data on each routing node;

[0011] S102) classifying and preprocessing the traffic data collected in step S101), wherein the preprocessing includes data cleaning, feature extraction and category labeling;

[0012] S103) inputting the pre-processed traffic data into different analysis and detection models according to categories for analysis and detection; wherein the analysis and detection models include DDoS attack analysis and detection models, ARP spoofing attack analysis and detection models, password attack analysis and detection models and IP address hijacking attack analysis and detection models;

[0013] S104) performing standardization processing on the analysis and detection results obtained in step S103) and outputting a probability value, calculating the average value of the probability values ​​outputted cumulatively n times and sorting the average values ​​of the probability values ​​according to their size, and the method adopted for the standardization processing is the Min-Max standardization method; wherein n is an integer greater than or equal to 50;

[0014] S105) Calculate the security score of each routing node. The specific formula is as follows:

[0015]

[0016] In the formula, is the probability value of DDoS attack; is the probability value of ARP spoofing attack; is the probability value of password attack; is the probability value of IP address hijacking attack;

[0017] Index j, index k, index l, and index m are all positive numbers greater than 0, and their values ​​are determined according to the following strategy:

[0018] According to the result of sorting the average values ​​of the probability values ​​obtained in step S104), the value range of the index associated with the average value of the first-ranked probability value is (0.25, 0.5], the value range of the index associated with the average value of the second-ranked probability value is (0.5, 1], the value range of the index associated with the average value of the third-ranked probability value is (1, 2], and the value range of the index associated with the average value of the fourth-ranked probability value is (2, 3];

[0019] S200) couples the security score obtained in step S100) with the priority score of each routing node in the static route, calculates the comprehensive score of each routing node, and selects the routing path based on the comprehensive score; wherein the comprehensive score is calculated by the following formula:

[0020]

[0021] Where e is a natural constant; Pref is the priority score of a routing node in the routing table of other routing nodes.

[0022] In the above intelligent routing selection method, the probability value output by the normalization process ranges from 0 to 1.

[0023] In the above intelligent routing selection method, in step S104), the average value of the probability value is a square average.

[0024] In the above intelligent routing selection method, the index j, index k, index l and index m are determined according to the following strategy:

[0025] According to the result of sorting the average values ​​of the probability values ​​obtained in step S104), the value range of the index related to the average value of the first-ranked probability value is (0.25, 0.3], the value range of the index related to the average value of the second-ranked probability value is [0.8, 1], the value range of the index related to the average value of the third-ranked probability value is [1.5, 2], and the value range of the index related to the average value of the fourth-ranked probability value is [2.5, 3].

[0026] In the above intelligent routing selection method, in step S101), when collecting traffic data on each routing node, data collection is performed according to the type of traffic data required by each analysis and detection model.

[0027] In the above intelligent routing selection method, in step S200), when selecting a routing path based on the comprehensive score, the routing table in each routing node is first updated based on the comprehensive score, and then data is transmitted based on the updated routing table.

[0028] A system for performing route selection using the above intelligent route selection method, comprising:

[0029] A security scoring unit is used to perform security scoring on each routing node; the security scoring unit includes a data acquisition module, a data processing module, an analysis and detection model module, a standardization processing module and a security scoring calculation module, the data acquisition module is communicatively connected to the data processing module, the data processing module is communicatively connected to the analysis and detection model module, the analysis and detection model module is communicatively connected to the standardization processing module, and the standardization processing module is communicatively connected to the security scoring module;

[0030] A comprehensive scoring unit, used to comprehensively score each routing node using the security score and priority score of the routing node;

[0031] A routing table updating unit, used for updating the routing table in each routing node according to the comprehensive score;

[0032] The security scoring unit is communicatively connected to the comprehensive scoring unit, and the comprehensive scoring unit is communicatively connected to the routing table updating unit.

[0033] The above system, the analysis and detection model module includes a DDoS attack analysis and detection model module, an ARP spoofing attack analysis and detection model module, a password attack analysis and detection model module and an IP address hijacking attack analysis and detection model module.

[0034] A computer-readable storage medium stores a computer program, which implements the above-mentioned intelligent routing selection method when executed by a processor.

[0035] The computer device comprises a readable storage medium, a processor and a computer program stored in the readable storage medium and executable on the processor, wherein the computer program implements the above-mentioned intelligent routing selection method when executed by the processor.

[0036] The technical solution of the present invention achieves the following beneficial technical effects:

[0037] 1. The present invention significantly improves the security of static routing selection, making it more flexible and effective in protecting the overall security of the network when facing various network attacks.

[0038] 2. The present invention can effectively consider security factors in the static route selection process, avoid selecting unsafe nodes when facing potential network attacks, and thus improve the overall security of the network.

[0039] 3. The present invention can significantly improve the security and robustness of routing selection without affecting network performance.

[0040] 4. The present invention monitors and evaluates the security of each routing node by introducing multiple attack detection models, generates a security score between 0 and 1, and couples the score with the priority score in static routing to form a comprehensive score. This comprehensive score not only takes into account the topological location and traditional priority factors of the node, but also incorporates its security into the decision-making basis. Therefore, when making route selection, it can effectively avoid directing traffic to nodes with potential security risks, greatly improving the overall security and stability of the network.

[0041] 5. The design of the present invention also takes into account the efficiency and practicality of the system. The model accurately identifies and evaluates various types of attacks, ensuring the reliability of the security score. The innovative way of combining this score with the priority score not only simplifies the complexity of routing selection, but also ensures the applicability of the algorithm in the real network environment. Therefore, while improving network security, the present invention still maintains good performance and practical application value, fully demonstrating its superiority.

[0042] 6. The present invention enhances the sensitivity of the intelligent routing system to potential threats by introducing differentiated processing of different attack probability values, so that when facing vulnerable nodes, the probability value of related attacks accounts for a larger proportion in the security score. This ensures that the system can timely reflect changes in the network environment, optimize routing selection strategies, and reduce the risk of misjudgment, thereby significantly improving the security and adaptability of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a working principle diagram of the intelligent routing selection system in the present invention;

[0044] Figure 2 A flow chart of intelligent routing selection in the present invention;

[0045] Figure 3 A schematic diagram of a computer device capable of intelligent routing. DETAILED DESCRIPTION

[0046] The present invention is further described below with reference to examples.

[0047] like Figure 1 As shown, the intelligent routing selection system in the present invention includes a security scoring unit, a comprehensive scoring unit and a routing table updating unit. The security scoring unit is communicatively connected to the comprehensive scoring unit, and the comprehensive scoring unit is communicatively connected to the routing table updating unit.

[0048] Among them, the security scoring unit is used to perform security scoring on each routing node; the security scoring unit includes a data acquisition module, a data processing module, an analysis and detection model module, a standardization processing module and a security scoring calculation module, the data acquisition module is communicatively connected to the data processing module, the data processing module is communicatively connected to the analysis and detection model module, the analysis and detection model module is communicatively connected to the standardization processing module, and the standardization processing module is communicatively connected to the security scoring module. In this embodiment, the analysis and detection model module includes a DDoS attack analysis and detection model module, an ARP spoofing attack analysis and detection model module, a password attack analysis and detection model module and an IP address hijacking attack analysis and detection model module; the comprehensive scoring unit is used to perform a comprehensive scoring on each routing node using the security score and priority score of the routing node; the routing table updating unit is used to update the routing table in each routing node according to the comprehensive score.

[0049] like Figure 2 As shown, the intelligent routing selection system is used for routing selection, and the specific steps are as follows:

[0050] S100) Perform security assessment on each route in the routing network. The specific steps are as follows:

[0051] S101) Collecting traffic data on each routing node;

[0052] S102) classifying and preprocessing the traffic data collected in step S101), wherein the preprocessing includes data cleaning, feature extraction and category labeling;

[0053] S103) inputting the pre-processed traffic data into different analysis and detection models according to categories for analysis and detection;

[0054] S104) normalizing the analysis and detection results obtained in step S103) and outputting a probability value, calculating the average value of the probability values ​​outputted cumulatively n times and sorting the average values ​​of the probability values ​​according to their size, and the method adopted for the normalization is the Min-Max normalization method; wherein n is an integer greater than or equal to 50, and in the present invention, preferably 100;

[0055] S105) Calculate the security score of each routing node. The specific formula is as follows:

[0056]

[0057] In the formula, is the probability value of DDoS attack; is the probability value of ARP spoofing attack; is the probability value of password attack; is the probability value of IP address hijacking attack;

[0058] Index j, index k, index l, and index m are all positive numbers greater than 0, and their values ​​are determined according to the following strategy:

[0059] According to the result of sorting the average values ​​of the probability values ​​obtained in step S104), the value range of the index associated with the average value of the first-ranked probability value is (0.25, 0.5], the value range of the index associated with the average value of the second-ranked probability value is (0.5, 1], the value range of the index associated with the average value of the third-ranked probability value is (1, 2], and the value range of the index associated with the average value of the fourth-ranked probability value is (2, 3];

[0060] S200) couples the security score obtained in step S100) with the priority score of each routing node in the static route, calculates the comprehensive score of each routing node, and selects the routing path based on the comprehensive score.

[0061] The priority score used in the comprehensive scoring of a routing node is the priority score of the routing node in the routing table of the previous hop routing node.

[0062] In some usage scenarios where a more subtle response to a certain attack is required, the values ​​of index j, index k, index l, and index m are determined according to the following strategy:

[0063] According to the result of sorting the average values ​​of the probability values ​​obtained in step S104), the value range of the index related to the average value of the first-ranked probability value is (0.25, 0.3], the value range of the index related to the average value of the second-ranked probability value is [0.8, 1], the value range of the index related to the average value of the third-ranked probability value is [1.5, 2], and the value range of the index related to the average value of the fourth-ranked probability value is [2.5, 3].

[0064] The purpose of increasing the difference between two adjacent numbers of index j, index k, index l and index m is to make the security score more subtle and accurate in responding to the impact of a certain attack, and further ensure the security of the routing path.

[0065] As for the usage scenario of the intelligent routing selection system in the first use invention, the historical traffic data of the scenario or a scenario similar to the scenario can be used to train the DDoS attack analysis and detection model, the ARP spoofing attack analysis and detection model, the password attack analysis and detection model and the IP address hijacking attack analysis and detection model, and at the same time, it can be known which type of attack accounts for a higher proportion in the scenario, so as to pay more attention to this type of attack when scoring the security.

[0066] After the intelligent routing selection system of the present invention has been used for a period of time, the intelligent routing selection system can adjust the values ​​of index j, index k, index l and index m according to the average value change of the probability values ​​of various attacks in the historical traffic data, and can also be adjusted by the user.

[0067] In this embodiment, the analysis and detection models used include the DDoS attack analysis and detection model in the DDoS attack analysis and detection model module, the ARP spoofing attack analysis and detection model in the ARP spoofing attack analysis and detection model module, the password attack analysis and detection model in the password attack analysis and detection model module, and the IP address hijacking attack analysis and detection model in the IP address hijacking attack analysis and detection model module. The machine learning model used by the DDoS attack analysis and detection model is a random forest model, the machine learning model used by the ARP spoofing attack analysis and detection model is a K-nearest neighbor algorithm model, the machine learning model used by the password attack analysis and detection model is a logistic regression model, and the machine learning model used by the IP address hijacking attack analysis and detection model is an anomaly detection algorithm model.

[0068] And in step S101), when collecting the flow data on each routing node, data collection is performed according to the flow data type required by each analysis and detection model.

[0069] In step S200), the comprehensive score is calculated by the following formula:

[0070]

[0071] Where e is a natural constant; Pref is the priority score of a routing node in the routing table of other routing nodes.

[0072] After calculating the comprehensive score of each routing node, when selecting a routing path based on the comprehensive score, the routing table in each routing node is first updated based on the comprehensive score, and then data is transmitted based on the updated routing table.

[0073] Specifically, in the present invention, the traffic capture tool Wireshark is first used to obtain traffic data from each routing node in the static routing network, and then the traffic data is classified and preprocessed, and the preprocessed traffic data is input into the DDoS attack analysis and detection model, the ARP spoofing attack analysis and detection model, the password attack analysis and detection model, and the IP address hijacking attack analysis and detection model to achieve the discrimination of four different router attacks. Among them, the different types of traffic data captured by Wireshark for each analysis and detection model are as follows:

[0074] (1) DDoS attack: traffic rate, packet size, and number of connections;

[0075] (2) ARP spoofing attack: number of ARP packets, ARP packet frequency, source and destination MAC address distribution;

[0076] (3) Password attacks: number of login attempts per hour, login success rate, and IP address distribution;

[0077] (4) IP address hijacking attack: IP address usage, IP address allocation change records, and source records.

[0078] The four analysis and detection models analyze and detect the traffic data obtained by Wireshark in a timely manner, and the results are standardized after each model, and the probability value between 0 and 1 is output, wherein the closer the probability value is to 0, the less susceptible the routing node is to a certain attack, and vice versa, it means that it is susceptible to a certain attack. When the more susceptible it is to a certain attack, the greater the proportion of the probability value of the attack in the security score, which requires the intelligent routing selection system in the present invention to be more sensitive to the attack, that is, the perception of the attack is more subtle, and further requires the probability value of the attack to be amplified to a certain extent in the security score calculation process. Therefore, the present invention adopts the use of indexes to differentiate the probability values ​​of different attacks, so that the probability value of the attack that the route is susceptible to is more prominent, and when the probability value of the attack that the route is susceptible to becomes low in a short time, the intelligent routing selection system in the present invention can reduce the misjudgment of the attack that the route is susceptible to by the intelligent routing selection system in the present invention.

[0079] because Indicates the priority score of the routing node in the routing table of other routing nodes. According to the static routing rules, The smaller the value, the higher the priority of the router. Generally speaking, the smaller the score, the higher the priority of the router, and vice versa.

[0080] Finally, after calculating the comprehensive score of each routing node in the static routing network, the routing table is updated with the comprehensive score to guide the transmission of data in the routing nodes and realize the intelligent selection of routes.

[0081] Based on the above intelligent routing selection method, accordingly, this example also provides a computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, the following steps are implemented: collecting traffic data of each routing node in the static routing network, calculating the security score of each routing node, and then calculating the comprehensive score of the routing node based on the security score and priority score of each routing node, and then updating the routing table based on the comprehensive score of each routing node, and finally using the updated routing table to perform routing selection and data transmission.

[0082] like Figure 3 As shown, based on the above-mentioned intelligent routing selection method and computer-readable storage medium, in this embodiment, a computer device is also provided, which includes a readable storage medium, a processor, and a computer program stored on the readable storage medium and executable on the processor, wherein the readable storage medium and the processor are both arranged on a bus, and the processor implements the following steps when executing the computer program: collecting traffic data of each routing node in the static routing network, calculating the security score of each routing node, and then calculating the comprehensive score of the routing node according to the security score and priority score of each routing node, and then updating the routing table according to the comprehensive score of each routing node, and finally using the updated routing table to perform routing selection and data transmission.

[0083] Obviously, the above embodiments are merely examples for the purpose of clear explanation, and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived therefrom are still within the scope of protection of the claims of this patent application.

Claims

1. An intelligent routing selection method, characterized in that: The steps include: S100) Perform security assessment on each route in the routing network. The specific steps are as follows: S101) Collecting traffic data on each routing node; S102) classifying and preprocessing the traffic data collected in step S101), wherein the preprocessing includes data cleaning, feature extraction and category labeling; S103) inputting the pre-processed traffic data into different analysis and detection models according to categories for analysis and detection; wherein the analysis and detection models include DDoS attack analysis and detection models, ARP spoofing attack analysis and detection models, password attack analysis and detection models and IP address hijacking attack analysis and detection models; S104) performing standardization processing on the analysis and detection results obtained in step S103) and outputting a probability value, calculating the average value of the probability values ​​outputted cumulatively n times and sorting the average values ​​of the probability values ​​according to their size, and the method adopted for the standardization processing is the Min-Max standardization method; wherein n is an integer greater than or equal to 50; S105) Calculate the security score of each routing node. The specific formula is as follows: In the formula, is the probability value of DDoS attack; is the probability value of ARP spoofing attack; is the probability value of password attack; is the probability value of IP address hijacking attack; Index j, index k, index l, and index m are all positive numbers greater than 0, and their values ​​are determined according to the following strategy: According to the result of sorting the average values ​​of the probability values ​​obtained in step S104), the value range of the index associated with the average value of the first-ranked probability value is (0.25, 0.5], the value range of the index associated with the average value of the second-ranked probability value is (0.5, 1], the value range of the index associated with the average value of the third-ranked probability value is (1, 2], and the value range of the index associated with the average value of the fourth-ranked probability value is (2, 3]; S200) couples the security score obtained in step S100) with the priority score of each routing node in the static route, calculates the comprehensive score of each routing node, and selects the routing path based on the comprehensive score; wherein the comprehensive score is calculated by the following formula: Where e is a natural constant; Pref is the priority score of a routing node in the routing table of other routing nodes.

2. The intelligent routing selection method according to claim 1, characterized in that: In step S104), the probability value output by the normalization process ranges from 0 to 1.

3. The intelligent routing selection method according to claim 1, characterized in that: In step S104), the average value of the probability value is a square mean.

4. The intelligent routing selection method according to claim 1, characterized in that: The values ​​of index j, index k, index l and index m are determined according to the following strategy: According to the result of sorting the average values ​​of the probability values ​​obtained in step S104), the value range of the index related to the average value of the first-ranked probability value is (0.25, 0.3], the value range of the index related to the average value of the second-ranked probability value is [0.8, 1], the value range of the index related to the average value of the third-ranked probability value is [1.5, 2], and the value range of the index related to the average value of the fourth-ranked probability value is [2.5, 3].

5. The intelligent routing selection method according to claim 1, characterized in that: In step S101), when collecting traffic data on each routing node, data collection is performed according to the type of traffic data required by each analysis and detection model.

6. The intelligent routing selection method according to claim 1, characterized in that: In step S200), when selecting a routing path based on the comprehensive score, the routing table in each routing node is first updated based on the comprehensive score, and then data is transmitted based on the updated routing table.

7. A system for performing route selection using the intelligent route selection method according to claim 1, characterized in that: include: A security scoring unit, used to perform security scoring on each routing node; The safety scoring unit includes a data acquisition module, a data processing module, an analysis and detection model module, a standardization processing module and a safety scoring calculation module. The data acquisition module is connected to the data processing module in communication, the data processing module is connected to the analysis and detection model module in communication, the analysis and detection model module is connected to the standardization processing module in communication, and the standardization processing module is connected to the safety scoring module in communication; A comprehensive scoring unit, used to comprehensively score each routing node using the security score and priority score of the routing node; A routing table updating unit, used for updating the routing table in each routing node according to the comprehensive score; The security scoring unit is communicatively connected to the comprehensive scoring unit, and the comprehensive scoring unit is communicatively connected to the routing table updating unit.

8. The system according to claim 7, characterized in that The analysis and detection model modules include DDoS attack analysis and detection model modules, ARP spoofing attack analysis and detection model modules, password attack analysis and detection model modules and IP address hijacking attack analysis and detection model modules.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the intelligent routing selection method according to any one of claims 1 to 6 is implemented.

10. A computer device comprising a readable storage medium, a processor, and a computer program stored on the readable storage medium and executable on the processor, characterized in that: When the computer program is executed by a processor, the intelligent routing selection method according to any one of claims 1 to 6 is implemented.

Images