A global-view Internet autonomous domain-level topology inference method

Abstract

The present invention discloses a method for inferring Internet autonomous domain-level topology based on a global perspective. First, an Internet AS-level topology association relationship graph is constructed, and elements related to the Internet AS-level topology are organized through the association relationship graph. Then, the AS business relationship is inferred using a Bayesian network. Then, the AS hierarchy is inferred based on a series of heuristic methods. Then, the AS-level topology is corrected under the constraint of a global perspective that ASs within the same level of the Internet have similar routing strategies. Finally, it is determined whether it is necessary to continue iteratively inferring the AS business relationship and hierarchy based on a set threshold. The method of the present invention organizes elements related to the AS-level topology through an association relationship graph, can better explore the complex association relationships between the elements, and can more accurately infer the Internet AS-level topology under the constraint of a global perspective that ASs within the same level of the Internet have similar routing strategies.

Description

Technical Field

[0001] The present invention belongs to the technical field of Internet autonomous domains, and specifically relates to an Internet autonomous domain-level topology inference method based on a global perspective. Background Art

[0002] The Internet's Autonomous Systems (AS) level topology is the coarsest-grained topology. It is a hierarchical structure composed of autonomous systems and the business relationships between them. The global Internet has over 70,000 independent and autonomous ASes. An AS is a collection of IP routing prefixes under the control of a single or multiple network operators. ASes are identified by a unique 16-bit or 32-bit AS number. Each AS is managed using a unified routing policy, while different commercial routing policies are set between ASes using the Border Gateway Protocol (BGP) to enable traffic exchange and global reach.

[0003] Based on the different commercial routing strategies between ASes, commercial relationships between ASes are generally categorized into three types: provider-to-customer (P2C), peer-to-peer (P2P), and sibling-to-sibling (S2S). In P2C, customers pay providers for traffic forwarding. In P2P and S2S, however, ASes can exchange traffic free of charge. The difference between P2P and S2S is that ASes belonging to S2S are typically from the same carrier and therefore exchange all types of traffic, while in P2P, both parties only exchange routes required to reach their respective networks and the networks obtained from customers. When inferring AS commercial relationships, ASes belonging to the same carrier are generally considered S2S, and only P2P and P2C are considered in further inferences.

[0004] The complex business relationships between ASes dictate that the AS-level topology is a hierarchical structure, consisting of Tier 1, Tier 2, Tier 3, Tier 4, and Tier 5. Tier 1 is the top-level, provider-free AS on the Internet. Tier 2, Tier 3, and Tier 4 are national, regional, and local ASes, respectively, which purchase traffic forwarding services from upper-level ASes and provide access services to lower-level ASes. Tier 5 consists of stub ASes and multi-homed ASes that do not forward traffic. With the rise of content providers, Internet traffic exchange is becoming increasingly flat, but this does not affect the fact that the Internet's AS-level topology is essentially a hierarchical structure. The Internet's AS-level topology depicts the true commercial nature of Internet inter-domain routing and is widely used in further research related to Internet security monitoring, service quality optimization, and network congestion monitoring.

[0005] The Internet AS-level topology includes topology structure, AS business relationships, and AS hierarchy. Topology information consists of BGP routing paths collected from multiple BGP routing observation points (Vantage Points, VPs). Due to the limitations of the location and number of VPs, the obtained topology is incomplete and biased. Based on the AS-level topology base map, the business relationships and hierarchy of the AS are inferred in combination with the registration information related to the AS to obtain a complete AS-level topology. Existing AS-level topology inference methods are based on the assumption of the valley-free property (i.e., customers will not announce routing paths obtained from other suppliers or peers to their supplier AS). They mainly focus on inferring AS business relationships. On this basis, a series of heuristic methods are used to infer the AS hierarchy.

[0006] The AS-Rank method proposed in the paper "Luckie M, Huffaker B, Dhamdhere A, et al. AS relationships, customercones, and validation. Proceedings of IMC, New York, NY, USA 2013, 243-256" does not rely on the assumption of valley-free paths or the maximization of their number. Instead, it assumes global AS connectivity and uses the Bron / Kerbosch method proposed in the paper "Bron C and Kerbosch J. Algorithm 457: Finding All Cliques of an Undirected Graph. CACM, 1973" to obtain tier-1 ASs. It then uses a heuristic method to infer AS business relationships. The paper "Jin Y, Scott C, Dhamdhere A, et al. Stable and Practical AS Relationship Inference with ProbLink. 16th USENIX Symposium on NSDI, Boston, MA, USA, 2019, 581-598" pioneered a probabilistic inference algorithm, using a Bayesian network framework to integrate many noisy but useful attributes, selecting the highest-probability relationship for each link, and being insensitive to the position of the VP and the order of inferred link relationships. The paper "Jin Z, Shi X, Yang Y, et al. Toposcope: Recover AS relationships from fragmentary observations. Proceedings of IMC, USA, 2020, 266-280" uses a Bayesian network to explore the interdependence between various link features and the uneven distribution of features observed from a biased VP distribution. However, these methods have difficulty in accurately mining the complex relationships between different elements related to the AS-level topology. They only consider the constraints of neighboring ASs and lack the constraints of the global perspective of the global Internet. That is, ASs within the same layer of the Internet have similar routing strategies, which leads to deviations in AS-level topology inference.

[0007] In summary, existing AS-level topology inference methods primarily focus on reasoning about AS business relationships, and then inferring the AS hierarchy based on this. Such methods are limited by the location and number of VPs, and only utilize information about neighboring ASs, lacking a global perspective. They fail to consider the global hierarchical nature of the AS-level topology, which states that ASes within the same Internet hierarchy share similar routing policies. Summary of the Invention

[0008] To solve the above technical problems, the present invention provides an Internet autonomous domain-level topology inference method based on a global perspective. The elements related to the AS-level topology are organized through an association relationship diagram, which can better explore the complex association relationships between the various elements. At the same time, under the global perspective constraint that ASs in the same layer of the Internet have similar routing strategies, the Internet AS-level topology can be inferred more accurately.

[0009] The technical solution adopted by the present invention is: a method for inferring Internet autonomous domain-level topology based on a global perspective, the specific steps of which are as follows:

[0010] S1. Build an Internet AS-level topology relationship diagram;

[0011] S2. Based on step S1, using Bayesian network to infer AS business relationship;

[0012] S3. Based on steps S1 and S2, perform AS hierarchy division;

[0013] S4. After inferring the AS business relationship and hierarchical structure based on steps S2-S3, perform AS-level topology correction based on the meta-path, i.e., add a global constraint to adjust the AS business relationship and hierarchical structure.

[0014] S5. Based on step S4, determine the number of AS business relationships and hierarchical structure adjustments. If it is greater than the set threshold, repeat steps S1-S4 with the adjusted hierarchical structure as input, and continue to infer AS business relationships and AS hierarchical structures until it is less than the set threshold. Stop iteration, output the results, and complete the Internet autonomous domain-level topology inference.

[0015] Furthermore, the step S1 is specifically as follows:

[0016] The nodes in the association relationship graph include: AS, AS link, network operator, IXP, traffic exchange infrastructure and VP.

[0017] The attributes in the association relationship diagram include: AS attributes and AS link attributes.

[0018] Among them, AS attributes include AS type and AS hierarchy; AS link attributes include: AS business relationship, distance between AS link and VP, number of VPs observed to AS link, and BGP community value.

[0019] The nodes of the association graph are associated with each other through different relationships, including: a network operator operates an AS, a network operator operates an IXP, an AS exchanges traffic with an IXP, an AS exchanges traffic with a traffic exchange infrastructure, an IXP is located in a traffic exchange infrastructure, a VP belongs to an AS, an AS link has a source / destination AS, and a VP observes an AS link.

[0020] The data of the association relationship graph comes from a public data set, including: BGP routing path and routing registration information.

[0021] The route registration information includes: operator information, AS type information, IXP information, and the meaning of the BGP community value.

[0022] The data of the association relationship diagram are as follows:

[0023] (1) BGP routing path;

[0024] All BGP routing paths within five days from the Route-Views and RIPE RIS public databases are downloaded and irrelevant and erroneous paths are filtered out. The BGP routing paths after filtering are the BGP routing paths of the association graph.

[0025] The filtering process is as follows:

[0026] First, all AS paths with destinations that are IPv4 prefixes are extracted. Then, all paths that have appeared within five days are retained to try to preserve backup paths that appear briefly. Then, paths with retained AS numbers caused by route poisoning and AS loop paths are filtered out.

[0027] The BGP routing path information includes: AS, AS link, VP, the distance between the AS link and the VP, the number of VPs observed to the AS link, and the BGP community value of the AS link.

[0028] (2) Operator information;

[0029] The operator information data includes the mapping between ASs and operators, which comes from CAIDA. Each AS has a corresponding operating organization. ASes belonging to the same operating organization are considered to be in an S2S relationship and are not inferred in subsequent inferences.

[0030] (3)AS type information;

[0031] Download and extract the business type data of ASs from PeeringDB, and merge the business types of ASs with similar businesses and services. That is, "Cable / Digital Subscriber Line / Internet Service Provider", "Network Service Provider" and "Network Service" were merged into "Transmission / Access Provider"; "Government Network", "Education / Research" and "Enterprise Network" were merged into "Enterprise Network"; "Route Collector", "Route Server" and "Non-profit Network" were merged into "Non-profit Network", and "Content Provider" remained "Content Provider".

[0032] Then, the "non-profit network" in the merged AS business type data is ignored, and the AS type information of the association relationship diagram is obtained, including: "transmission / access provider", "content provider", and "enterprise network".

[0033] Among them, "transmission / access providers" provide traffic exchange and access services on the Internet, "content providers" are suppliers of service network content, and "enterprise networks" are mainly customers, and on the Internet they are mainly ASs that use Internet services.

[0034] (4) IXP information;

[0035] IXPs are third-party organizations that facilitate interconnection and data exchange between autonomous systems (ASs). IXP information data used comes from CAIDA-aggregated data from PeeringDB, Hurricane Electric, Packet Clearing House, Wikipedia, BGP Looking Glass, and GeoNames.

[0036] The IXP information data includes: the name of the IXP, the traffic exchange infrastructure in which it is located, the IPv4 prefix, the network operator and the member ASs.

[0037] IXPs use bilateral and multilateral peering. Multilateral peering uses the route server provided by the IXP as an intermediary to achieve dense peering. The route server belongs to the AS of the IXP and is filtered out from the AS path.

[0038] (5) The meaning of BGP community value;

[0039] Data was downloaded from the 18 routing registries listed by the IRR and BGP community values ​​and their meanings were extracted. BGP community values ​​are optional 32-bit numbers in BGP messages. The first 16 bits represent the AS of the community value, and the last 16 bits represent the meaning of the community value. They are used to encode additional information related to the AS path. The inferred AS business relationships based on the meaning of BGP community values ​​were used as real data to verify the inference. Information on network operation websites was extracted from PeeringDB, as well as AS import and export rules from the RIPE NCC database, to supplement the meaning of BGP community values.

[0040] Among them, for other BGP community values ​​whose meanings cannot be found, they are added to the association relationship graph.

[0041] Furthermore, the step S2 is specifically as follows:

[0042] S21. Determine the information required for inferring AS business relationships, including: neighbor information, observation information, hierarchy information, and coexistence information;

[0043] (1)Neighbor information;

[0044] Neighbor information includes: AS link triplet. AS link triplet is three adjacent links on the same path.

[0045] All BGP routing paths are broken down into triplets. For the first hop of a path, add NULL as the first value of the triplet, and for the last hop of a path, add NULL as the last value of the triplet. The ratio of each business relationship between the previous and next hops of the intermediate AS is used as a probability, with probabilities categorized as high, medium, and low, with values ​​greater than 0.1, 0.01 to 0.1, and less than 0.01.

[0046] (2) Observation information;

[0047] The observation information includes: the number of VPs that observe the AS link, the distance to the VP, and non-path information.

[0048] Among them, if the number of VPs observing the AS link is greater than or equal to 10, it is considered to be observed by a large number of VPs, and if it is less than 10, it is considered to be observed by a small number of VPs. If the distance to the VP is less than or equal to 2, it is considered to be close to the VP, and if it is greater than 2, it is considered to be far away from the VP. Non-path information refers to neighbors in the AS topology structure but not appearing on the same path at the same time. It is used to describe the probability of P2P or P2C neighbors.

[0049] (3) Hierarchical information;

[0050] The hierarchical information includes the location of the AS and the location of the VP.

[0051] Among them, ASs at the same level have similar business strategies, and AS level information can provide constraints from a global perspective.

[0052] (4) information about getting along;

[0053] The coexistence information includes: being in the same IXP and being in the same traffic exchange infrastructure.

[0054] S22, constructing a training set for the Bayesian network;

[0055] First, the data is grouped according to VP, that is, the BGP routing path is divided into N groups according to VP.

[0056] Among them, the data of observation points belonging to "full VP" are divided into N-1 groups, and the remaining data belonging to "partial VP" are divided into one group. When grouping data, the level of VP is taken into consideration and VPs of different levels are evenly divided into different groups.

[0057] Then, the AS-Rank method is used to infer the preliminary AS business relationship for each group. Then, the preliminary AS business relationship data of each group are voted using ensemble learning to obtain high-confidence AS business relationships as the training set of the Bayesian network.

[0058] The preliminary AS business relationship results obtained for each group are subjected to ensemble learning and voting to obtain trusted links and fuzzy links. Any inference that is consistent with at least 80% of the groups is considered a consensus link. When the consensus link is P2P, it is considered a trusted link if no more than 20% of the groups observe it. When the consensus link is P2C, it is considered a trusted link if at least 80% of the groups observe it. All other links except the trusted link are considered fuzzy links.

[0059] S23. Based on step S22, the Bayesian network structure is obtained, the EM algorithm is used to train the Bayesian network, and finally, the AS business relationship is inferred;

[0060] Taking high-confidence AS business relationships as input, the maximum-minimum hill climbing (MMLC) structural learning algorithm is used to obtain the probability distribution between each element. After removing the edges with smaller probabilities, the Bayesian network structure associated with each element is obtained. Then, taking the AS business relationships of high-confidence trusted links and the Bayesian network structure as input, the EM algorithm is used to obtain the parameters of the Bayesian network. Finally, the trained Bayesian network is used to infer the low-confidence business relationships between ASs obtained by ensemble learning voting.

[0061] The high-confidence AS business relationship is a trusted link, and the low-confidence AS business relationship is a fuzzy link. In subsequent iterations, only the EM algorithm needs to be used to update the conditional probability and infer the low-confidence AS business relationship.

[0062] Furthermore, the step S3 is specifically as follows:

[0063] Based on steps S1 and S2, the Internet AS-level topology is divided into five tiers: Tier 1, Tier 2, Tier 3, Tier 4, and Tier 5. The inferred order is Tier 5, Tier 4, Tier 1, Tier 2, and Tier 3, as follows:

[0064] (1) Tier 5 is the lowest level AS, which has no customers and does not forward traffic. It includes stub ASs and multi-homed ASs.

[0065] A stub AS is an AS that is connected to only one AS and has no customers, and a multi-homed AS is an AS that is connected to multiple ASs but does not forward traffic.

[0066] (2) Tier 4 is a small local supplier with only a small number of customer ASs;

[0067] After Tier 5 is deleted from the topology, ASs without customers are iteratively searched and deleted, and the deleted AS is Tier 4.

[0068] (3) Tier 1 is the top-level densely peered AS without any upstream providers;

[0069] First, use the Bron / Kerbosch algorithm to find all clusters. Then select the largest cluster with the highest transmission degree and no more than 10 ASes. Then select other ASes that meet the requirements and add them to the largest cluster. Finally, use the Bron / Kerbosch algorithm again to find the largest cluster by summing the transmission degrees. This largest cluster is Tier 1.

[0070] (4) Tier 2 refers to some large regional and national Internet providers;

[0071] Tier 2 ASes tend not to peer with other Tier 1 ASes. Starting with Tier 1, sort the ASes by their transmission degrees to find the smallest set that satisfies weak partitioning. Tier 2 is the ASes in this set excluding Tier 1.

[0072] (5) Tier 3 is a regional access provider that connects with a small number of Tier 1 and Tier 2 providers to provide network services to lower-level ASes;

[0073] Tier 3 is the remaining AS after inferring the ASs of other levels.

[0074] Furthermore, in step S2, when inferring the AS business relationship for the first time, the AS hierarchy is roughly divided based on the AS topology and node degree, as follows:

[0075] First, consider the ASs with degree 1 in the topology as Tier 5, and the ASs with degree 2 connected to Tier 5 as Tier 4. Then use the Bron / Kerbosch algorithm to find the largest clique as Tier 1. Next, consider the ASs connected to Tier 1 with a degree greater than or equal to 100 as Tier 2. Finally, the remaining ASes are Tier 3. In subsequent iterations, the AS hierarchy information inferred in step S3 is added.

[0076] Furthermore, the step S4 is specifically as follows:

[0077] The constraint of the global perspective is that ASs at the same level have similar roles in Internet traffic exchange and similar business strategies. The meta-path of the association graph is used to measure this similarity.

[0078] Metapaths are all paths consisting of nodes and relationships between two nodes in the association graph. Metapaths in the association graph correspond to features in the existing dataset, and the semantics of different paths imply different similarities. Metapaths between AS links are used to measure the similarity of AS links at the same level and across different levels.

[0079] Define the AS-level topology association graph G = (V, E), the node type mapping function is φ: V→A, and the edge type mapping function is ψ: E→R.

[0080] Where V represents a node, E represents an edge, each v∈V belongs to a special node type φ(v)∈A, and each link e∈E belongs to a special relationship type ψ(e)∈R.

[0081] Using network mode T G =(A,R) to describe the meta-level of the AS-level topological association graph, that is, a directed graph defined on node type A, with edges being relationships from R.

[0082] The network model includes: AS link, AS, AS type, IXP where AS is located, traffic exchange infrastructure where AS is located, network operator where AS is located, AS community value marking AS link in BGP path, distance of AS link from observation point (long distance if greater than 2 hops, otherwise short distance), and number of VPs observed in AS link (large number of VPs if greater than or equal to 10, otherwise small number of VPs).

[0083] The meta-paths related to the AS business relationship in the network model include: (AS link, AS, IXP, AS, AS link), (AS link, AS, traffic exchange infrastructure, AS, AS link), (AS link, AS, AS type, AS, AS link), (AS link, AS, network operator, AS, AS link), (AS link, BGP community value, AS link), (AS link, long distance, AS link), (AS link, short distance, AS link), (AS link, a large number of VPs, AS link), (AS link, a small number of VPs, AS link).

[0084] In the network mode T G =(A,R), the meta-path P in the AS-level topology association graph is represented as Then a node A1 and node A l The compound relationship between

[0085] Among them, A l Indicates the lth node type, R l-1 Indicates the l-1th relationship type.

[0086] For a given symmetric meta-path P, the Pathsim metric expression for AS links x and y of the same type is defined as follows:

[0087]

[0088] Among them, p x→y represents the path between x and y, p x→x represents the path between x and x, p y→y represents the path between y and y.

[0089] Based on the above-obtained Internet AS-level topology relationship network G = (V, E) and network model T G , meta-path P=(A1A2…A l ), calculate the matrix

[0090] in, Indicates A i and A j The adjacency matrix, M represents the calculation matrix, M ij Represents the value of the i-th row and j-th column of M, that is, the object x under the meta-path P i ∈A1 and x j ∈A l The number of paths between .

[0091] Then from the same type of x i and x j The Pathsim between two objects is

[0092] Among them, M ii and M jj Indicates that given a meta-path in the network x i and x j visibility.

[0093] Then traverse all the levels, for those in (Tier i ,Tier j ) of the link L(i,j)(Tier i The level is not lower than Tier j The Pathsim between P2P links and P2C links is calculated respectively.

[0094] When obtaining the calculation matrix M, the common number of IXPs, BGP community values, and network operators connected to the AS links is calculated, and then normalized to represent the three types of meta-paths: IXPs, BGP community values, and network operators.

[0095] Then, for a given business relationship c1∈{P2P,P2C}, the average similarity ranking of each AS link and the rest of the AS links is calculated, and the AS links L ranked before Δ are considered similar. Similar (i, j), and the remaining AS links with lower rankings are regarded as dissimilar links L Dissimilar (i,j).

[0096] Among them, Δ is set according to actual conditions.

[0097] Then for the dissimilar AS link L Dissimilar (i,j) further judges that the dissimilar AS links L Dissimilar (i,j) and in (Tier i ,Tier j ) Calculate the similar links of another business relationship c2∈{P2P,P2C},c1≠c2, and consider the ones in the top Δ as being able to be adjusted, that is, to be adjusted to another business relationship c2. For these dissimilar AS links L Dissimilar (i,j) The remaining unadjusted links, if Tier i If it is not Tier 1, then (Tier i-1 ,Tier j ) similar links are calculated, if Tier j If it is not Tier 5, then (Tier i ,Tier j+1 ) are calculated, and the links ranked higher than Δ are considered as links that can be adjusted. CandidateThe last unadjusted AS link will not be adjusted any more.

[0098] After traversing all levels, judge L Candidate Whether the AS level in the AS needs to be adjusted. For any AS, calculate the number of times that all its associated links need to modify the level. If the number of times that the level needs to be modified is greater than the number that does not need to be modified, then modify the AS level.

[0099] Beneficial effects of the present invention: The method of the present invention first constructs an Internet AS-level topology association relationship graph, organizes the elements related to the Internet AS-level topology through the association relationship graph, and then uses the Bayesian network to infer the AS business relationship, and then infers the AS hierarchy based on a series of heuristic methods, and then corrects the AS-level topology under the constraint of the global perspective that ASs in the same level of the Internet have similar routing strategies, and finally determines whether it is necessary to continue iteratively inferring the AS business relationship and hierarchy based on the set threshold. The method of the present invention overcomes the deviation caused by the position and number of observation points in the existing AS-level topology inference method, organizes the elements related to the AS-level topology through the association relationship graph, and can better explore the complex association relationships between the various elements. At the same time, under the constraint of the global perspective that ASs in the same level of the Internet have similar routing strategies, it can narrow the solution space and achieve the AS-level topology inference accuracy that is difficult to achieve by relying solely on local observations and neighbor information, effectively reducing the deviation caused by the position and number of observation points, and can more accurately infer the Internet AS-level topology. BRIEF DESCRIPTION OF THE DRAWINGS

[0100] Figure 1 This is a flowchart of an Internet autonomous domain-level topology inference method based on a global perspective of the present invention.

[0101] Figure 2 This is a schematic diagram of the Internet AS-level topology association relationship diagram in an embodiment of the present invention.

[0102] Figure 3 Schematic diagram of the Bayesian network structure in an embodiment of the present invention.

[0103] Figure 4 This is a network model diagram of the Internet AS-level topology association diagram in an embodiment of the present invention. DETAILED DESCRIPTION

[0104] The method of the present invention is further described below with reference to the accompanying drawings and embodiments.

[0105] like Figure 1 As shown in FIG, a flowchart of an Internet autonomous domain-level topology inference method based on a global perspective of the present invention is shown, and the specific steps are as follows:

[0106] S1. Build an Internet AS-level topology relationship diagram;

[0107] S2. Based on step S1, using Bayesian network to infer AS business relationship;

[0108] S3. Based on steps S1 and S2, perform AS hierarchy division;

[0109] S4. After inferring the AS business relationship and hierarchical structure based on steps S2-S3, perform AS-level topology correction based on the meta-path, i.e., add a global constraint to adjust the AS business relationship and hierarchical structure.

[0110] S5. Based on step S4, determine the number of AS business relationships and hierarchical structure adjustments. If it is greater than the set threshold, repeat steps S1-S4 with the adjusted hierarchical structure as input, and continue to infer AS business relationships and AS hierarchical structures until it is less than the set threshold. Stop iteration, output the results, and complete the Internet autonomous domain-level topology inference.

[0111] In this embodiment, step S1 is specifically as follows:

[0112] The Internet AS-level topology relationship diagram is as follows: Figure 2 As shown, the nodes in the association relationship diagram include: AS, AS link, network operator, IXP, traffic exchange infrastructure and VP.

[0113] The attributes in the association relationship diagram include: AS attributes and AS link attributes.

[0114] Among them, AS attributes include AS type and AS hierarchy; AS link attributes include: AS business relationship, distance between AS link and VP, number of VPs observed to AS link, and BGP community value.

[0115] One of the goals of this embodiment is to infer the business relationship of AS. In essence, it is to classify AS links, and AS links are also regarded as nodes. Using AS links as nodes in the association relationship graph can better characterize the characteristics of AS links. The nodes of the association relationship graph are associated with each other through different relationships. The specific association relationships are as follows: Figure 2 As shown in the figure, by using the association relationship graph, the complex and diverse elements related to the AS-level topology can be associated in the form of a graph, which can better explore the complex association relationships between multiple elements and better constrain them from a global perspective, thereby more accurately inferring the business relationships and hierarchical structures of the AS.

[0116] The nodes of the association graph are associated with each other through different relationships, including: a network operator operates an AS, a network operator operates an IXP, an AS exchanges traffic with an IXP, an AS exchanges traffic with a traffic exchange infrastructure, an IXP is located in a traffic exchange infrastructure, a VP belongs to an AS, an AS link has a source / destination AS, and a VP observes an AS link.

[0117] The data of the association relationship graph comes from a public data set, including: BGP routing path and routing registration information.

[0118] The routing registration information includes: operator information, AS type information, IXP (Internet Exchange Point) information and BGP community value meaning information.

[0119] The data of the association relationship diagram are as follows:

[0120] (1) BGP routing path;

[0121] BGP routing paths are the most important data in the Internet's AS-level topology graph, providing information about AS interconnection and observation. Route-Views and RIPE RIS route collectors are deployed in various locations across the Internet and peer with BGP routers from multiple ASes, collecting BGP path information from around the world. They periodically save snapshots of their state. Different VPs collect AS-level views of the Internet from different perspectives, and aggregating them together yields the global Internet AS-level topology. Of course, due to the limitations on the number and location of VPs and the existence of backup links, this topology is not complete.

[0122] All BGP routing paths within five days from the Route-Views and RIPE RIS public databases are downloaded and irrelevant and erroneous paths are filtered out. The BGP routing paths after filtering are the BGP routing paths of the association graph.

[0123] The filtering process is as follows:

[0124] First, all AS paths with destinations that are IPv4 prefixes are extracted. Then, all paths that have appeared within five days are retained to try to preserve backup paths that appear briefly. Then, paths with reserved AS numbers caused by routing poisoning (which should not appear on the public Internet) and AS loop paths (the same AS appears multiple times in the same path without being adjacent) are filtered out.

[0125] The BGP routing path information includes: AS, AS link, VP, the distance between the AS link and the VP, the number of VPs observed to the AS link, and the BGP community value of the AS link.

[0126] (2) Operator information;

[0127] Operator information, including mappings between ASes and operators, is obtained from the Center for Applied Internet Data Analysis (CAIDA), which aggregates routing registration information from multiple routing registries. These registries include five regional RIRs (ARIN for North America, LACNIC for South America, RIPE NCC for Europe, AFRINIC for Africa, and APNIC for Asia / Pacific, including Australia), and WHOIS information from two national Internet registries (NIRs: KRNIC for South Korea and JPNIC for Japan). Each AS has a corresponding operating organization. ASes belonging to the same operating organization are considered to have a S2S relationship and are not further inferred in subsequent inferences.

[0128] (3)AS type information;

[0129] AS type information comes from PeeringDB, the world's largest Internet database. We downloaded and extracted the business type data of ASs in PeeringDB, and merged the business types of ASs with similar businesses and services. For example, "Cable / DSL / Internet Service Provider", "Network Service Provider" and "Network Service" were merged into "Transmission / Access Provider"; "Government Network", "Education / Research" and "Enterprise Network" were merged into "Enterprise Network"; "Route Collector", "Route Server" and "Non-profit Network" were merged into "Non-profit Network", and "Content Provider" remained "Content Provider".

[0130] Then ignore the "non-profit network" in the merged AS business type data (because the business types of these ASs are unknown and it is meaningless to infer the AS business relationship and hierarchy), and obtain the AS type information of the association relationship diagram, including: "transmission / access provider", "content provider", and "enterprise network".

[0131] Among them, "transmission / access providers" provide traffic exchange and access services on the Internet, "content providers" are suppliers of service network content, and "enterprise networks" are mainly customers, and on the Internet they are mainly ASs that use Internet services.

[0132] (4) IXP information;

[0133] IXPs are third-party organizations that facilitate interconnection and data exchange between different ASes. Many ASes establish peer-to-peer (P2P) relationships through IXPs, exchanging traffic for free. Therefore, whether ASes are members of the same IXP is an important indicator of AS relationships. The IXP information used comes from CAIDA-aggregated data from PeeringDB, Hurricane Electric, PacketClearning House (PCH), Wikipedia, BGP Looking Glass, and GeoNames.

[0134] The IXP information data includes: the name of the IXP, the traffic exchange infrastructure in which it is located, the IPv4 prefix, the network operator and the member ASs.

[0135] IXPs use bilateral and multilateral peering. Multilateral peering uses the route server provided by the IXP as an intermediary to achieve dense peering. The route server belongs to the AS of the IXP and is filtered out from the AS path.

[0136] (5) The meaning of BGP community value;

[0137] Data was downloaded from 18 routing registries listed by the Internet Routing Registry (IRR) to extract BGP community values ​​and their meanings. BGP community values ​​are optional 32-bit numbers in BGP messages. The first 16 bits represent the AS of the community value, and the last 16 bits represent the meaning of the community value. They are used to encode additional information related to the AS path. The inferred AS business relationships based on the meaning of the BGP community values ​​were used as real data to verify the inference results. Information on network operation websites was extracted from PeeringDB, as well as AS import and export rules from the RIPE NCC database, to supplement the meaning of BGP community values.

[0138] Among them, for other BGP community values ​​whose meanings cannot be found, they are added to the association relationship graph (AS links with the same BGP community value are more likely to belong to the same business relationship).

[0139] In addition to BGP community values, which can be used to identify AS business relationships, some network operators use routing policy specification languages ​​to register routing policies in public datasets. The largest source of this data is the RIPE National Communications Commission (RIPE NCC) database. The routing policy specification language defines the rules for ASes to import and export routes from their neighbors. If AS1 imports ANY from AS2, and AS2 exports ANY from AS1, AS2 is considered to forward all traffic for AS1, indicating a P2C business relationship between AS2 and AS1.

[0140] In this embodiment, step S2 is specifically as follows:

[0141] S21. Determine the information required for inferring AS business relationships, including: neighbor information, observation information, hierarchy information, and coexistence information;

[0142] (1)Neighbor information;

[0143] Neighbor information includes: AS link triplet. AS link triplet is three adjacent links on the same path.

[0144] AS link triplets are used to satisfy the valley-free property. As long as all triplets in a path do not violate the valley-free property, the path will not violate the valley-free property. Under the valley-free property, the business relationships between the preceding and succeeding AS links most likely determine the business relationships of the intermediate links. If the first AS link in a triplet is P2P, then the intermediate AS is most likely P2C. All BGP routing paths are split into triplets. To ensure that all ASs have at least one triplet, a null is added as the first value of the triplet for the first hop of the path, and a null is added as the last value of the triplet for the last hop of the path. The ratio of each business relationship between the previous and next hops of the intermediate AS is used as a probability, and the probability is categorized as high, medium, and low, with values ​​greater than 0.1, 0.01 to 0.1, and less than 0.01.

[0145] (2) Observation information;

[0146] Observation information includes the number of VPs that observe the AS link, the distance to the VP, and non-path information. Because an AS prefers to announce customer routes rather than those of peers and providers, making P2C links more likely to be observed by more VPs, the number of VPs is used.

[0147] Among them, if the number of VPs observing the AS link is greater than or equal to 10, it is considered to be observed by a large number of VPs, and if it is less than 10, it is considered to be observed by a small number of VPs. If the distance to the VP is less than or equal to 2, it is considered to be close to the VP, and if it is greater than 2, it is considered to be far away from the VP. Non-path information refers to neighbors in the AS topology structure but not appearing on the same path at the same time. It is used to describe the probability of P2P or P2C neighbors.

[0148] (3) Hierarchical information;

[0149] The hierarchical information includes the location of the AS and the location of the VP.

[0150] Among them, ASes at the same level have similar business strategies, so AS-level information can provide global constraints. The location of VPs is also closely related to the business relationship type of ASes. For example, VPs at higher levels have difficulty observing P2P links at lower levels.

[0151] (4) information about getting along;

[0152] The coexistence information includes: being in the same IXP and being in the same traffic exchange infrastructure.

[0153] Because IXPs and traffic exchange infrastructure are often used to exchange traffic between AS peers, the more IXPs and traffic exchange infrastructures two ASes share, the more likely they are to be in a peering relationship. In real-world data, over 90% of ASes in P2C links are not located in the same IXP or traffic exchange infrastructure, while over 70% of ASes in P2P links are located in at least one of the same IXPs or traffic exchange infrastructures.

[0154] Bayesian networks can well characterize the correlation between multiple factors, so this embodiment uses Bayesian networks to infer AS business relationships. Unlike the Toposcope method, this embodiment updates and iterates AS business relationships and hierarchical structures under the global constraint that ASs at the same level have similar business strategies. In addition, this embodiment also adds hierarchical information of AS and VP. The positions of AS and VP in the Internet hierarchy reflect the information of Internet observation points and observed points, and are also a global vision constraint that can better infer AS business relationships. Since both AS business relationships and AS hierarchical structures are unknown and require further inference, this embodiment roughly divides the AS hierarchy based on the AS topology and node degree method when inferring AS business relationships for the first time, and only adds the AS hierarchy information inferred by this embodiment in subsequent iterations.

[0155] S22, constructing a training set for the Bayesian network;

[0156] First, the data is grouped according to VP, that is, the BGP routing path is divided into N groups according to VP.

[0157] Among them, the data of the observation points belonging to "full VP" (VP that reports a large number of routes to the route collector) are divided into N-1 groups, and the remaining data belonging to "partial VP" (VP that reports a small number of routes to the route collector) are divided into one group. In order to make the distribution of each group of data more even, the level of the VP is taken into consideration when grouping the data, and VPs of different levels are evenly divided into different groups.

[0158] Then, the AS-Rank method is used to infer the preliminary AS business relationship for each group. Then, the preliminary AS business relationship data of each group are voted using ensemble learning to obtain high-confidence AS business relationships as the training set of the Bayesian network.

[0159] The preliminary AS business relationship results obtained from each group are subjected to ensemble learning and voting to obtain trusted links and fuzzy links. The inferences that are consistent among at least 80% of the groups are considered consensus links. When the consensus link is P2P, it is considered trusted if no more than 20% of the groups observe it; when the consensus link is P2C, it is considered trusted if at least 80% of the groups observe it. Trusted links serve as training sets to obtain the structure of the Bayesian network, and all remaining links except trusted links are considered fuzzy links.

[0160] S23. Based on step S22, the Bayesian network structure is obtained, the EM algorithm is used to train the Bayesian network, and finally, the AS business relationship is inferred;

[0161] Taking high-confidence AS business relationships as input, the Max-Min Hill Climbing (MMLC) structure learning algorithm is used to obtain the probability distribution between each element. After removing the edges with smaller probabilities, the Bayesian network structure of the association between each element is obtained, as shown in the following example: Figure 3 As shown, the AS business relationship of the high-confidence trusted link and the Bayesian network structure are then used as input, and the EM algorithm is used to obtain the parameters of the Bayesian network (i.e., the conditional probability corresponding to the Bayesian network structure). Finally, the trained Bayesian network is used to infer the business relationship between the low-confidence ASs obtained by ensemble learning voting.

[0162] The high-confidence AS business relationship is a trusted link, and the low-confidence AS business relationship is a fuzzy link. In subsequent iterations, only the EM algorithm needs to be used to update the conditional probability and infer the low-confidence AS business relationship.

[0163] In this embodiment, step S3 is specifically as follows:

[0164] Based on steps S1 and S2, the Internet AS-level topology is divided into five tiers: Tier 1, Tier 2, Tier 3, Tier 4, and Tier 5. The inferred order is Tier 5, Tier 4, Tier 1, Tier 2, and Tier 3, as follows:

[0165] (1) Tier 5 is the lowest level AS, which has no customers and does not forward traffic. It includes stub ASs and multi-homed ASs.

[0166] A stub AS is an AS that is connected to only one AS and has no customers, and a multi-homed AS is an AS that is connected to multiple ASs but does not forward traffic.

[0167] (2) Tier 4 is a small local supplier with only a small number of customer ASs;

[0168] After Tier 5 is deleted from the topology, ASs without customers are iteratively searched and deleted, and the deleted AS is Tier 4.

[0169] (3) Tier 1 is the top-level densely peered AS without any upstream providers;

[0170] First, use the Bron / Kerbosch algorithm to find all clusters. Then select the largest cluster with the highest transmission degree (the number of unique neighbors on both sides of the AS link) and no more than 10 ASes. Then select other ASes that meet the requirements and add them to the largest cluster (that is, they are disconnected from at most one AS in the largest cluster and are not on the same path with more than two ASes in the largest cluster at the same time). Finally, use the Bron / Kerbosch algorithm again to find the largest cluster by summing the transmission degrees. This largest cluster is Tier 1.

[0171] (4) Tier 2 refers to some large regional and national Internet providers;

[0172] These ASes have peer relationships with many Tier 1 ASes, but also need to purchase at least some traffic transit services to access certain parts of the Internet.

[0173] Tier 2 ASes tend not to peer with other Tier 1 ASes. Starting with Tier 1, sort the ASes by their transmission degrees to find the smallest set that satisfies weak partitioning. Tier 2 is the ASes in this set excluding Tier 1.

[0174] (5) Tier 3 is a regional access provider that connects with a small number of Tier 1 and Tier 2 providers to provide network services to lower-level ASes;

[0175] Tier 3 is the remaining AS after inferring the ASs of other levels.

[0176] In this embodiment, in step S2, when inferring AS business relationships for the first time, the AS hierarchy is roughly divided based on the AS topology and node degree, as follows:

[0177] First, consider the ASs with degree 1 in the topology as Tier 5, and the ASs with degree 2 connected to Tier 5 as Tier 4. Then use the Bron / Kerbosch algorithm to find the largest clique as Tier 1. Next, consider the ASs connected to Tier 1 with a degree greater than or equal to 100 as Tier 2. Finally, the remaining ASes are Tier 3. In subsequent iterations, the AS hierarchy information inferred in step S3 is added.

[0178] In this embodiment, step S4 is specifically as follows:

[0179] The constraint of the global perspective is that ASs at the same level have similar roles in Internet traffic exchange and similar business strategies. The meta-path of the association graph is used to measure this similarity.

[0180] Metapaths are all paths consisting of nodes and relationships between two nodes in an association graph. Metapaths in an association graph correspond to features in an existing dataset, and the semantics of different paths imply different similarities. Metapaths between AS links are used to measure the similarity of AS links within the same layer and across different layers, thereby illustrating their distribution patterns and providing a global perspective on the similarity of AS business strategies within the same layer. This global perspective provides new constraints for AS-level topology inference, narrowing the solution space and achieving greater accuracy than existing methods that rely on neighbor information.

[0181] When stratifying ASes, ASes between adjacent tiers can be easily confused due to inaccurate or insufficiently observed AS business relationships. For example, a Tier 1 AS might belong to Tier 2, a Tier 2 AS might belong to Tier 1 or Tier 3, a Tier 3 AS might belong to Tier 2 and Tier 4, a Tier 4 AS might belong to Tier 3, and a Tier 5 AS might belong to Tier 4. Therefore, it's important to focus on these easily confused tiers to reduce computational complexity.

[0182] Define the AS-level topology association graph G = (V, E), the node type mapping function is φ: V→A, and the edge type mapping function is ψ: E→R.

[0183] Where V represents a node, E represents an edge, each v∈V belongs to a special node type φ(v)∈A, and each link e∈E belongs to a special relationship type ψ(e)∈R.

[0184] Using network mode T G =(A,R) to describe the meta-level (i.e., schema level) of the AS-level topological association graph, which is a directed graph defined on node type A, with edges being relationships from R.

[0185] The concept of network model is similar to the entity-relationship model in database system, but it only captures entity types and their binary relationships without considering the attributes of each entity type. Figure 4As shown, the network mode includes: AS link, AS, AS type, IXP where the AS is located, traffic exchange infrastructure where the AS is located, network operator where the AS is located, AS community value marking the AS link in the BGP path, distance of the AS link from the observation point (long distance if greater than 2 hops, otherwise short distance), and number of VPs observed on the AS link (greater than or equal to 10 for a large number of VPs, otherwise a small number of VPs).

[0186] The meta-paths related to the AS business relationship in the network model include: (AS link, AS, IXP, AS, AS link), (AS link, AS, traffic exchange infrastructure, AS, AS link), (AS link, AS, AS type, AS, AS link), (AS link, AS, network operator, AS, AS link), (AS link, BGP community value, AS link), (AS link, long distance, AS link), (AS link, short distance, AS link), (AS link, a large number of VPs, AS link), (AS link, a small number of VPs, AS link).

[0187] like Figure 4 As shown, in the network mode T G =(A,R), the meta-path P in the AS-level topology association graph is represented as Then a node A1 and node A l The compound relationship between

[0188] Among them, A l Indicates the lth node type, R l-1 Indicates the l-1th relationship type.

[0189] Pathsim is able to capture the semantics of peer similarity, i.e., two similar peer objects should not only be closely connected but also have similar visibility. For a given symmetric meta-path P, the Pathsim metric expression for AS links x and y of the same type is defined as follows:

[0190]

[0191] Among them, p x→y represents the path between x and y, p x→x represents the path between x and x, p y→y represents the path between y and y.

[0192] Based on the above-obtained Internet AS-level topology relationship network G = (V, E) and network model T G , meta-path P=(A1A2…A l ), calculate the matrix

[0193] in, Indicates A i and A j The adjacency matrix, M represents the calculation matrix, M ij Represents the value of the i-th row and j-th column of M, that is, the object x under the meta-path P i ∈A1 and x j ∈A l The number of paths between .

[0194] Then from the same type of x i and x j The Pathsim between two objects is

[0195] Among them, M ii and M jj Indicates that given a meta-path in the network x i and x j visibility.

[0196] Then traverse all the levels, for those in (Tier i ,Tier j ) of the link L(i,j)(Tier i The level is not lower than Tier j The Pathsim between P2P links and P2C links is calculated respectively.

[0197] When obtaining the calculation matrix M, the common number of IXPs, BGP community values, and network operators connected to the AS links is calculated and then normalized to represent the three types of meta-paths: IXP, BGP community value, and network operator. (The fact that two AS links are not at the same IXP does not mean that they are dissimilar. Instead, it is reflected based on the overall IXP data. That is, as long as they are at the same IXP, the AS links are similar.)

[0198] Then, for a given business relationship c1∈{P2P,P2C}, the average similarity ranking of each AS link and the rest of the AS links is calculated, and the AS links L ranked before Δ are considered similar. Similar (i, j) (i.e., the business strategies of these AS links are similar and they are high-confidence AS links), while the remaining AS links with lower rankings are regarded as dissimilar links L Dissimilar (i, j) (i.e., the business strategies of these AS links are dissimilar to those of the other AS links and are AS links with low confidence).

[0199] Among them, Δ is set according to actual conditions.

[0200] Dissimilar AS link L Dissimilar(i, j) may be a link of another business relationship or belong to another level. Dissimilar (i,j) further judges that the dissimilar AS links L Dissimilar (i,j) and in (Tier i ,Tier j ) Calculate the similar links of another business relationship c2∈{P2P,P2C},c1≠c2, and consider the ones in the top Δ as being able to be adjusted, that is, to be adjusted to another business relationship c2. For these dissimilar AS links L Dissimilar (i,j) The remaining unadjusted links, if Tier i If it is not Tier 1, then (Tier i-1 ,Tier j ) similar links are calculated, if Tier j If it is not Tier 5, then (Tier i ,Tier j+1 ) are calculated, and the links ranked higher than Δ are considered as links that can be adjusted. Candidate The last unadjusted AS link will not be adjusted any more.

[0201] After traversing all levels, judge L Candidate Whether the AS level in the AS needs to be adjusted. For any AS, calculate the number of times that all its associated links need to modify the level. If the number of times that the level needs to be modified is greater than the number that does not need to be modified, then modify the AS level.

[0202] In summary, the method of the present invention overcomes the deviation caused by the location and number of observation points in the existing AS-level topology inference method, organizes the elements related to the AS-level topology through an association relationship diagram, and can better explore the complex association relationships between the various elements. At the same time, under the constraint of the global perspective that ASs at the same level of the Internet have similar routing strategies, it can narrow the solution space and achieve the AS-level topology inference accuracy that is difficult to achieve by relying solely on local observations and neighbor information, effectively reduce the deviation caused by the location and number of observation points, and can more accurately infer the Internet AS-level topology.

[0203] Those skilled in the art will appreciate that the above-described embodiments are intended to help readers understand the principles of the present invention, and it should be understood that the scope of protection of the present invention is not limited to such specific descriptions and embodiments. Those skilled in the art will readily appreciate that the present invention is susceptible to various modifications and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention are intended to be included within the scope of the claims of the present invention.

Claims

1. A global-view Internet autonomous domain-level topology inference method, with the following specific steps: S1. Build an Internet AS-level topology relationship diagram; S2. Based on step S1, using Bayesian network to infer AS business relationship; S3. Based on steps S1 and S2, perform AS hierarchy division; S4. After inferring the AS business relationship and hierarchical structure based on steps S2-S3, perform AS-level topology correction based on the meta-path, i.e., add a global constraint to adjust the AS business relationship and hierarchical structure. in, The global constraint is that ASes at the same level play similar roles in Internet traffic exchange and have similar business strategies. This similarity is measured using the meta-path of the association graph. Metapaths are all paths consisting of nodes and relationships between two nodes in an association graph. Metapaths in an association graph correspond to features in an existing dataset, and the semantics of different paths imply different similarities. Metapaths between AS links are used to measure the similarity of AS links at the same level and between different levels. S5. Based on step S4, determine the number of AS business relationships and hierarchical structure adjustments. If it is greater than the set threshold, repeat steps S1-S4 with the adjusted hierarchical structure as input, and continue to infer AS business relationships and AS hierarchical structures until it is less than the set threshold. Stop iteration, output the results, and complete the Internet autonomous domain-level topology inference.

2. The method for inferring Internet autonomous domain-level topology based on a global perspective according to claim 1, characterized in that: The step S1 is specifically as follows: The nodes in the association relationship graph include: AS, AS link, network operator, IXP, traffic exchange infrastructure and VP; The attributes in the association relationship diagram include: AS attributes and AS link attributes; Among them, AS attributes include AS type and AS hierarchy; AS link attributes include: AS business relationship, distance between AS link and VP, number of VPs observed to AS link, and BGP community value; The nodes of the association graph are associated with each other through different relationships, including: a network operator operates an AS, a network operator operates an IXP, an AS exchanges traffic with an IXP, an AS exchanges traffic with a traffic exchange infrastructure, an IXP is located in a traffic exchange infrastructure, a VP belongs to an AS, an AS link has a source / destination AS, and a VP observes an AS link; The data of the association relationship graph comes from a public data set, including: BGP routing path and routing registration information; The route registration information includes: operator information, AS type information, IXP information, and the meaning of the BGP community value; The data of the association relationship diagram are as follows: (1) BGP routing path; Download all BGP routing paths within five days from the Route-Views and RIPE RIS public databases and filter out irrelevant and erroneous paths. The filtered BGP routing paths are the BGP routing paths of the association graph. The filtering process is as follows: First, all AS paths with destinations containing IPv4 prefixes are extracted. All paths that have appeared within the past five days are retained to minimize the number of backup paths that appear briefly. Paths that retain AS numbers due to route poisoning and AS loops are filtered out. The BGP routing path information includes: AS, AS link, VP, the distance between the AS link and the VP, the number of VPs observed to the AS link, and the BGP community value of the AS link. (2) Operator information; The operator information data includes the mapping between ASs and operators, which comes from CAIDA. Each AS has a corresponding operating organization. ASes belonging to the same operating organization are considered to have an S2S relationship and are not further inferred in subsequent inferences. (3)AS type information; Download and extract the business type data of ASes from PeeringDB, and merge the business types of ASes with similar businesses and services. For example, "Cable / DSL / Internet Service Provider," "Network Service Provider," and "Network Service" were merged into "Transmission / Access Provider"; "Government Network," "Education / Research," and "Enterprise Network" were merged into "Enterprise Network"; "Route Collector," "Route Server," and "Non-profit Network" were merged into "Non-profit Network," and "Content Provider" remained "Content Provider." Then, ignoring "non-profit network" in the merged AS business type data, the AS type information of the association relationship diagram is obtained, including: "transmission / access provider", "content provider", and "enterprise network"; Among them, "transmission / access providers" provide traffic exchange and access services on the Internet, "content providers" are suppliers of service network content, and "enterprise networks" are mainly customers, and on the Internet, they mainly refer to the AS that uses Internet services. (4) IXP information; IXPs are third-party organizations that facilitate interconnection and data exchange between autonomous systems (ASs). IXP information is aggregated by CAIDA from PeeringDB, Hurricane Electric, Packet Clearing House, Wikipedia, BGP Looking Glass, and GeoNames. The IXP information data includes: the name of the IXP, the traffic exchange infrastructure in which it is located, the IPv4 prefix, the network operator, and the member ASs; IXPs use bilateral and multilateral peering. Multilateral peering uses the route servers provided by the IXP as intermediaries to achieve dense peering. The route servers belong to the AS of the IXP and are filtered out of the AS path. (5) The meaning of BGP community value; Data was downloaded from the 18 routing registries listed by the IRR, and BGP community values ​​and their meanings were extracted. BGP community values ​​are optional 32-bit numbers in BGP messages, with the first 16 bits representing the AS of the community value and the last 16 bits representing its meaning. They are used to encode additional information related to the AS path. The inferred AS business relationships based on the meaning of BGP community values ​​were used as real data to verify the inference. Information on network operation websites was extracted from PeeringDB, as well as AS import and export rules from the RIPE NCC database, to supplement the meaning of BGP community values. Among them, for other BGP community values ​​whose meanings cannot be found, they are added to the association relationship graph.

3. The method for inferring Internet autonomous domain-level topology based on a global perspective according to claim 1, characterized in that: The step S2 is specifically as follows: S21. Determine the information required for inferring AS business relationships, including: neighbor information, observation information, hierarchy information, and coexistence information; (1)Neighbor information; Neighbor information includes: AS link triplet; AS link triplet is three adjacent links on the same path; All BGP routing paths are split into triplets. For the first hop of the path, a NULL is added as the first tuple, and for the last hop of the path, a NULL is added as the last tuple. The ratio of each business relationship between the previous and next hops of the intermediate AS is used as the probability, and the probability is classified as high, medium, and low, with values ​​greater than 0.1, 0.01 to 0.1, and less than 0.

01. (2) Observation information; Observation information includes: the number of VPs observing the AS link, the distance to the VP, and non-path information; A VP with a number of VPs observing the AS link greater than or equal to 10 is considered to be observed by a large number of VPs, while a VP with a number less than 10 is considered to be observed by a small number of VPs. A VP with a distance less than or equal to 2 is considered to be close to the VP, while a VP with a distance greater than 2 is considered to be far from the VP. Non-path information refers to neighbors in the AS topology that do not appear on the same path at the same time. It is used to describe the probability of P2P or P2C neighbors. (3) Hierarchical information; Hierarchical information includes: the location of the AS and the location of the VP; Among them, ASs at the same level have similar business strategies, so AS level information can provide constraints from a global perspective; (4) information about getting along; The information about coexistence includes: being in the same IXP and being in the same traffic exchange infrastructure; S22, constructing a training set for the Bayesian network; First, data is grouped according to VP, that is, BGP routing paths are divided into N groups according to VP; The data of observation points belonging to "full VP" are divided into N-1 groups, and the remaining data belonging to "partial VP" are divided into one group. When grouping data, the level of VP is taken into consideration, and VPs of different levels are evenly divided into different groups. Then, the AS-Rank method is used to infer preliminary AS business relationships for each group. Then, ensemble learning voting is used on the preliminary AS business relationship data of each group to obtain high-confidence AS business relationships as the training set of the Bayesian network. Among them, the preliminary AS business relationship results obtained by each group are subjected to ensemble learning and voting to obtain trusted links and fuzzy links. The inference that at least 80% of the groups agree on is considered a consensus link. When the consensus link is P2P, if no more than 20% of the groups observe the link, it is considered a trusted link. When the consensus link is P2C, if at least 80% of the groups observe the link, it is considered a trusted link. The remaining links except the trusted links are considered fuzzy links. S23. Based on step S22, the Bayesian network structure is obtained, the EM algorithm is used to train the Bayesian network, and finally, the AS business relationship is inferred; Taking high-confidence AS business relationships as input, the maximum-minimum hill climbing (MMLC) structural learning algorithm is used to obtain the probability distribution between each element. After removing edges with low probability, the Bayesian network structure associated with each element is obtained. Then, taking the AS business relationships of high-confidence trusted links and the Bayesian network structure as input, the EM algorithm is used to obtain the parameters of the Bayesian network. Finally, the trained Bayesian network is used to infer the low-confidence business relationships between ASs obtained by ensemble learning voting. Among them, the high-confidence AS business relationship is a credible link, and the low-confidence business relationship between ASs is a fuzzy link; and in subsequent iterations, it is only necessary to use the EM algorithm to update the conditional probability and infer the low-confidence AS business relationship.

4. The method for inferring Internet autonomous domain-level topology based on a global perspective according to claim 1, characterized in that: The step S3 is specifically as follows: Based on steps S1 and S2, the Internet AS-level topology is divided into five tiers: Tier 1, Tier 2, Tier 3, Tier 4, and Tier 5. The inferred order is Tier 5, Tier 4, Tier 1, Tier 2, and Tier 3, as follows: (1) Tier 5 is the lowest level AS, which has no customers and does not forward traffic. It includes stub ASs and multi-homed ASs. A stub AS is an AS that is connected to only one AS and has no clients, and a multihomed AS is an AS that is connected to multiple ASes but does not forward traffic. (2) Tier 4 is a small local supplier with only a small number of customer ASs; After Tier 5 is deleted from the topology, ASs without customers are iteratively searched and deleted. The deleted AS is Tier 4. (3) Tier 1 is the top-level densely peered AS without any upstream providers; First, use the Bron / Kerbosch algorithm to find all clusters. Then, select the largest cluster with the highest transmission degree and no more than 10 ASes. Then, select other ASes that meet the requirements and add them to the largest cluster. Finally, use the Bron / Kerbosch algorithm again to find the largest cluster by summing the transmission degrees. This largest cluster is Tier 1. (4) Tier 2 refers to some large regional and national Internet providers; Tier 2 ASes tend not to peer with other Tier 1 ASes. Starting with Tier 1, sort the ASes by their transmission degrees to find the smallest set that satisfies weak partitioning. Tier 2 is the ASes in this set excluding Tier 1. (5) Tier 3 is a regional access provider that connects with a small number of Tier 1 and Tier 2 providers to provide network services to lower-level ASes; Tier 3 is the remaining AS after inferring the ASs of other levels.

5. The method for inferring Internet autonomous domain-level topology based on a global perspective according to claim 1, characterized in that: The step S4 is specifically as follows: Define the AS-level topology association graph G = (V, E), the node type mapping function is φ: V → A, and the edge type mapping function is ψ: E → R; Where V represents a node, E represents an edge, each v∈V belongs to a special node type φ(v)∈A, and each link e∈E belongs to a special relationship type ψ(e)∈R; Using network mode T G =(A,R) to describe the meta-level of the AS-level topological association graph, that is, a directed graph defined on node type A, with edges being relationships from R; The network model includes: AS link, AS, AS type, IXP where the AS is located, traffic exchange infrastructure where the AS is located, network operator where the AS is located, AS community value marking the AS link in the BGP path, distance of the AS link from the observation point, and number of VPs observed on the AS link; Wherein, if the distance between the AS link and the observation point is greater than 2 hops, it is a long distance; otherwise, it is a short distance; if the number of VPs observed on the AS link is greater than or equal to 10, it is a large number of VPs; otherwise, it is a small number of VPs; Then the meta-paths related to the AS business relationship in the network model include: (AS link, AS, IXP, AS, AS link), (AS link, AS, traffic exchange infrastructure, AS, AS link), (AS link, AS, AS type, AS, AS link), (AS link, AS, network operator, AS, AS link), (AS link, BGP community value, AS link), (AS link, long distance, AS link), (AS link, short distance, AS link), (AS link, a large number of VPs, AS link), (AS link, a small number of VPs, AS link); In the network mode T G =(A,R), the meta-path P in the AS-level topology association graph is represented as Then a node A1 and node A l The compound relationship between Among them, A l Indicates the lth node type, R l-1 Indicates the l-1th relationship type; For a given symmetric meta-path P, the Pathsim metric expression for AS links x and y of the same type is defined as follows: Among them, p x→y represents the path between x and y, p x→x represents the path between x and x, p y→y represents the path between y and y; Based on the above-obtained Internet AS-level topology relationship network G = (V, E) and network model T G , meta-path P=(A1A2…A l ), calculate the matrix in, Indicates A i and A j The adjacency matrix, M represents the calculation matrix, M ij Represents the value of the i-th row and j-th column of M, that is, the object x under the meta-path P i ∈A1 and x j ∈A l The number of paths between Then from the same type of x i and x j The Pathsim between two objects is Among them, M ii and M jj Indicates that given a meta-path in the network x i and x j visibility; Then traverse all the levels, for those in (Tier i ,Tier j ) links L(i,j), calculate the Pathsim between P2P links and P2C links respectively, and Tier i The level is not lower than Tier j level; When obtaining the calculation matrix M, the common number of IXPs, BGP community values, and network operators connected to the AS links is calculated and then normalized to represent the three types of meta-paths: IXPs, BGP community values, and network operators. Then, for a given business relationship c1∈{P2P,P2C}, the average similarity ranking of each AS link and the rest of the AS links is calculated, and the AS links L ranked before Δ are considered similar. Similar (i, j), and the remaining AS links with lower rankings are regarded as dissimilar links L Dissimilar (i,j); Among them, Δ is set according to the actual situation; Then for the dissimilar AS link L Dissimilar (i,j) further judges that the dissimilar AS links L Dissimilar (i,j) and in (Tier i ,Tier j ) calculate the similar links of another business relationship c2∈{P2P,P2C},c1≠c2, and consider the ones in the top Δ as being able to be adjusted, that is, to be adjusted to another business relationship c2; for these dissimilar AS links L Dissimilar (i,j) The remaining unadjusted links, if Tier i If it is not Tier 1, then (Tier i-1 ,Tier j ) similar links are calculated, if Tier j If it is not Tier 5, then (Tier i ,Tier j+1 ) are calculated, and the links ranked higher than Δ are considered as links that can be adjusted. Candidate ; The AS link that has not been adjusted at the end will not be adjusted again; After traversing all levels, judge L Candidate Whether the AS level in the AS needs to be adjusted; for any AS, calculate the number of times that the levels of all its associated links need to be modified. If the number of times the levels need to be modified is greater than the number that do not need to be modified, then modify the AS level.

6. The method for inferring Internet autonomous domain-level topology based on a global perspective according to claim 3, characterized in that: In step S2, when inferring AS business relationships for the first time, the AS hierarchy is roughly divided based on the AS topology and node degree, as follows: First, consider the ASs with degree 1 in the topology as Tier 5, and the ASs with degree 2 connected to Tier 5 as Tier 4. Then use the Bron / Kerbosch algorithm to find the largest clique as Tier 1. Next, consider the ASs connected to Tier 1 with a degree greater than or equal to 100 as Tier 2. Finally, the remaining ASes are Tier 3. In subsequent iterations, the AS hierarchy information inferred in step S3 is added.

Images