Transform model-based inter-domain routing anomaly detection method and system

Abstract

The invention discloses an inter-domain routing anomaly detection method and system based on a Transform model, and the method comprises the steps: collecting BGP routing data based on a collection point, and constructing a dynamic BGP network topology; extracting each AS node sub-graph in the BGP network topology, and extracting related feature information to obtain a graph model; according to the graph model with the related feature information, calculating fingerprint information of the graph model based on Simhash; and according to the fingerprint information obtained at the previous and later moments, constructing an anomaly detection model for inter-domain routing anomaly detection by adopting a Transform and GCN framework. According to the invention, the behavior information of the AS in the dynamic BGP network can be accurately captured; according to the method, incomplete information is accurately compensated by combining local information extracted by graph convolution and global information extracted by an attention mechanism, so that the anomaly detection accuracy is improved.

Description

Technical Field

[0001] The present invention belongs to the field of inter-domain anomaly detection in inter-domain routing security, and in particular relates to an inter-domain routing anomaly detection method based on a Transformer model. Background Art

[0002] Border Gateway Protocol (BGP) is a routing protocol for an autonomous system running on TCP. BGP anomaly detection detects anomalies through actively and passively acquired routing data, and further locates suspicious routing information (prefix, AS, etc.), so that operation and maintenance personnel can quickly trace the source and mitigate the anomaly. This type of method usually uses massive BGP historical routing data, analyzes historical BGP routing behavior rules and patterns as prior knowledge, detects BGP routing messages sent by AS, and effectively identifies BGP anomalies and traces them.

[0003] However, the existing anomaly detection methods still have a lot of room for improvement in terms of real-time, accuracy and intelligence. Faced with many challenges such as the bias and incompleteness of observation data, the dynamic changes in BGP routing behavior, and large-scale BGP networks, existing methods cannot achieve real-time and accuracy at the same time. Therefore, it is necessary to carry out research on BGP anomaly detection and traceability mechanisms, monitor the global BGP operation status in real time, and conduct traceability analysis to ensure national inter-domain network security. Summary of the invention

[0004] The present invention aims at the challenges faced by existing anomaly detection methods, such as bias and incompleteness of collected data; dynamic changes in BGP routing behavior; and the BGP network being a distributed system with a large scale.

[0005] An object of the present invention is to provide an inter-domain routing anomaly detection method based on a Transformer model, aiming to solve one of the technical problems at least to a certain extent.

[0006] Another object of the present invention is to provide an inter-domain routing anomaly detection system based on the Transformer model.

[0007] In order to achieve the above-mentioned object, the present invention provides, on one hand, a method for detecting anomalies in inter-domain routing based on a Transformer model, comprising:

[0008] Collect BGP routing data based on collection points and build dynamic BGP network topology;

[0009] Extract each AS node subgraph in the BGP network topology, extract relevant feature information, and obtain a graph model;

[0010] According to the graph model with relevant feature information, the fingerprint information of the graph model is calculated based on Simhash;

[0011] According to the fingerprint information obtained before and after, the Transformer and GCN frameworks are used to build an anomaly detection model for inter-domain routing anomaly detection.

[0012] A further preferred technical solution of the present invention is that the BGP routing data is collected based on the collection point to build a dynamic BGP network topology; specifically:

[0013] Collect BGP routing data based on global collection points, including BGP routing table data and BGP routing update data;

[0014] Build a global routing topology based on BGP routing table data;

[0015] Then, according to the current BGP routing update data, the global routing topology is updated to obtain the current BGP network topology.

[0016] Preferably, the step of extracting each AS node subgraph in the BGP network topology and extracting relevant feature information to obtain a graph model is as follows:

[0017] Traverse each AS node in the BGP network topology and extract its first-order Ego subgraph;

[0018] Calculate the relevant feature information of AS nodes, including edge features, local topology features, global topology features, and path-related features.

[0019] Preferably, the fingerprint information of the graph model is calculated based on Simhash according to the graph model with relevant feature information; specifically:

[0020] Use cyclic redundancy coding to hash the m AS nodes and n edge names in the BGP network topology to form a b-bit binary number, expressed as:

[0021]

[0022] In the formula, and They are respectively represented as the set of nodes and connected edges at the current time t;

[0023] Normalize the AS node features to obtain the feature vector at time t , and reverse the positive and negative values ​​according to the obtained hash value, and then sum them up by row to get the fingerprint information of the i-th AS node , expressed as:

[0024]

[0025] In the formula, Represents a function for obtaining fingerprint information; It is represented as the jth bit of the i-th AS node; is the jth feature of the i-th AS node at the current time t, and b is the number of binary digits output by the hash function;

[0026] Then, the negative position of the fingerprint information of each AS node is set to 0, and the positive position is set to 1, to obtain the fingerprint vector of each AS node, forming a global fingerprint matrix, which is expressed as:

[0027]

[0028] in, .

[0029] As a preferred method, based on the fingerprint information obtained before and after, a Transformer and GCN framework is used to build an anomaly detection model for inter-domain routing anomaly detection; specifically:

[0030] First, perform an XOR operation on the global fingerprint matrix obtained at this moment and the previous moment, input the fingerprint information after the XOR operation into the Transformer module, and output the attention vector matrix. The specific calculation formula is:

[0031]

[0032]

[0033]

[0034]

[0035] in, represents the normalized query tensor, represents a key-value tensor, represents a numerical tensor, N represents the number of nodes in the BGP network topology, represents an N-dimensional all-1 column vector; represents the first layer input of the attention network, namely the fingerprint data, is a hyperparameter representing the proportion of residual connections;

[0036] , and They represent the linear transformation functions, represents the function of taking the diagonal elements of the matrix, represents the Frobenius norm;

[0037] At the same time, the adjacency information of the BGP network topology and the fingerprint information after the XOR operation are input into the GCN network, and the pooling operation is performed to output the GCN representation tensor, which is expressed as:

[0038]

[0039] In the formula, represents the l-th layer structure of GCN, represents the degree matrix of the AS graph, represents the adjacency matrix of the AS graph, Indicates The GCN output matrix of the layer, Indicates GCN The learning matrix of the layer, represents the vector dimension of the hidden layer, Represents a nonlinear activation function, using the RELU activation function;

[0040] The obtained attention vector matrix is ​​connected with the GCN representation tensor, and the result is input into the multi-layer perceptron to obtain the output at the current time t , by calculating the binary cross entropy loss Update the gradient variable, expressed as:

[0041]

[0042]

[0043] In the formula, Represents the GCN network The output matrix at time instant, represents the global fingerprint matrix, Represents the attention network Output at the moment; Indicates the number of abnormal categories, represents the identifier of the cth category of the ith sample, represents the output score for the cth category of the ith sample; in addition, Represents the concatenation operation of the matrix;

[0044] According to the detection model, inter-domain routing anomaly detection is performed.

[0045] As a preference, according to the constructed anomaly detection model, the reconstruction loss Construct a traceability analysis model, expressed as:

[0046]

[0047] In the formula, , Represent the deviation loss function and classification loss function respectively; is the label of the i-th sample.

[0048] Another aspect of the present invention provides an inter-domain routing anomaly detection system based on a Transformer model, comprising:

[0049] Data collection and topology construction module, used to collect BGP routing data based on collection points and build dynamic BGP network topology;

[0050] The feature extraction module is used to extract each AS node in the BGP network topology and extract relevant feature information to obtain a graph model;

[0051] A fingerprint information calculation module, used for calculating fingerprint information of a graph model based on Simhash according to a graph model with relevant feature information;

[0052] The anomaly detection model building module is used to build an anomaly detection model based on the fingerprint information obtained before and after the moment, using the Transformer and GCN framework, for inter-domain routing anomaly detection.

[0053] Another aspect of the present invention provides a non-transitory computer-readable storage medium having computer instructions stored thereon, the computer instructions enabling a computer to execute the above-mentioned inter-domain routing anomaly detection method based on the Transformer model.

[0054] Another aspect of the present invention provides an electronic device, comprising: a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus, and the processor calls the logic instructions in the memory to execute the above-mentioned inter-domain routing anomaly detection method based on the Transformer model.

[0055] On the other hand, the present invention provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer executes the above-mentioned inter-domain routing anomaly detection method based on the Transformer model.

[0056] Beneficial effects: The inter-domain routing anomaly detection method based on the Transformer model of the present invention obtains rich fingerprint information of each AS by sampling the global BGP network subgraph and calculating Simhash, which includes the edge information and node information of the subgraph, so as to accurately capture the behavior information of the AS in the dynamic BGP network;

[0057] The inter-domain routing anomaly detection method based on the Transformer model of the present invention performs parallel tensor processing on the fingerprint information of the global AS by calculating the linear attention mechanism, thereby reducing the complexity, so that the vector representation of the global AS can be calculated at the same time, avoiding the problem of memory overflow in the original method;

[0058] In order to overcome the local incomplete information of the collection point, the present invention proposes to use a method that combines the local information extracted by graph convolution and the global information extracted by the attention mechanism to accurately compensate for the incomplete information, thereby improving the accuracy of anomaly detection and tracing. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 This is a flow chart of the inter-domain routing anomaly detection method based on the Transformer model in Example 1 of the present invention.

[0060] Figure 2 This is a flowchart of detecting and tracing BGP anomalies based on the linear attention mechanism in Example 1 of the present invention.

[0061] Figure 3 This is a comparison chart of performance indicators of the method in Example 1 of the present invention at different partial observation degrees. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings in the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments, and they should not be understood as limitations on the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. In the description of the present invention, it should be understood that the terms used are only for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0063] Combine the following Figure 1-Figure 3 The present invention describes a method and system for detecting anomalies in inter-domain routing based on a Transformer model.

[0064] Before describing the embodiments of the present invention in detail, some terms involved in the present invention are first explained.

[0065] BGP, the full name is Border Gateway Protocol, which corresponds to Border Gateway Protocol in Chinese. BGP is a core decentralized autonomous routing protocol on the Internet.

[0066] AS, (Autonomous system), Autonomous system AS is a collection of connected Internet Protocol IP routing prefixes under the control of one or more network operators on behalf of a single management entity or domain, which provides a common and well-defined routing policy to the Internet. AS is a collection of multiple routers identified by a unique autonomous system number under a single technical management system; it is a giant network or network group with (the same or multiple) routing protocol policies. Typically, each AS is operated by a single large organization (such as an Internet Service Provider (IPS), a large enterprise technology company, a university, or a government agency); among them, each ISP can be in charge of multiple ASs.

[0067] Simhash is a text similarity algorithm. Its main idea is dimensionality reduction. It maps high-dimensional feature vectors into low-dimensional feature vectors and uses the Hamming distance between two vectors to determine whether the articles are repeated or highly similar.

[0068] GCN (Graph Convolutional Network) is a graph convolutional network, a widely used graph neural network, which is a convolutional neural network that can directly act on graphs and utilize their structural information.

[0069] Embodiment 1: This embodiment provides a method for detecting anomalies in inter-domain routing based on a Transformer model.

[0070] Faced with the increasing routing scale and dynamically changing global AS connection topology, it is a huge challenge to accurately perceive BGP abnormal situations. In order to cope with the above technical challenges, this embodiment proposes a method for detecting inter-domain routing anomalies based on the Transformer model, thereby overcoming the characteristics of BGP dynamic changes, complex BGP network and large scale.

[0071] In this embodiment, firstly, the global BGP network topology is constructed based on the routing table (RIB table) and the routing update table and dynamically updated; then, graph-related features and statistical-related features are extracted based on the constructed BGP network topology, including edge features, local topology features, global topology features, and path-related features; Simhash is used to calculate the fingerprint information of the entire graph based on the extracted features, thereby embedding the information into the Hamming space; in order to overcome the challenge of the large scale of the BGP network that makes the global AS feature calculation amount, a linear attention mechanism is used to process the fingerprint information of the AS. Specifically, the inter-domain routing anomaly detection method based on the Transformer model of this embodiment, such as Figure 1 As shown, the following steps are included:

[0072] S1. Collect BGP routing data based on global collection points, including BGP routing table data and BGP routing update data.

[0073] S2. Build a dynamic BGP routing topology, specifically:

[0074] S21, according to the BGP routing table data R t-1 Build a global routing topology;

[0075] Then update the data U according to the current BGP route t , update the global routing topology to obtain the current BGP network topology R t .

[0076] S3. Extract each AS node subgraph in the BGP network topology and extract relevant feature information to obtain a graph model; specifically:

[0077] S31, traverse each AS node in the BGP network topology and extract its first-order Ego subgraph;

[0078] S32. Calculate the relevant characteristic information of the AS node, including the out-degree, in-degree and Pagerank value of the node, and calculate the edge information of the topology, that is, the number of prefixes flowing through the AS.

[0079] S4. According to the graph model with relevant feature information, the fingerprint information of the graph model is calculated based on Simhash; specifically:

[0080] S41. Use cyclic redundancy coding to perform hash calculation on the m AS nodes and n edge names in the BGP network topology to form a b-bit binary number, expressed as:

[0081]

[0082] In the formula, and They are respectively represented as the set of nodes and connected edges at the current time t;

[0083] S42, normalize the AS node features to obtain the feature vector at time t , and reverse the positive and negative values ​​according to the obtained hash value, and then sum them up by row to get the fingerprint information of the i-th AS node , expressed as:

[0084]

[0085] In the formula, Represents a function for obtaining fingerprint information; It is represented as the jth bit of the i-th AS node; is the jth feature of the i-th AS node at the current time t, and b is the number of binary digits output by the hash function;

[0086] S43, then the negative value position of the fingerprint information of each AS node is set to 0, and the positive value position is set to 1, to obtain the fingerprint vector of each AS node, and form a global fingerprint matrix, which is expressed as:

[0087]

[0088] in, .

[0089] S5. Based on the fingerprint information obtained before and after, the Transformer and GCN frameworks are used to build an anomaly detection model for inter-domain routing anomaly detection; Figure 2 As shown, specifically:

[0090] S51, first perform an XOR operation on the global fingerprint matrix obtained at this moment and the previous moment, input the fingerprint information after the XOR operation into the Transformer module, and output the attention vector matrix. The specific calculation formula is:

[0091]

[0092]

[0093]

[0094]

[0095] in, represents the normalized query tensor, represents a key-value tensor, represents a numerical tensor, N represents the number of nodes in the BGP network topology, represents an N-dimensional all-1 column vector; represents the first layer input of the attention network, namely the fingerprint data, is a hyperparameter representing the proportion of residual connections;

[0096] , and They represent the linear transformation functions, represents the function of taking the diagonal elements of the matrix, represents the Frobenius norm;

[0097] S52, at the same time, the adjacency information of the BGP network topology and the fingerprint information after the XOR operation are input into the GCN network, a pooling operation is performed, and a GCN representation tensor is output, which is expressed as:

[0098]

[0099] In the formula, represents the l-th layer structure of GCN, represents the degree matrix of the AS graph, represents the adjacency matrix of the AS graph, Indicates The GCN output matrix of the layer, Indicates GCN The learning matrix of the layer, represents the vector dimension of the hidden layer, Represents a nonlinear activation function, using the RELU activation function;

[0100] S53, connect the obtained attention vector matrix with the GCN representation tensor, and input the result into the multi-layer perceptron to obtain the output at the current time t , by calculating the binary cross entropy loss Update the gradient variables, build the abnormal model, and reconstruct the loss Construct a traceability analysis model. It can be expressed as:

[0101]

[0102]

[0103]

[0104] In the formula, Represents the GCN network The output matrix at time instant, represents the global fingerprint matrix, Represents the attention network Output at the moment; Indicates the number of abnormal categories, represents the identifier of the cth category of the ith sample, represents the output score for the cth category of the ith sample; in addition, Represents the concatenation operation of the matrix;

[0105] , Represent the deviation loss function and classification loss function respectively; is the label of the i-th sample.

[0106] In order to detect the effect of anomaly detection of the inter-domain routing anomaly detection method based on the Transformer model of this embodiment under global real data, the present invention uses RIPENCC and RouteView global public collection points to collect BGP routing data. In the constructed dataset, based on the grid search results, 1 minute is used as the time window to construct a data sample. Then the data is labeled according to the occurrence time of the actual abnormal event and the reported abnormal routing information. The simulation experiment platform is Python 3.10 software under the Linux system (the analysis results of the present invention are not affected by the operating system and Python software version). In addition, the geographic location and ranking information of AS are obtained from the official authoritative data of Caida.

[0107] from Figure 3 It can be seen from the table that the method in Example 1 and the comparative method (BGPViewer and MSLSTM method) have specific performance indicators under different degrees of partial observation. Compared with the comparative method, the method in Example 1 can overcome the negative impact of partial observation, has higher accuracy and F1 score, and lower false alarm rate and missed alarm rate. This shows that the method in Example 1 has higher robustness than the comparative method as the missing information increases.

[0108] It can be seen from the above experimental results that the inter-domain routing anomaly detection method based on the Transformer model proposed in the present invention can more accurately detect BGP anomalies and perform source tracing analysis.

[0109] Embodiment 2: This embodiment provides an inter-domain routing anomaly detection system based on a Transformer model, including:

[0110] Data collection and topology construction module, used to collect BGP routing data based on collection points and build dynamic BGP network topology;

[0111] The feature extraction module is used to extract each AS node in the BGP network topology and extract relevant feature information to obtain a graph model;

[0112] A fingerprint information calculation module, used for calculating fingerprint information of a graph model based on Simhash according to a graph model with relevant feature information;

[0113] The anomaly detection model building module is used to build an anomaly detection model based on the fingerprint information obtained before and after the moment, using the Transformer and GCN framework, for inter-domain routing anomaly detection.

[0114] Embodiment 3: This embodiment provides a non-transitory computer-readable storage medium, on which computer instructions are stored, and the computer instructions enable a computer to execute a method for detecting anomalies in inter-domain routing based on a Transformer model, the method comprising the following steps:

[0115] Collect BGP routing data based on collection points and build dynamic BGP network topology;

[0116] Extract each AS node in the BGP network topology and relevant feature information to obtain a graph model;

[0117] According to the graph model with relevant feature information, the fingerprint information of the graph model is calculated based on Simhash;

[0118] According to the fingerprint information obtained before and after, the Transformer and GCN frameworks are used to build an anomaly detection model for inter-domain routing anomaly detection.

[0119] Embodiment 4: This embodiment provides an electronic device, which may include: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus. The processor may call the logic instructions in the memory to execute the inter-domain routing anomaly detection method based on the Transformer model, and the method includes the following steps:

[0120] Collect BGP routing data based on collection points and build dynamic BGP network topology;

[0121] Extract each AS node in the BGP network topology and relevant feature information to obtain a graph model;

[0122] According to the graph model with relevant feature information, the fingerprint information of the graph model is calculated based on Simhash;

[0123] According to the fingerprint information obtained before and after, the Transformer and GCN frameworks are used to build an anomaly detection model for inter-domain routing anomaly detection.

[0124] In addition, the logic instructions in the above-mentioned memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program code.

[0125] Embodiment 5: This embodiment provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute an inter-domain routing anomaly detection method based on a Transformer model, which includes the following steps:

[0126] Collect BGP routing data based on collection points and build dynamic BGP network topology;

[0127] Extract each AS node in the BGP network topology and relevant feature information to obtain a graph model;

[0128] According to the graph model with relevant feature information, the fingerprint information of the graph model is calculated based on Simhash;

[0129] According to the fingerprint information obtained before and after, the Transformer and GCN frameworks are used to build an anomaly detection model for inter-domain routing anomaly detection.

[0130] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0131] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0132] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting anomalies in inter-domain routing based on a Transformer model, characterized in that: include: Collect BGP routing data based on collection points and build dynamic BGP network topology; Extract each AS node subgraph in the BGP network topology, extract relevant feature information, and obtain a graph model; According to the graph model with relevant feature information, the fingerprint information of the graph model is calculated based on Simhash; According to the fingerprint information obtained before and after, the Transformer and GCN frameworks are used to build an anomaly detection model for inter-domain routing anomaly detection.

2. According to the Transformer model-based inter-domain routing anomaly detection method according to claim 1, it is characterized in that: The method collects BGP routing data based on the collection point and constructs a dynamic BGP network topology; specifically: Collect BGP routing data based on global collection points, including BGP routing table data and BGP routing update data; Build a global routing topology based on BGP routing table data; Then, according to the current BGP routing update data, the global routing topology is updated to obtain the current BGP network topology.

3. According to the Transformer model-based inter-domain routing anomaly detection method according to claim 1, it is characterized in that: The step of extracting each AS node subgraph in the BGP network topology and extracting relevant feature information to obtain a graph model is as follows: Traverse each AS node in the BGP network topology and extract its first-order Ego subgraph; Calculate the relevant feature information of AS nodes, including edge features, local topology features, global topology features, and path-related features.

4. The method for detecting anomalies in inter-domain routing based on the Transformer model according to claim 1, characterized in that: The method of calculating the fingerprint information of the graph model based on Simhash according to the graph model with relevant feature information is as follows: Use cyclic redundancy coding to hash the m AS nodes and n edge names in the BGP network topology to form a b-bit binary number, expressed as: ； In the formula, and They are respectively represented as the set of nodes and connected edges at the current time t; Normalize the AS node features to obtain the feature vector at time t , and reverse the positive and negative values ​​according to the obtained hash value, and then sum them up by row to get the fingerprint information of the i-th AS node , expressed as: ； In the formula, Represents a function for obtaining fingerprint information; It is represented as the jth bit of the i-th AS node; is the jth feature of the i-th AS node at the current time t, and b is the number of binary digits output by the hash function; Then, the negative position of the fingerprint information of each AS node is set to 0, and the positive position is set to 1, to obtain the fingerprint vector of each AS node, forming a global fingerprint matrix, which is expressed as: ； in, .

5. According to claim 4, the method for detecting anomalies in inter-domain routing based on the Transformer model is characterized in that: Based on the fingerprint information obtained before and after, the Transformer and GCN frameworks are used to build an anomaly detection model for inter-domain routing anomaly detection. Specifically: First, perform an XOR operation on the global fingerprint matrix obtained at this moment and the previous moment, input the fingerprint information after the XOR operation into the Transformer module, and output the attention vector matrix. The specific calculation formula is: ； ； ； ； in, represents the normalized query tensor, represents a key-value tensor, represents a numerical tensor, N represents the number of nodes in the BGP network topology, represents an N-dimensional all-1 column vector; represents the first layer input of the attention network, namely the fingerprint data, is a hyperparameter representing the proportion of residual connections; , and They represent the linear transformation functions, represents the function of taking the diagonal elements of the matrix, represents the Frobenius norm; At the same time, the adjacency information of the BGP network topology and the fingerprint information after the XOR operation are input into the GCN network, and the pooling operation is performed to output the GCN representation tensor, which is expressed as: ； In the formula, Represents the first Layer structure, represents the degree matrix of the AS graph, represents the adjacency matrix of the AS graph, Indicates The GCN output matrix of the layer, Indicates GCN The learning matrix of the layer, represents the vector dimension of the hidden layer, Represents a nonlinear activation function, using the RELU activation function; The obtained attention vector matrix is ​​connected with the GCN representation tensor, and the result is input into the multi-layer perceptron to obtain the output at the current time t , by calculating the binary cross entropy loss Update the gradient variable, expressed as: ； ； In the formula, Represents the GCN network The output matrix at time instant, represents the global fingerprint matrix, Represents the attention network Output at the moment; Indicates the number of abnormal categories, represents the identifier of the cth category of the ith sample, represents the output score for the cth category of the ith sample; in addition, Represents the concatenation operation of the matrix; According to the detection model, inter-domain routing anomaly detection is performed.

6. The method for detecting anomalies in inter-domain routing based on the Transformer model according to claim 5, characterized in that: According to the constructed anomaly detection model, the reconstruction loss Construct a traceability analysis model, expressed as: ； In the formula, , Represent the deviation loss function and classification loss function respectively; is the label of the i-th sample.

7. A Transformer-based inter-domain routing anomaly detection system, characterized in that: include: Data collection and topology construction module, used to collect BGP routing data based on collection points and build dynamic BGP network topology; The feature extraction module is used to extract each AS node in the BGP network topology and extract relevant feature information to obtain a graph model; A fingerprint information calculation module, used for calculating fingerprint information of a graph model based on Simhash according to a graph model with relevant feature information; The anomaly detection model building module is used to build an anomaly detection model based on the fingerprint information obtained before and after the moment, using the Transformer and GCN framework, for inter-domain routing anomaly detection.

8. A non-transitory computer-readable storage medium, characterized in that: Computer instructions are stored thereon, and the computer instructions enable the computer to execute the inter-domain routing anomaly detection method based on the Transformer model as described in any one of claims 1-6.

9. An electronic device, characterized in that: include: A processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus, and the processor calls the logic instructions in the memory to execute the inter-domain routing anomaly detection method based on the Transformer model according to any one of claims 1 to 6.

10. A computer program product, characterized in that The computer program product includes a computer program, which is stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer executes the inter-domain routing anomaly detection method based on the Transformer model according to any one of claims 1 to 6.

Images