BGP (Border Gateway Protocol) abnormal route identification method, device, equipment and medium

Abstract

The invention discloses a BGP (Border Gateway Protocol) abnormal route identification method, device and equipment and a medium, and the method comprises the steps: obtaining a plurality of pieces of network flow data in a current time period from a boundary router of each AS (Application Server), and a plurality of route update messages of which a source AS of an AS path is a target AS; determining an abnormal IP prefix and a normal IP prefix of the target AS based on the routing declaration data or the routing withdrawal data of each routing update message; determining the index data of the abnormal IP prefix and the index data of the normal IP prefix in the current time period based on the destination IP address, the abnormal IP prefix and the normal IP prefix of each piece of network flow data; determining an abnormal influence degree based on the index data of the abnormal IP prefix and the index data of the normal IP prefix in the current time period; and determining whether the target AS has an abnormal route in the current time period based on the abnormal influence degree and a set threshold value. According to the method, the accuracy of identifying the BGP abnormal routing can be improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network information security, and in particular to a BGP abnormal routing identification method, device, equipment and medium. Background Art

[0002] In the huge network architecture of the operator level, the Border Gateway Protocol (BGP) is not only a key protocol for achieving route reachability and optimal routing between autonomous systems (AS), but its security is also the cornerstone for ensuring the stable operation of the entire Internet and secure data transmission. With the rapid development of network technology, the security issues of the BGP protocol have gradually become prominent and have become the focus of attention of operators and network security experts.

[0003] The BGP protocol exchanges routing information through the Transmission Control Protocol (TCP). Although this mechanism ensures the reliability of data transmission, it also exposes BGP to the risk of being exploited by malicious attackers. Attackers may inject false routing information into the network by forging BGP update messages, inducing legitimate traffic to flow to maliciously controlled paths, thereby implementing attacks such as route hijacking, data theft, and service interruption. In addition, the leakage of BGP paths may also expose the network topology, providing attackers with attack targets and strategies.

[0004] Currently, control plane signaling exchanged by the BGP protocol, namely, route update messages, is usually used to identify abnormal routes. However, due to the extreme complexity of network configuration, the accuracy of identifying abnormal routes is not high if only these control plane messages are used to identify abnormal routes. Summary of the invention

[0005] The embodiments of the present application provide a BGP abnormal route identification method, apparatus, device and medium to improve the accuracy of identifying BGP abnormal routes.

[0006] In a first aspect, an embodiment of the present application provides a BGP abnormal routing identification method, comprising:

[0007] Obtain multiple network traffic data in the current time period from the border routers of each autonomous system AS, as well as multiple routing update messages whose source AS of the AS path is the target AS;

[0008] Determining an abnormal Internet Protocol IP prefix and a normal IP prefix of the target AS based on the route announcement data or the route withdrawal data of each route update message;

[0009] Based on the destination IP address of each piece of network traffic data and the abnormal IP prefix, determine the indicator data of the abnormal IP prefix in the current time period; and based on the destination IP address of each piece of network traffic data and the normal IP prefix, determine the indicator data of the normal IP prefix in the current time period;

[0010] Determine the abnormal impact of the abnormal IP prefix based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the normal IP prefix in the current time period, wherein the abnormal impact is used to characterize the degree of influence of the abnormal IP prefix on network traffic in the current time period;

[0011] The abnormal impact degree is compared with a set threshold, and based on the comparison result, it is determined whether there is an abnormal route in the target AS within the current time period.

[0012] In an embodiment of the present application, multiple network flow data and multiple routing update messages of the source AS of the AS path as the target AS in the current time period are obtained, and based on the routing announcement data or routing withdrawal data of each routing update message, the abnormal IP prefix and normal IP prefix of the target AS are determined to improve the accuracy of identifying the abnormal IP prefix and normal IP prefix of the target AS. In addition, the present application determines the index data of the abnormal IP prefix in the current time period and the index data of the normal IP prefix in the current time period based on the destination IP address, abnormal IP prefix and normal IP prefix of each network flow data, and determines the abnormal impact of the abnormal IP prefix based on the index data of the abnormal IP prefix in the current time period and the index data of the normal IP prefix in the current time period, so as to more accurately characterize the influence of the abnormal IP prefix on the network flow in the current time period. The present application compares the abnormal impact with the set threshold, and determines whether the target AS has an abnormal route in the current time period based on the comparison result, improves the accuracy of identifying BGP abnormal routes, and reduces the cost of manual participation.

[0013] In one possible design, determining the abnormal IP prefix and the normal IP prefix of the target AS based on the route announcement data or the route withdrawal data of each route update message includes:

[0014] The announcement time of each route announcement data and the withdrawal time of each route withdrawal data belonging to the same IP prefix are sorted from early to late to determine the interruption time period of each IP prefix;

[0015] Determine, based on the interruption time period of each IP prefix belonging to the target AS, the number of IP prefixes in the target AS that are in an interruption state in each sub-time period of the current time period, wherein the current time period includes a plurality of sub-time periods;

[0016] Determine an interruption rate of the target AS in each sub-time period based on the number of IP prefixes in the target AS in an interrupted state and the total number of IP prefixes of the target AS in each sub-time period;

[0017] For each sub-time period, if the interruption rate of the target AS in the sub-time period is greater than the set probability threshold, the IP prefix in the target AS in the sub-time period that is in an interrupted state is used as the abnormal IP prefix, and the IP prefix in the target AS in a non-interrupted state is used as the normal IP prefix.

[0018] In an embodiment of the present application, based on the announcement time of each route announcement data belonging to the same IP prefix and the withdrawal time of each route withdrawal data, the interruption time period of each IP prefix is ​​determined to reflect the interruption of each IP prefix, and based on the interruption time period of each IP prefix belonging to the target AS, the number of IP prefixes in the target AS in an interrupted state in each sub-time period of the current time period is determined, thereby determining the interruption rate of the target AS in each sub-time period based on the number of IP prefixes in the target AS in an interrupted state in each sub-time period and the total number of IP prefixes of the target AS to reflect the degree of interruption of the target AS in each sub-time period. The present application determines the abnormal IP prefix and normal IP prefix of the target AS based on the interruption rate of the target AS in each sub-time period and the set probability threshold, thereby improving the accuracy of identifying the abnormal IP prefix and normal IP prefix of the target AS.

[0019] In one possible design, determining the abnormal IP prefix and the normal IP prefix of the target AS based on the route announcement data or the route withdrawal data of each route update message includes:

[0020] Determine the registered IP prefix of the target AS based on the corresponding relationship between the target AS and the set corresponding relationship, wherein the corresponding relationship is the corresponding relationship between each AS and each registered IP prefix;

[0021] For each IP prefix of the route announcement data or the route withdrawal data of the route update message, if the IP prefix does not exist in the registered IP prefixes of the target AS, and the AS path of the route announcement data or the route withdrawal data of the route update message does not satisfy the set AS business relationship, then the IP prefix is ​​determined to be the abnormal IP prefix;

[0022] If the IP prefix exists in the registered IP prefixes of the target AS, or the IP prefix does not exist in the registered IP prefixes of the target AS, and the AS path of the route declaration data or route withdrawal data of the route update message satisfies the set AS business relationship, then the IP prefix is ​​determined to be the normal IP prefix.

[0023] In an embodiment of the present application, based on the corresponding relationship between the target AS and the setting, the registered IP prefix of the target AS is determined, and for the IP prefix of the route announcement data or the route withdrawal data of each route update message, based on whether the IP prefix exists in the registered IP prefixes of the target AS, and whether the AS path of the route update message satisfies the set AS business relationship, it is judged whether the IP prefix is ​​a hijacked IP prefix, that is, the abnormal IP prefix and the normal IP prefix of the target AS are determined, thereby improving the accuracy of identifying the abnormal IP prefix and the normal IP prefix of the target AS.

[0024] In a possible design, determining the indicator data of the abnormal IP prefix in the current time period based on the destination IP address of each piece of network traffic data and the abnormal IP prefix includes:

[0025] Based on the destination IP address of each piece of network traffic data and the abnormal IP prefix, determine the network traffic data corresponding to the abnormal IP prefix in the current time period;

[0026] Determine an indicator value of at least one set flow indicator of the abnormal IP prefix based on network flow data corresponding to the abnormal IP prefix in the current time period;

[0027] Based on an indicator value of at least one set traffic indicator of the abnormal IP prefix, indicator data of the abnormal IP prefix in a current time period is determined.

[0028] In an embodiment of the present application, based on the destination IP address and abnormal IP prefix of each piece of network traffic data, the network traffic data corresponding to the abnormal IP prefix in the current time period is determined, and based on the network traffic data corresponding to the abnormal IP prefix in the current time period, the indicator value of at least one set traffic indicator of the abnormal IP prefix is ​​determined, thereby obtaining the indicator data of the abnormal IP prefix in the current time period, and improving the accuracy of the indicator data of the abnormal IP prefix in the current time period.

[0029] In a possible design, determining the indicator data of the normal IP prefix in the current time period based on the destination IP address of each piece of network traffic data and the normal IP prefix includes:

[0030] Based on the destination IP address of each piece of network traffic data and the normal IP prefix, determine the network traffic data corresponding to the normal IP prefix in the current time period;

[0031] Determine an indicator value of at least one set flow indicator of the normal IP prefix based on network flow data corresponding to the normal IP prefix in the current time period;

[0032] Based on an indicator value of at least one set traffic indicator of the normal IP prefix, indicator data of the normal IP prefix in a current time period is determined.

[0033] In an embodiment of the present application, based on the destination IP address and normal IP prefix of each piece of network traffic data, the network traffic data corresponding to the normal IP prefix in the current time period is determined, and based on the network traffic data corresponding to the normal IP prefix in the current time period, the indicator value of at least one set traffic indicator of the normal IP prefix is ​​determined, thereby obtaining the indicator data of the normal IP prefix in the current time period, and improving the accuracy of the indicator data of the normal IP prefix in the current time period.

[0034] In a possible design, determining the abnormal impact of the abnormal IP prefix based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the normal IP prefix in the current time period includes:

[0035] Determine a first abnormal impact based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the abnormal IP prefix in the historical time period;

[0036] Determine a second abnormal impact based on the indicator data of the abnormal IP prefix in the current time period, the indicator data of the normal IP prefix in the current time period, the indicator data of the abnormal IP prefix in the historical time period, and the indicator data of the normal IP prefix in the historical time period;

[0037] The abnormality impact is determined based on the first abnormality impact, the second abnormality impact, and their respective corresponding weights.

[0038] In an embodiment of the present application, based on the index data of the abnormal IP prefix in the current time period and the index data of the abnormal IP prefix in the historical time period, the first abnormal impact is determined to characterize the degree of change of the index data of the abnormal IP prefix in the historical time period and the index data of the abnormal IP prefix in the current time period. In addition, based on the index data of the abnormal IP prefix in the current time period, the index data of the normal IP prefix in the current time period, the index data of the abnormal IP prefix in the historical time period, and the index data of the normal IP prefix in the historical time period, the second abnormal impact is determined to characterize the correlation of the network traffic of the abnormal IP prefix and the normal IP prefix in the historical time period, and the change of the correlation of the network traffic of the abnormal IP prefix and the normal IP prefix in the current time period. The present application determines the abnormal impact based on the first abnormal impact, the second abnormal impact and the corresponding weights, so as to more accurately characterize the degree of influence of the abnormal IP prefix on the network traffic in the current time period.

[0039] In a possible design, the first abnormal impact includes part or all of the flow impact, the connection success rate impact, and the connection quantity impact:

[0040] If the first abnormal impact includes the flow impact, the flow impact is determined by: determining the flow impact based on the network flow of the abnormal IP prefix in the current time period and the network flow of the abnormal IP prefix in the historical time period;

[0041] If the first abnormality impact includes the connection success rate impact, the connection success rate impact is determined in the following manner: based on the Transmission Control Protocol TCP connection success rate of the abnormal IP prefix in the current time period and the TCP connection success rate of the abnormal IP prefix in the historical time period, the connection success rate impact is determined;

[0042] If the first abnormality impact includes the connection quantity impact, the connection quantity impact is determined in the following manner: based on the number of TCP connections of the abnormal IP prefix in the current time period and the number of TCP connections of the abnormal IP prefix in the historical time period, the connection quantity impact is determined.

[0043] In an embodiment of the present application, since the first abnormality impact includes part or all of the traffic impact, the connection success rate impact and the connection number impact, the traffic impact can be determined based on the network traffic of the abnormal IP prefix in the current time period and the network traffic of the abnormal IP prefix in the historical time period, the connection success rate impact can be determined based on the TCP connection success rate of the abnormal IP prefix in the current time period and the TCP connection success rate of the abnormal IP prefix in the historical time period, and the connection number impact can be determined based on the number of TCP connections of the abnormal IP prefix in the current time period and the number of TCP connections of the abnormal IP prefix in the historical time period, thereby improving the accuracy of the determined first abnormality impact.

[0044] In one possible design, determining the second abnormal impact based on the indicator data of the abnormal IP prefix in the current time period, the indicator data of the normal IP prefix in the current time period, the indicator data of the abnormal IP prefix in the historical time period, and the indicator data of the normal IP prefix in the historical time period includes:

[0045] Determine a first correlation based on the network traffic of the abnormal IP prefix in M ​​historical time periods and the network traffic of the normal IP prefix in M ​​historical time periods, wherein M is a positive integer greater than 1, and the first correlation is used to characterize the correlation degree between the network traffic of the abnormal IP prefix and the normal IP prefix in the historical time period;

[0046] Determine a second correlation based on the network traffic of the abnormal IP prefix in the current time period, the network traffic of the normal IP prefix in the current time period, the network traffic of the abnormal IP prefix in M-1 historical time periods, and the network traffic of the normal IP prefix in M-1 historical time periods, wherein the second correlation is used to characterize the degree of correlation between the network traffic of the abnormal IP prefix and the normal IP prefix in the current time period;

[0047] The second abnormality influence degree is determined based on the first correlation degree and the second correlation degree.

[0048] In an embodiment of the present application, a first correlation is determined based on the network traffic of the abnormal IP prefix in M ​​historical time periods and the network traffic of the normal IP prefix in M ​​historical time periods to characterize the degree of correlation between the network traffic of the abnormal IP prefix and the normal IP prefix in the historical time periods; a second correlation is determined based on the network traffic of the abnormal IP prefix in the current time period, the network traffic of the normal IP prefix in the current time period, the network traffic of the abnormal IP prefix in M-1 historical time periods, and the network traffic of the normal IP prefix in M-1 historical time periods to characterize the degree of correlation between the network traffic of the abnormal IP prefix and the normal IP prefix in the current time period; and a second abnormal impact is determined based on the first correlation and the second correlation to more accurately characterize the change in the correlation within the historical time periods and the correlation within the current time period.

[0049] In one possible design, determining whether there is an abnormal route in the target AS within the current time period based on the comparison result includes:

[0050] If the abnormal impact is greater than or equal to the set threshold, it is determined that an abnormal route exists in the target AS in the current time period;

[0051] If the abnormal impact is less than the set threshold, it is determined that there is no abnormal route in the target AS within the current time period.

[0052] In the embodiment of the present application, based on the abnormal impact and the set threshold, it is determined whether there is an abnormal route in the target AS within the current time period, thereby improving the accuracy of identifying abnormal BGP routes and reducing the cost of manual participation.

[0053] In a second aspect, an embodiment of the present application provides a BGP abnormal routing identification device, including:

[0054] An acquisition module is used to acquire multiple network flow data in the current time period and multiple routing update messages whose source AS of the AS path is the target AS from the border routers of each autonomous system AS;

[0055] A first determination module, configured to determine an abnormal Internet Protocol IP prefix and a normal IP prefix of the target AS based on route announcement data or route withdrawal data of each route update message;

[0056] A second determination module is used to determine the indicator data of the abnormal IP prefix in the current time period based on the destination IP address of each network traffic data and the abnormal IP prefix; and to determine the indicator data of the normal IP prefix in the current time period based on the destination IP address of each network traffic data and the normal IP prefix;

[0057] A third determination module is used to determine the abnormal impact of the abnormal IP prefix based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the normal IP prefix in the current time period, wherein the abnormal impact is used to characterize the degree of influence of the abnormal IP prefix on the network traffic in the current time period;

[0058] The comparison module is used to compare the abnormal impact degree with a set threshold, and determine whether there is an abnormal route in the target AS within a current time period based on the comparison result.

[0059] In a third aspect, the present application provides an electronic device, including:

[0060] A memory for storing program instructions;

[0061] The processor is used to call the program instructions stored in the memory, and execute the steps included in any one of the methods in the first aspect according to the obtained program instructions.

[0062] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes any one of the methods described in the first aspect.

[0063] In a fifth aspect, the present application provides a computer program product, comprising: a computer program code, when the computer program code is run on a computer, the computer executes any one of the methods described in the first aspect.

[0064] The technical effects brought about by the second to fifth aspects and any one of their designs can refer to the technical effects brought about by the corresponding designs in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 A schematic diagram of an application scenario provided for an embodiment of the present application;

[0066] Figure 2A flowchart of a BGP abnormal routing identification method provided in an embodiment of the present application;

[0067] Figure 3 A detailed flow chart of a BGP abnormal routing identification method provided in an embodiment of the present application;

[0068] Figure 4 A flowchart of a method for determining indicator data of abnormal IP prefixes in the current time period provided by an embodiment of the present application;

[0069] Figure 5 A flowchart of a method for determining indicator data of a normal IP prefix in the current time period provided by an embodiment of the present application;

[0070] Figure 6 A flowchart of a method for determining an abnormal IP prefix and a normal IP prefix of a target AS provided in an embodiment of the present application;

[0071] Figure 7 A flowchart of another method for determining an abnormal IP prefix and a normal IP prefix of a target AS provided in an embodiment of the present application;

[0072] Figure 8 A flowchart of a method for determining the abnormal impact of an abnormal IP prefix provided in an embodiment of the present application;

[0073] Fig. 9 A flowchart of a method for determining a second abnormal influence degree provided in an embodiment of the present application;

[0074] Fig.10 A schematic diagram of the structure of a BGP abnormal routing identification device provided in an embodiment of the present application;

[0075] Fig.11 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0076] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0077] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0078] In the technical solution of this application, the collection, dissemination, and use of data are in compliance with the requirements of relevant national laws and regulations.

[0079] Before introducing a BGP abnormal routing identification method provided by an embodiment of the present application, in order to facilitate understanding, the technical background of the embodiment of the present application is first introduced in detail below.

[0080] In the huge network architecture of the operator level, BGP is not only a key protocol for achieving inter-AS route reachability and optimal routing, but its security is also the cornerstone for ensuring the stable operation of the entire Internet and secure data transmission. With the rapid development of network technology, the security issues of the BGP protocol have gradually become prominent and have become the focus of attention of operators and network security experts.

[0081] The BGP protocol exchanges routing information through TCP. Although this mechanism ensures the reliability of data transmission, it also exposes BGP to the risk of being exploited by malicious attackers. Attackers may inject false routing information into the network by forging BGP update messages, inducing legitimate traffic to flow to maliciously controlled paths, thereby implementing attacks such as route hijacking, data theft, and service interruption. In addition, the leakage of BGP paths may also expose the network topology, providing attackers with attack targets and strategies.

[0082] At present, the BGP abnormal route identification method usually uses the control plane signaling exchanged by the BGP protocol, that is, the route update message, to identify abnormal routes. However, due to the extreme complexity of network configuration, it is unknown whether the route change will affect the actual data transmission on the data plane if only these control plane messages are used to identify abnormal routes. Since it is very difficult to capture real route abnormal events, they can only be obtained and marked through major events reported publicly, and the number is very limited. The BGP abnormal route identification method cannot be fully verified based on real route abnormal events, making the recognition accuracy of BGP abnormal routes low.

[0083] In order to solve the above problems, the present invention proposes a BGP abnormal route identification method, device, equipment and medium to improve the accuracy of identifying BGP abnormal routes.

[0084] First reference Figure 1 , which is a schematic diagram of an application scenario of an embodiment of the present disclosure, including three AS11s and a server 12. Each AS11 may include one or more routers 111 and a border router 112. The border router 112 may also be referred to as a BGP router. In each AS11, the border router 112 and other routers 111 implement the routing policy of the AS11 and maintain a connection with the border router 112 in the adjacent AS11. AS11 shares routing information with other AS11s by exchanging routing messages between border routers 112 using BGP. Routing information can be shared within an AS11 or between AS11s by establishing a connection from the border router 112 to one of its BGP peers in order to exchange BGP updates. The process of exchanging data between border routers 112 is called "peering". In a peering session, two networks are directly connected and exchange data. An internal BGP peering session includes directly connecting a border router 112 and an internal router 111 within a single AS11 or only connecting an internal router 111. The external BGP peer operation session includes directly connecting the border routers 112 in the adjacent AS11 to each other. The border routers 112 can exchange routing update (UPDATE) messages. The server 12 is connected to the border router 112 of each AS11, obtains the network flow data in the current time period and the routing update message of the source AS of the AS path as the target AS11, and determines whether there is an abnormal route in the target AS11 in the current time period based on the network flow data and the routing update message.

[0085] In the disclosed embodiment, as an optional implementation, the server 12 obtains multiple network traffic data in the current time period from the border router 112 of each AS11, and multiple route update messages with the source AS of the AS path as the target AS11; determines the abnormal IP prefix and the normal IP prefix of the target AS11 based on the route declaration data or route withdrawal data of each route update message; determines the index data of the abnormal IP prefix in the current time period based on the destination IP address and the abnormal IP prefix of each network traffic data; and determines the index data of the normal IP prefix in the current time period based on the destination IP address and the normal IP prefix of each network traffic data; determines the abnormal impact of the abnormal IP prefix based on the index data of the abnormal IP prefix in the current time period and the index data of the normal IP prefix in the current time period, wherein the abnormal impact is used to characterize the degree of influence of the abnormal IP prefix on the network traffic in the current time period; compares the abnormal impact with the set threshold, and determines whether there is an abnormal route in the target AS11 in the current time period based on the comparison result.

[0086] Reference below Figure 2 A flowchart of a BGP abnormal routing identification method is shown to illustrate the technical solution provided by the embodiment of the present application:

[0087] Step 201 , obtaining multiple network flow data in the current time period and multiple routing update messages whose source AS of the AS path is the target AS from the border router of each AS.

[0088] The current time period can be set according to the actual situation. For example, the current time period is 10 seconds. AS refers to all IP (Internet Protocol) segments and routers under the jurisdiction of one or more entities, which implement a common routing strategy for the Internet. In addition to the IP address attributes of the IP segment itself, it can also have physical location attributes and operator attributes. The Internet is composed of many independently developed ASs. Governments, network operators (Internet Service Provider, ISP), universities and enterprises can all run their own ASs. Each AS is assigned a globally unique number, called an AS number. ASs share routing information through the inter-domain routing protocol BGP: each AS is responsible for announcing its own IP prefix to neighboring ASs, spreading it to the global Internet, so that any two globally routable IP prefixes on the Internet can communicate.

[0089] In an embodiment of the present application, multiple routing update messages whose source AS of the AS path in the current time period is the target AS are obtained from the border router of each AS, including: for each AS, collecting routing update messages sent by the border router of the AS where the monitoring probe is located to the external AS in the current time period, and collecting routing update messages sent by other ASs and received by the border router of the AS where the monitoring probe is located in the current time period; determining multiple routing update messages whose source AS of the AS path is the target AS from the collected BGP routing update messages.

[0090] In the embodiment of the present application, based on the update type, the routing update message is divided into an announcement type and a withdrawal type. The routing update message of the announcement type indicates that the border router receives the routing announcement data of a certain IP prefix. The routing update message of the announcement type includes the routing announcement data, and the routing announcement data includes information such as the AS path, the IP prefix, and the announcement time. The routing update message of the withdrawal type indicates that the border router receives the withdrawal data for a certain IP prefix. The routing update message of the withdrawal type includes the routing withdrawal data, and the routing withdrawal data includes information such as the AS path, the IP prefix, and the withdrawal time.

[0091] Among them, the AS path (AS_PATH) includes the AS numbers corresponding to each AS that the BGP route passes through. The AS numbers recorded in the AS path are arranged in the order of the ASs to be passed from the local AS to the source AS (Origin AS). The first AS number on the rightmost side of the AS path represents the number of the Origin AS in the BGP route, and the remaining AS numbers represent the AS numbers corresponding to the ASs passed through in the BGP route. For example, the AS path of a BGP route is: 100, 200, 300, which means that after the BGP route is initiated from AS300, it is forwarded by AS200 and AS100 in sequence. Among them, AS300 is the source AS.

[0092] The IP prefix is ​​an IP prefix specified by the user, for example, an IP prefix that needs to be monitored in real time; it may also be any one of all IP prefixes in the target AS.

[0093] Step 202: Determine the abnormal IP prefix and the normal IP prefix of the target AS based on the route announcement data or route withdrawal data of each route update message.

[0094] The target AS includes multiple IP prefixes.

[0095] Step 203, based on the destination IP address and abnormal IP prefix of each network traffic data, determine the indicator data of the abnormal IP prefix in the current time period, and based on the destination IP address and normal IP prefix of each network traffic data, determine the indicator data of the normal IP prefix in the current time period.

[0096] Among them, network traffic data includes information such as source IP address, destination IP address, source port, destination port, and transmission protocol. Indicator data includes data such as TCP connection success rate, number of TCP connections, and network traffic.

[0097] Step 204: Determine the abnormal impact of the abnormal IP prefix based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the normal IP prefix in the current time period.

[0098] The abnormal impact degree is used to characterize the impact degree of the abnormal IP prefix on the network traffic in the current time period.

[0099] Step 205: compare the abnormal impact degree with the set threshold, and determine whether there is abnormal routing in the target AS within the current time period based on the comparison result.

[0100] The threshold value may be set according to actual conditions.

[0101] Optionally, determining whether there is an abnormal route in the target AS within the current time period based on the comparison result includes:

[0102] If the abnormal impact is greater than or equal to the set threshold, it is determined that there is an abnormal route in the target AS in the current time period;

[0103] If the abnormal impact is less than the set threshold, it is determined that there is no abnormal route in the target AS in the current time period.

[0104] In an embodiment of the present application, multiple network flow data and multiple routing update messages of the source AS of the AS path as the target AS in the current time period are obtained, and based on the routing announcement data or routing withdrawal data of each routing update message, the abnormal IP prefix and normal IP prefix of the target AS are determined to improve the accuracy of identifying the abnormal IP prefix and normal IP prefix of the target AS. In addition, the present application determines the index data of the abnormal IP prefix in the current time period and the index data of the normal IP prefix in the current time period based on the destination IP address, abnormal IP prefix and normal IP prefix of each network flow data, and determines the abnormal impact of the abnormal IP prefix based on the index data of the abnormal IP prefix in the current time period and the index data of the normal IP prefix in the current time period, so as to more accurately characterize the influence of the abnormal IP prefix on the network flow in the current time period. The present application compares the abnormal impact with the set threshold, and determines whether the target AS has an abnormal route in the current time period based on the comparison result, improves the accuracy of identifying BGP abnormal routes, and reduces the cost of manual participation.

[0105] The specific steps of the above-mentioned BGP abnormal routing identification method are described in detail below. Figure 3 As shown:

[0106] Step 301 , obtaining multiple network flow data in the current time period and multiple routing update messages whose source AS of the AS path is the target AS from the border router of each AS.

[0107] In an embodiment of the present application, the time records and time zones of different data sources may be different, and their data recording times need to be aligned. NTP (Network Time Protocol) access can be performed based on the border router that collects routing update messages and the border router that collects network traffic data, and the timestamps of multi-source data can be leveled based on their clock differences to ensure that the network traffic data and routing update messages collected in the same time period are guaranteed.

[0108] Step 302: Determine the abnormal IP prefix and the normal IP prefix of the target AS based on the route announcement data or route withdrawal data of each route update message.

[0109] In an embodiment of the present application, the abnormal IP prefix and normal IP prefix of the target AS caused by the route interruption event can be determined based on the route announcement data or route withdrawal data of each route update message; the abnormal IP prefix and normal IP prefix of the target AS caused by the route hijacking event can also be determined based on the route announcement data or route withdrawal data of each route update message. Among them, the target AS includes multiple IP prefixes, and the number of abnormal IP prefixes of the target AS can be one or more. The number of normal IP prefixes of the target AS can be one or more. For example, the target AS includes 3 IP prefixes, namely IP prefix 1, IP prefix 2 and IP prefix 3. If IP prefix 1 is an abnormal IP prefix, IP prefix 2 and IP prefix 3 are normal IP prefixes. If IP prefix 1 and IP prefix 2 are abnormal IP prefixes, IP prefix 3 is a normal IP prefix.

[0110] In the embodiments of the present application, route hijacking refers to an AS announcing a false BGP route, that is, an AS announcing an IP prefix that does not belong to itself, hijacking network traffic, causing Internet service interruption or data theft. Route interruption refers to an AS losing almost all routes within a period of time, resulting in its unreachability, such as active withdrawal or link failure.

[0111] Step 303: Determine the indicator data of the abnormal IP prefix in the current time period based on the destination IP address and the abnormal IP prefix of each piece of network traffic data.

[0112] Figure 4 A flowchart of a method for determining indicator data of abnormal IP prefixes in the current time period provided by an embodiment of the present application, such as Figure 4 As shown, the above step 303 at least includes the following steps 401-403:

[0113] Step 401, based on the destination IP address and abnormal IP prefix of each piece of network traffic data, determine the network traffic data corresponding to the abnormal IP prefix in the current time period.

[0114] In the embodiment of the present application, the IP prefix represents the set of network addresses published by the target AS. In the embodiment of the present application, unless otherwise specified, the IP prefix is ​​represented by the IP address plus the number of mask bits, that is:

[0115] ABCD / X

[0116] Wherein, ABCD is the IP address, and X is the number of mask bits. For example, the IP prefix is ​​10.10.0.0 / 16, which represents all network addresses from 10.10.10.0.0 to 10.10.255.255; 10.10.10.0 / 24 represents all network addresses from 10.10.10.0 to 10.10.10.255.

[0117] For example, if the abnormal IP prefix is ​​10.10.0.0 / 16, the destination IP address of the first network traffic data is 10.10.10.0.0, the destination IP address of the second network traffic data is 10.10.11.0.0, and the destination IP address of the third network traffic data is 10.10.10.0.1, then the destination IP address of the first network traffic data and the destination IP address of the third network traffic data belong to the abnormal IP prefix, and the destination IP address of the second network traffic data does not belong to the abnormal IP prefix. Therefore, the network traffic data corresponding to the abnormal IP prefix are the first network traffic data and the third network traffic data.

[0118] Step 402: Determine an indicator value of at least one set flow indicator of the abnormal IP prefix based on the network flow data corresponding to the abnormal IP prefix in the current time period.

[0119] The set flow index may be an index such as TCP connection success rate, network flow, and number of TCP connections.

[0120] In the embodiment of the present application, the index value of the TCP connection success rate index of the abnormal IP prefix can be determined based on the TCP_FLAG (TCP flag) in the network traffic data corresponding to the abnormal IP prefix in the current time period. TCP_FLAG is used to indicate a specific state during a TCP session.

[0121] Step 403: Determine the indicator data of the abnormal IP prefix in the current time period based on the indicator value of at least one set flow indicator of the abnormal IP prefix.

[0122] Step 304: Determine the indicator data of the normal IP prefix in the current time period based on the destination IP address and the normal IP prefix of each piece of network traffic data.

[0123] Figure 5 A flowchart of a method for determining indicator data of a normal IP prefix in the current time period provided by an embodiment of the present application, such as Figure 5 As shown, the above step 304 at least includes the following steps 501-503:

[0124] Step 501, based on the destination IP address and the normal IP prefix of each piece of network traffic data, determine the network traffic data corresponding to the normal IP prefix in the current time period.

[0125] Step 502: Determine an indicator value of at least one set flow indicator of the normal IP prefix based on the network flow data corresponding to the normal IP prefix in the current time period.

[0126] Step 503: Determine the indicator data of the normal IP prefix in the current time period based on the indicator value of at least one set flow indicator of the normal IP prefix.

[0127] Since the method for determining the indicator data of the normal IP prefix in the current time period is the same as the method for determining the indicator data of the abnormal IP prefix in the current time period, the specific implementation process of determining the indicator data of the normal IP prefix in the current time period can be referred to the above-mentioned specific implementation process of determining the indicator data of the abnormal IP prefix in the current time period, and will not be repeated here.

[0128] Step 305: Determine the abnormal impact of the abnormal IP prefix based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the normal IP prefix in the current time period.

[0129] Specifically, based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the normal IP prefix in the current time period, determining the abnormal impact of the abnormal IP prefix includes:

[0130] Based on the indicator data of the abnormal IP prefix in the current time period, the indicator data of the normal IP prefix in the current time period, the indicator data of the abnormal IP prefix in the historical time period, and the indicator data of the normal IP prefix in the historical time period, the abnormal impact of the abnormal IP prefix is ​​determined.

[0131] The abnormal impact degree is used to characterize the impact degree of the abnormal IP prefix on the network traffic in the current time period.

[0132] Step 306 , determining whether the abnormal impact is greater than or equal to a set threshold, if so, executing step 307 , otherwise, executing step 308 .

[0133] Step 307: Determine whether there is abnormal routing in the target AS within the current time period.

[0134] Step 308: Determine whether there is no abnormal route in the target AS in the current time period.

[0135] In the embodiment of the present application, the abnormal routes of each AS are identified based on the route update message and network traffic data of the current time period, and the abnormal route event information is recorded. The abnormal route event information includes event information, impact information and abnormal impact. The event information includes information such as the attacker AS, the victim AS, the abnormal type, the start and end time, and the abnormal IP prefix. The impact information includes information such as the flow impact, the connection success rate impact, the connection number impact, and the second abnormal impact. The abnormal route event information is added to the route event library. After a period of accumulation and reaching a certain level, it can be directly applied to the training and verification of the current BGP abnormal route identification method, solving the need for mutual comparison between different methods and continuous iteration to improve the effect.

[0136] In the embodiment of the present application, based on the route announcement data or route withdrawal data of each route update message, the abnormal IP prefix and the normal IP prefix of the target AS caused by the route interruption event are determined. Figure 6 A flowchart of a method for determining an abnormal IP prefix and a normal IP prefix of a target AS provided in an embodiment of the present application, such as Figure 6 As shown, the above step 302 at least includes the following steps 601-604:

[0137] Step 601, sort the announcement time of each route announcement data and the withdrawal time of each route withdrawal data belonging to the same IP prefix from early to late, and determine the interruption time period of each IP prefix.

[0138] The interruption period of the IP prefix refers to the period of time during which the IP prefix is ​​in an interrupted state after the IP prefix is ​​withdrawn and before the IP prefix is ​​announced.

[0139] For example, the withdrawal time of IP prefix 1 is 2024-03-03 22:08:10, and the announcement time of IP prefix 1 is 2024-03-03 22:08:12. Therefore, the interruption time period of IP prefix 1 is from 22:08:10 to 22:08:12.

[0140] The following is an example of the route announcement data and route withdrawal data for the IP prefix 1.0.204.0 / 24 of AS23969:

[0141] "1.0.204.0 / 24":{ / / IP prefix

[0142] "country":["A"], / / IP prefix belongs to country A

[0143] "as":["23969"], / / IP prefix belongs to AS23969

[0144] "paths":{

[0145] "2914 38040 23969":{ / / AS path

[0146] "n_appearance":1,

[0147] "n_announces":3",

[0148] "announce_events":{ / / announce

[0149] "23969":[

[0150] "2024-03-03 22:07:43",

[0151] "2024-03-03 22:08:12",

[0152] "2024-03-03 22:08:13"]}}, / / Announcement time

[0153] "6939 38040 23969":{ / / AS path

[0154] "n_appearance":0,

[0155] "n_announces":1",

[0156] "announce_events":{ / / announce

[0157] "23969":[

[0158] "2024-03-03 22:08:12"]}}}, / / Announcement time

[0159] "withdraw_events":["2024-03-03 22:08:10"],} / / Withdraw

[0160] As shown above, the IP prefix 1.0.204.0 / 24 of AS23969 corresponds to 4 route announcement data and 1 route withdrawal data. The first route announcement data includes the IP prefix 1.0.204.0 / 24, the announcement time 2024-03-03 22:07:43, and the AS path 2914 38040 23969. The second route announcement data includes the IP prefix 1.0.204.0 / 24, the announcement time 2024-03-03 22:08:12, and the AS path 2914 3804023969. The third route announcement data includes the IP prefix 1.0.204.0 / 24, the announcement time 2024-03-03 22:08:13, and the AS path 2914 38040 23969. The fourth route announcement data includes an IP prefix of 1.0.204.0 / 24, an announcement time of 2024-03-03 22:08:12, and an AS path of 693938040 23969. The route withdrawal data includes an IP prefix of 1.0.204.0 / 24, a withdrawal time of 2024-03-03 22:08:10, and AS paths of 6939 38040 23969 and 2914 38040 23969. Since the IP prefix is ​​withdrawn at 2024-03-03 22:08:10 and announced at 2024-03-03 22:08:12, the interruption period of the IP prefix is ​​from 2024-03-03 22:08:10 to 2024-03-03 22:08:12.

[0161] Step 602: Based on the interruption time period of each IP prefix belonging to the target AS, determine the number of IP prefixes in an interruption state in the target AS in each sub-time period of the current time period.

[0162] Among them, at least one IP prefix is ​​included under the same AS. The current time period includes multiple sub-time periods. The number of sub-time periods can be set according to actual conditions. For example, the current time period can include 10 sub-time periods. The duration of each sub-time period can be set according to actual conditions, that is, the duration of each sub-time period can be the same, or different, or some sub-time periods can have the same duration.

[0163] For example, the target AS includes three IP prefixes, namely IP prefix 1, IP prefix 2, and IP prefix 3. The time period is set to 1:00:00 to 1:01:00. The set time period is evenly divided into four sub-time periods. Sub-time period 1 is from 1:00:00 to 1:00:15, sub-time period 2 is from 1:00:15 to 1:00:30, sub-time period 3 is from 1:00:30 to 1:00:45, and sub-time period 4 is from 1:00:45 to 1:01:00. If the interruption time period of IP prefix 1 is from 1:00:15 to 1:00:30, the interruption time period of IP prefix 2 is from 1:00:15 to 1:00:45, and the interruption time period of IP prefix 3 is from 1:00:00 to 1:00:30, then it is determined that the number of IP prefixes in the target AS in the interruption state in sub-time period 1 is 1, the number of IP prefixes in the target AS in the interruption state in sub-time period 2 is 3, the number of IP prefixes in the target AS in the interruption state in sub-time period 3 is 1, and the number of IP prefixes in the target AS in the interruption state in sub-time period 4 is 0.

[0164] Step 603: Determine the interruption rate of the target AS in each sub-time period based on the number of IP prefixes in the target AS in an interrupted state and the total number of IP prefixes in the target AS in each sub-time period.

[0165] Specifically, for each sub-time period, based on the ratio of the number of IP prefixes in the target AS in an interrupted state in the sub-time period to the total number of IP prefixes in the target AS, the interruption rate of the target AS in the sub-time period is determined.

[0166] Optionally, the interruption rate p of the target AS in the jth sub-time period can be determined using the following formula: j :

[0167]

[0168] Among them, a j is the number of IP prefixes in the target AS that are in the interrupted state during the j-th sub-time period, and a is the total number of IP prefixes in the target AS.

[0169] For example, the target AS includes 4 IP prefixes, namely IP prefix 1, IP prefix 2, IP prefix 3 and IP prefix 4. If IP prefix 1, IP prefix 2 and IP prefix 3 are in an interrupted state in the target AS within a sub-time period, then the number of IP prefixes in an interrupted state in the target AS within the sub-time period is determined to be 3. Therefore, the interruption rate of the target AS within the sub-time period is 3 / 4=0.75.

[0170] Step 604, for each sub-time period, if the interruption rate of the target AS in the sub-time period is greater than the set probability threshold, the IP prefix in the target AS in the sub-time period that is in an interrupted state is used as an abnormal IP prefix, and the IP prefix in the target AS in the sub-time period that is not in an interrupted state is used as a normal IP prefix.

[0171] The probability threshold may be set according to actual conditions. For example, the probability threshold may be set to 0.9.

[0172] For example, the set time period includes sub-time period 1, sub-time period 2, sub-time period 3 and sub-time period 4. If the set probability threshold is 0.7, the interruption rate of the target AS in sub-time period 1 is 0.25, the interruption rate of the target AS in sub-time period 2 is 0.75, the interruption rate of the target AS in sub-time period 3 is 0.5, and the interruption rate of the target AS in sub-time period 4 is 0, then it is determined that the interruption rate of the target AS in sub-time period 2 is 0.75 greater than the set probability threshold 0.7, and the IP prefix in the interrupted state in the target AS in the sub-time period 2 is taken as an abnormal IP prefix, and the IP prefix in the non-interrupted state in the target AS in the sub-time period is taken as a normal IP prefix.

[0173] Optionally, based on the route announcement data or route withdrawal data of each route update message, an abnormal IP prefix and a normal IP prefix of a target AS caused by the route hijacking event are determined, Figure 7 A flowchart of another method for determining an abnormal IP prefix and a normal IP prefix of a target AS provided in an embodiment of the present application, such as Figure 7 As shown, the above step 302 at least includes the following steps 701-703:

[0174] Step 701: Determine the registered IP prefix of the target AS based on the target AS and the set correspondence relationship.

[0175] The corresponding relationship is the corresponding relationship between each AS and each registered IP prefix.

[0176] Step 702, for the IP prefix of the route announcement data or route withdrawal data of each route update message, if the IP prefix does not exist in the registered IP prefixes of the target AS, and the AS path of the route announcement data or route withdrawal data of the route update message does not satisfy the set AS business relationship, then the IP prefix is ​​determined to be an abnormal IP prefix.

[0177] Among them, if the IP prefix does not exist in the registered IP prefixes of the target AS, the target AS will be marked as MOAS (multi-source AS), indicating that the IP prefix is ​​an IP prefix created by the target AS. However, since multiple creation may also be a sign of malicious activity or operator error, it is necessary to determine whether the IP prefix is ​​an abnormal IP prefix based on the AS path and the set AS business relationship.

[0178] In the embodiment of the present application, the connection between ASs is determined by the business contract that determines the economic and technical aspects of traffic exchange, that is, the so-called business relationship between ASs. AS business relationships may include customer-to-provider (c2p), peer-to-peer (p2p), sibling-to-sibling (s2s) and hybrid relationships. The AS path is used to indicate the AS path experienced during the transmission of the routing update message. According to the AS path, the ASs that the BGP route passes through in sequence during the transmission process can be determined. Specifically, when the routing update message is transmitted, it is necessary to meet the valley-free principle. The valley-free principle stipulates the conditions that the business relationship experienced by the routing update message during the transmission process must meet. For example, routes from customers can be sent to operators, customers, and peers, and routes from peers or operators can only be sent to customers.

[0179] Step 703, if the IP prefix exists in the registered IP prefixes of the target AS, or the IP prefix does not exist in the registered IP prefixes of the target AS, and the AS path of the route announcement data or route withdrawal data of the route update message satisfies the set AS business relationship, then the IP prefix is ​​determined to be a normal IP prefix.

[0180] The following is an example of a routing update message from AS65003:

[0181] "103.94.12.0 / 22":{ / / IP prefix

[0182] "n_hijacks": 1, / / Number of hijacks

[0183] "asn":[

[0184] “131578”], / / hijacked AS

[0185] "hijacks":{ / / hijack

[0186] “65003”:{ / / Hijack AS

[0187] "23724 4847 131578 650003":[ / / AS path [

[0189] "2024-03-01 00:01:57",

[0190] "2024-03-01 00:01:58"] / / Announcement time

[0191] ]}},

[0192] "valleyfree":{ / / valley-free principle

[0193] "131578":{

[0194] "23724 4847 131578":false},

[0195] "650003":{

[0196] "23724 4847 131578 650003":false}}}

[0197] As shown above, AS65003 corresponds to 2 route announcement data. The first route announcement data includes an IP prefix of 103.94.12.0 / 22, an announcement time of 2024-03-01 00:01:57, and an AS path of 23724 4847131578 650003. The second route announcement data includes an IP prefix of 103.94.12.0 / 22, an announcement time of 2024-03-01 00:01:58, and an AS path of 23724 4847 131578 650003. Since the IP prefix belongs to AS131578 but not AS65003, and the AS path 23724 4847 131578 650003 does not satisfy the set AS business relationship, it is determined that AS65003 hijacked an IP prefix belonging to AS131578, that is, the IP prefix is ​​an abnormal IP prefix.

[0198] In the embodiment of the present application, after determining the abnormal IP prefix and normal IP prefix of the target AS, the abnormal routing event is recorded, and the abnormal types of the abnormal routing event include routing hijacking events, routing interruption events and other events. The main record fields of the routing hijacking event include: the victim AS (i.e., the hijacked AS), the attacker AS, the hijacked IP prefix (the routing prefix corresponding to the victim AS), the detected IP prefix (the IP prefix initiated by the attacker AS), the abnormal type, the event start and end time and other information. In the routing hijacking event, the attacker AS generally initiates a routing prefix that is the same as the victim AS, or a sub-prefix of the victim AS, to hijack the network traffic of the victim AS. The main fields of the routing interruption event record include the interrupted AS, the affected IP prefix, the abnormal type, the event start and end time and other information. Assuming that an AS declares 10 IP prefixes, if 9 of the IP prefixes are revoked, the affected IP prefix of the AS is the revoked IP prefix.

[0199] In an embodiment of the present application, the abnormal impact of the abnormal IP prefix is ​​determined based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the normal IP prefix in the current time period. Figure 8 A flowchart of a method for determining the abnormal impact of an abnormal IP prefix provided in an embodiment of the present application, such as Figure 8 As shown, the above step 305 at least includes the following steps 801-803:

[0200] Step 801: Determine a first abnormal impact based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the abnormal IP prefix in the historical time period.

[0201] The current time period is adjacent to the historical time period. For example, the current time period is 2:00:00-2:00:10, and the historical time period is 1:59:50-2:00:00. The first abnormal impact includes part or all of the flow impact, the connection success rate impact, and the connection quantity impact.

[0202] If the first abnormal impact includes traffic impact, the traffic impact is determined in the following manner: based on the network traffic of the abnormal IP prefix in the current time period and the network traffic of the abnormal IP prefix in the historical time period, the traffic impact is determined.

[0203] Optionally, determining the traffic impact based on the network traffic of the abnormal IP prefix in the current time period and the network traffic of the abnormal IP prefix in the historical time period includes:

[0204] Calculate the first difference between the network traffic of the abnormal IP prefix in the current time period and the network traffic of the abnormal IP prefix in the historical time period; and take the ratio of the first difference to the network traffic of the abnormal IP prefix in the historical time period as the traffic impact.

[0205] The network traffic of the abnormal IP prefix in the current time period is the average of the network traffic of the abnormal IP prefix in the current time period, and the network traffic of the abnormal IP prefix in the historical time period is the average of the network traffic of the abnormal IP prefix in the historical time period.

[0206] Optionally, the traffic impact T of the abnormal IP prefix is ​​determined using the following formula:

[0207]

[0208] Among them, Y M+1 is the network traffic of abnormal IP prefix in the M+1th time period, Y M is the network traffic of abnormal IP prefix in the Mth time period.

[0209] If the first abnormality impact includes the connection success rate impact, the connection success rate impact is determined in the following manner: based on the TCP connection success rate of the abnormal IP prefix in the current time period and the TCP connection success rate of the abnormal IP prefix in the historical time period, the connection success rate impact is determined.

[0210] Optionally, based on the TCP connection success rate of the abnormal IP prefix in the current time period and the TCP connection success rate of the abnormal IP prefix in the historical time period, determining the connection success rate influence includes:

[0211] Calculate the TCP connection success rate of the abnormal IP prefix in the current time period and the second difference between the TCP connection success rate of the abnormal IP prefix in the historical time period; and take the ratio of the second difference to the TCP connection success rate of the abnormal IP prefix in the historical time period as the connection success rate influence.

[0212] The TCP connection success rate of the abnormal IP prefix in the current time period is the average of the TCP connection success rates of the abnormal IP prefix in the current time period, and the TCP connection success rate of the abnormal IP prefix in the historical time period is the average of the TCP connection success rates of the abnormal IP prefix in the historical time period.

[0213] Optionally, the traffic impact F of the abnormal IP prefix is ​​determined using the following formula:

[0214]

[0215] Among them, F M+1 is the TCP connection success rate of the abnormal IP prefix in the M+1th time period, F M is the TCP connection success rate of the abnormal IP prefix in the Mth time period.

[0216] If the first abnormality impact includes the connection quantity impact, the connection quantity impact is determined in the following manner: based on the number of TCP connections of the abnormal IP prefix in the current time period and the number of TCP connections of the abnormal IP prefix in the historical time period, the connection quantity impact is determined.

[0217] Optionally, determining the connection quantity impact based on the number of TCP connections of the abnormal IP prefix in the current time period and the number of TCP connections of the abnormal IP prefix in the historical time period includes:

[0218] Calculate the third difference between the number of TCP connections of the abnormal IP prefix in the current time period and the number of TCP connections of the abnormal IP prefix in the historical time period; and take the ratio of the third difference to the number of TCP connections of the abnormal IP prefix in the historical time period as the connection quantity influence.

[0219] The number of TCP connections with abnormal IP prefixes in the current time period is the average number of TCP connections with abnormal IP prefixes in the current time period, and the number of TCP connections with abnormal IP prefixes in the historical time period is the average number of TCP connections with abnormal IP prefixes in the historical time period.

[0220] Optionally, the traffic impact G of the abnormal IP prefix is ​​determined using the following formula:

[0221]

[0222] Among them, G M+1 is the number of TCP connections with abnormal IP prefixes in the M+1th time period, G M is the number of TCP connections with abnormal IP prefixes in the Mth time period.

[0223] Step 802, determining a second abnormal impact based on the indicator data of the abnormal IP prefix in the current time period, the indicator data of the normal IP prefix in the current time period, the indicator data of the abnormal IP prefix in the historical time period, and the indicator data of the normal IP prefix in the historical time period;

[0224] Specifically, based on the indicator data of the abnormal IP prefix in the current time period, the indicator data of the normal IP prefix in the current time period, the indicator data of the abnormal IP prefix in M ​​historical time periods, and the indicator data of the normal IP prefix in M ​​historical time periods, the second abnormal impact degree is determined, where M is a positive integer greater than 1. Fig. 9 A flowchart of a method for determining a second abnormal impact degree provided in an embodiment of the present application is shown in FIG. Fig. 9 As shown, at least the following steps 901-903 are included:

[0225] Step 901: Determine a first correlation based on network traffic of abnormal IP prefixes in M ​​historical time periods and network traffic of normal IP prefixes in M ​​historical time periods.

[0226] The first correlation is used to characterize the correlation degree between the network traffic of the abnormal IP prefix and the normal IP prefix in the historical time period.

[0227] Optionally, the first correlation r1 may be calculated using the following formula:

[0228]

[0229] Among them, X i is the network traffic of abnormal IP prefix in the i-th time period, is the average value of the network traffic of abnormal IP prefixes in M ​​time periods, Y i is the network traffic of the normal IP prefix in the i-th time period, is the average value of the network traffic of the normal IP prefix in M ​​time periods. The value range of i is [1, M], and M is a positive integer greater than 1. It can be determined based on the network traffic of abnormal IP prefixes in M ​​time periods and the number of time periods M, It can be determined based on the network traffic of the normal IP prefix in the M time periods and the number M of time periods.

[0230] Step 902, determine the second correlation based on the network traffic of the abnormal IP prefix in the current time period, the network traffic of the normal IP prefix in the current time period, the network traffic of the abnormal IP prefix in M-1 historical time periods, and the network traffic of the normal IP prefix in M-1 historical time periods.

[0231] The second correlation is used to characterize the correlation degree between the network traffic of the abnormal IP prefix and the normal IP prefix in the current time period.

[0232] Optionally, the second correlation r2 may be calculated using the following formula:

[0233]

[0234] Among them, X i is the network traffic of abnormal IP prefix in the i-th time period, is the average value of the network traffic of the abnormal IP prefix in M ​​time periods, that is, the average value of the network traffic of the abnormal IP prefix in the current time period and the network traffic of the abnormal IP prefix in M-1 historical time periods. i is the network traffic of the normal IP prefix in the i-th time period, It is the average value of the network traffic of the normal IP prefix in M ​​time periods, that is, the average value of the network traffic of the normal IP prefix in the current time period and the network traffic of the normal IP prefix in M-1 historical time periods. The value range of i is [2, M+1], and M is a positive integer greater than 1. It can be determined based on the network traffic of the abnormal IP prefix in the current time period, the network traffic of the abnormal IP prefix in M-1 historical time periods, and the number of time periods M. It can be determined based on the network traffic of the normal IP prefix in the current time period, the network traffic of the normal IP prefix in M-1 historical time periods, and the number of time periods M.

[0235] Step 903: Determine a second abnormal influence based on the first correlation and the second correlation.

[0236] Optionally, determining the second abnormality influence based on the first correlation and the second correlation includes: taking the ratio between the second correlation and the first correlation as the second abnormality influence.

[0237] Optionally, the second abnormal influence degree may be calculated using the following formula:

[0238]

[0239] Among them, r1 is the first correlation, and r2 is the second correlation.

[0240] Step 803: Determine the abnormality impact based on the first abnormality impact, the second abnormality impact and their corresponding weights.

[0241] Among them, the weight corresponding to the first abnormal impact and the weight corresponding to the second abnormal impact can be set according to actual conditions. In the embodiment of the present application, since some abnormal impacts are larger, indicating a greater degree of abnormality, and some abnormal impacts are smaller, indicating a greater degree of abnormality, it is necessary to make homogeneous adjustments to the first abnormal impact and the second abnormal impact, so as to achieve that all abnormal impacts are larger, indicating a greater degree of abnormality.

[0242] In the embodiment of the present application, if the first abnormal impact includes the flow impact, the connection success rate impact and the connection quantity impact, the abnormal impact S of the abnormal IP prefix can be determined by the following formula:

[0243] S=ω1*T+ω2*F+ω3*G+ω4*R;

[0244] Among them, T is the traffic impact, F is the connection success rate impact, G is the connection number impact, R is the second abnormality impact, ω1 is the weight corresponding to the traffic impact, ω2 is the weight corresponding to the connection success rate impact, ω3 is the weight corresponding to the connection number impact, and ω4 is the weight corresponding to the second abnormality impact.

[0245] Based on the same technical concept, the present application exemplarily provides a BGP abnormal routing identification device, such as Fig.10 As shown, the device comprises:

[0246] The acquisition module 101 is used to acquire multiple network flow data in the current time period and multiple routing update messages whose source AS of the AS path is the target AS from the border router of each autonomous system AS;

[0247] A first determination module 102, configured to determine an abnormal Internet Protocol IP prefix and a normal IP prefix of the target AS based on route announcement data or route withdrawal data of each route update message;

[0248] The second determination module 103 is used to determine the indicator data of the abnormal IP prefix in the current time period based on the destination IP address of each network traffic data and the abnormal IP prefix; and to determine the indicator data of the normal IP prefix in the current time period based on the destination IP address of each network traffic data and the normal IP prefix;

[0249] The third determination module 104 is used to determine the abnormal impact of the abnormal IP prefix based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the normal IP prefix in the current time period, wherein the abnormal impact is used to characterize the degree of influence of the abnormal IP prefix on the network traffic in the current time period;

[0250] The comparison module 105 is used to compare the abnormal impact degree with a set threshold, and determine whether there is an abnormal route in the target AS within the current time period based on the comparison result.

[0251] Optionally, the first determining module 102 is used to:

[0252] The announcement time of each route announcement data and the withdrawal time of each route withdrawal data belonging to the same IP prefix are sorted from early to late to determine the interruption time period of each IP prefix;

[0253] Determine, based on the interruption time period of each IP prefix belonging to the target AS, the number of IP prefixes in the target AS that are in an interruption state in each sub-time period of the current time period, wherein the current time period includes a plurality of sub-time periods;

[0254] Determine an interruption rate of the target AS in each sub-time period based on the number of IP prefixes in the target AS in an interrupted state and the total number of IP prefixes of the target AS in each sub-time period;

[0255] For each sub-time period, if the interruption rate of the target AS in the sub-time period is greater than the set probability threshold, the IP prefix in the target AS in the sub-time period that is in an interrupted state is used as the abnormal IP prefix, and the IP prefix in the target AS in a non-interrupted state is used as the normal IP prefix.

[0256] Optionally, the first determining module 102 is used to:

[0257] Determine the registered IP prefix of the target AS based on the corresponding relationship between the target AS and the set corresponding relationship, wherein the corresponding relationship is the corresponding relationship between each AS and each registered IP prefix;

[0258] For each IP prefix of the route announcement data or the route withdrawal data of the route update message, if the IP prefix does not exist in the registered IP prefixes of the target AS, and the AS path of the route announcement data or the route withdrawal data of the route update message does not satisfy the set AS business relationship, then the IP prefix is ​​determined to be the abnormal IP prefix;

[0259] If the IP prefix exists in the registered IP prefixes of the target AS, or the IP prefix does not exist in the registered IP prefixes of the target AS, and the AS path of the route declaration data or route withdrawal data of the route update message satisfies the set AS business relationship, then the IP prefix is ​​determined to be the normal IP prefix.

[0260] Optionally, the second determining module 103 is used to:

[0261] Based on the destination IP address of each piece of network traffic data and the abnormal IP prefix, determine the network traffic data corresponding to the abnormal IP prefix in the current time period;

[0262] Determine an indicator value of at least one set flow indicator of the abnormal IP prefix based on network flow data corresponding to the abnormal IP prefix in the current time period;

[0263] Based on an indicator value of at least one set traffic indicator of the abnormal IP prefix, indicator data of the abnormal IP prefix in a current time period is determined.

[0264] Optionally, the second determining module 103 is used to:

[0265] Based on the destination IP address of each piece of network traffic data and the normal IP prefix, determine the network traffic data corresponding to the normal IP prefix in the current time period;

[0266] Determine an indicator value of at least one set flow indicator of the normal IP prefix based on network flow data corresponding to the normal IP prefix in the current time period;

[0267] Based on an indicator value of at least one set traffic indicator of the normal IP prefix, indicator data of the normal IP prefix in a current time period is determined.

[0268] Optionally, the third determining module 104 is used to:

[0269] Determine a first abnormal impact based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the abnormal IP prefix in the historical time period;

[0270] Determine a second abnormal impact based on the indicator data of the abnormal IP prefix in the current time period, the indicator data of the normal IP prefix in the current time period, the indicator data of the abnormal IP prefix in the historical time period, and the indicator data of the normal IP prefix in the historical time period;

[0271] The abnormality impact is determined based on the first abnormality impact, the second abnormality impact, and their respective corresponding weights.

[0272] Optionally, the first abnormal impact includes part or all of a flow impact, a connection success rate impact, and a connection quantity impact, and the third determining module 104 is used to:

[0273] If the first abnormal impact includes the flow impact, the flow impact is determined by: determining the flow impact based on the network flow of the abnormal IP prefix in the current time period and the network flow of the abnormal IP prefix in the historical time period;

[0274] If the first abnormality impact includes the connection success rate impact, the connection success rate impact is determined in the following manner: based on the Transmission Control Protocol TCP connection success rate of the abnormal IP prefix in the current time period and the TCP connection success rate of the abnormal IP prefix in the historical time period, the connection success rate impact is determined;

[0275] If the first abnormality impact includes the connection quantity impact, the connection quantity impact is determined in the following manner: based on the number of TCP connections of the abnormal IP prefix in the current time period and the number of TCP connections of the abnormal IP prefix in the historical time period, the connection quantity impact is determined.

[0276] Optionally, the third determining module 104 is used to:

[0277] Determine a first correlation based on the network traffic of the abnormal IP prefix in M ​​historical time periods and the network traffic of the normal IP prefix in M ​​historical time periods, wherein M is a positive integer greater than 1, and the first correlation is used to characterize the correlation degree between the network traffic of the abnormal IP prefix and the normal IP prefix in the historical time period;

[0278] Determine a second correlation based on the network traffic of the abnormal IP prefix in the current time period, the network traffic of the normal IP prefix in the current time period, the network traffic of the abnormal IP prefix in M-1 historical time periods, and the network traffic of the normal IP prefix in M-1 historical time periods, wherein the second correlation is used to characterize the degree of correlation between the network traffic of the abnormal IP prefix and the normal IP prefix in the current time period;

[0279] The second abnormality influence degree is determined based on the first correlation degree and the second correlation degree.

[0280] Optionally, the comparison module 105 is used to:

[0281] If the abnormal impact is greater than or equal to the set threshold, it is determined that an abnormal route exists in the target AS in the current time period;

[0282] If the abnormal impact is less than the set threshold, it is determined that there is no abnormal route in the target AS within the current time period.

[0283] Based on the same inventive concept, the embodiment of the present application provides an electronic device, which can realize the function of the BGP abnormal routing identification device discussed above, please refer to Fig.11 , the device includes a processor 1111 and a memory 1112, wherein the memory 1112 is used to store program instructions;

[0284] The processor 1111 calls the program instructions stored in the memory and executes the program instructions to implement the following steps:

[0285] Obtain multiple network traffic data in the current time period from the border routers of each autonomous system AS, as well as multiple routing update messages whose source AS of the AS path is the target AS;

[0286] Determining an abnormal Internet Protocol IP prefix and a normal IP prefix of the target AS based on the route announcement data or the route withdrawal data of each route update message;

[0287] Based on the destination IP address of each piece of network traffic data and the abnormal IP prefix, determine the indicator data of the abnormal IP prefix in the current time period; and based on the destination IP address of each piece of network traffic data and the normal IP prefix, determine the indicator data of the normal IP prefix in the current time period;

[0288] Determine the abnormal impact of the abnormal IP prefix based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the normal IP prefix in the current time period, wherein the abnormal impact is used to characterize the degree of influence of the abnormal IP prefix on network traffic in the current time period;

[0289] The abnormal impact degree is compared with a set threshold, and based on the comparison result, it is determined whether there is an abnormal route in the target AS within the current time period.

[0290] The processor 1111 calls the program instructions stored in the memory, and implements the BGP abnormal route identification method provided in the above embodiment by running the program instructions.

[0291] Based on the same inventive concept, the embodiment of the present application provides a computer-readable storage medium, and the computer program product includes: computer program code, when the computer program code is executed on a computer, the computer executes any of the BGP abnormal route identification methods discussed above. Since the principle of solving the problem by the above-mentioned computer-readable storage medium is similar to that of the BGP abnormal route identification method, the implementation of the above-mentioned computer-readable storage medium can refer to the implementation of the method, and the repeated parts will not be repeated.

[0292] Based on the same inventive concept, the embodiment of the present application also provides a computer program product, which includes: computer program code, when the computer program code is run on a computer, the computer executes any of the BGP abnormal route identification methods discussed above. Since the principle of solving the problem by the above computer program product is similar to that of the BGP abnormal route identification method, the implementation of the above computer program product can refer to the implementation of the method, and the repeated parts will not be repeated.

[0293] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0294] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0295] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0296] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of user-operated steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0297] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for identifying abnormal routing of Border Gateway Protocol (BGP), characterized in that: include: Obtain multiple network traffic data in the current time period from the border routers of each autonomous system AS, as well as multiple routing update messages whose source AS of the AS path is the target AS; Determining an abnormal Internet Protocol IP prefix and a normal IP prefix of the target AS based on the route announcement data or the route withdrawal data of each route update message; Based on the destination IP address of each piece of network traffic data and the abnormal IP prefix, determine the indicator data of the abnormal IP prefix in the current time period; as well as Based on the destination IP address of each piece of network traffic data and the normal IP prefix, determine the indicator data of the normal IP prefix in the current time period; Determine the abnormal impact of the abnormal IP prefix based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the normal IP prefix in the current time period, wherein the abnormal impact is used to characterize the degree of influence of the abnormal IP prefix on network traffic in the current time period; The abnormal impact degree is compared with a set threshold, and based on the comparison result, it is determined whether there is an abnormal route in the target AS within the current time period.

2. The method according to claim 1, characterized in that The determining of the abnormal IP prefix and the normal IP prefix of the target AS based on the route announcement data or the route withdrawal data of each route update message includes: The announcement time of each route announcement data and the withdrawal time of each route withdrawal data belonging to the same IP prefix are sorted from early to late to determine the interruption time period of each IP prefix; Determine, based on the interruption time period of each IP prefix belonging to the target AS, the number of IP prefixes in the target AS that are in an interruption state in each sub-time period of the current time period, wherein the current time period includes a plurality of sub-time periods; Determine an interruption rate of the target AS in each sub-time period based on the number of IP prefixes in the target AS in an interrupted state and the total number of IP prefixes of the target AS in each sub-time period; For each sub-time period, if the interruption rate of the target AS in the sub-time period is greater than the set probability threshold, the IP prefix in the target AS in the sub-time period that is in an interrupted state is used as the abnormal IP prefix, and the IP prefix in the target AS in a non-interrupted state is used as the normal IP prefix.

3. The method according to claim 1, characterized in that The determining of the abnormal IP prefix and the normal IP prefix of the target AS based on the route announcement data or the route withdrawal data of each route update message includes: Determine the registered IP prefix of the target AS based on the corresponding relationship between the target AS and the set corresponding relationship, wherein the corresponding relationship is the corresponding relationship between each AS and each registered IP prefix; For each IP prefix of the route announcement data or the route withdrawal data of the route update message, if the IP prefix does not exist in the registered IP prefixes of the target AS, and the AS path of the route announcement data or the route withdrawal data of the route update message does not satisfy the set AS business relationship, then the IP prefix is ​​determined to be the abnormal IP prefix; If the IP prefix exists in the registered IP prefixes of the target AS, or the IP prefix does not exist in the registered IP prefixes of the target AS, and the AS path of the route declaration data or route withdrawal data of the route update message satisfies the set AS business relationship, then the IP prefix is ​​determined to be the normal IP prefix.

4. The method according to claim 1, characterized in that The determining, based on the destination IP address of each piece of network traffic data and the abnormal IP prefix, indicator data of the abnormal IP prefix in the current time period includes: Based on the destination IP address of each piece of network traffic data and the abnormal IP prefix, determine the network traffic data corresponding to the abnormal IP prefix in the current time period; Determine an indicator value of at least one set flow indicator of the abnormal IP prefix based on network flow data corresponding to the abnormal IP prefix in the current time period; Based on an indicator value of at least one set traffic indicator of the abnormal IP prefix, indicator data of the abnormal IP prefix in a current time period is determined.

5. The method according to claim 1, characterized in that The determining, based on the destination IP address of each piece of network traffic data and the normal IP prefix, indicator data of the normal IP prefix in the current time period includes: Based on the destination IP address of each piece of network traffic data and the normal IP prefix, determine the network traffic data corresponding to the normal IP prefix in the current time period; Determine an indicator value of at least one set flow indicator of the normal IP prefix based on network flow data corresponding to the normal IP prefix in the current time period; Based on an indicator value of at least one set traffic indicator of the normal IP prefix, indicator data of the normal IP prefix in a current time period is determined.

6. The method according to claim 1, characterized in that The determining the abnormal impact of the abnormal IP prefix based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the normal IP prefix in the current time period includes: Determine a first abnormal impact based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the abnormal IP prefix in the historical time period; Determine a second abnormal impact based on the indicator data of the abnormal IP prefix in the current time period, the indicator data of the normal IP prefix in the current time period, the indicator data of the abnormal IP prefix in the historical time period, and the indicator data of the normal IP prefix in the historical time period; The abnormality impact is determined based on the first abnormality impact, the second abnormality impact, and their respective corresponding weights.

7. The method according to claim 6, characterized in that The first abnormal impact includes part or all of the flow impact, connection success rate impact and connection quantity impact: If the first abnormal impact includes the flow impact, the flow impact is determined by: determining the flow impact based on the network flow of the abnormal IP prefix in the current time period and the network flow of the abnormal IP prefix in the historical time period; If the first abnormality impact includes the connection success rate impact, the connection success rate impact is determined in the following manner: based on the Transmission Control Protocol TCP connection success rate of the abnormal IP prefix in the current time period and the TCP connection success rate of the abnormal IP prefix in the historical time period, the connection success rate impact is determined; If the first abnormality impact includes the connection quantity impact, the connection quantity impact is determined in the following manner: based on the number of TCP connections of the abnormal IP prefix in the current time period and the number of TCP connections of the abnormal IP prefix in the historical time period, the connection quantity impact is determined.

8. The method according to claim 6, characterized in that The determining of the second abnormal impact based on the indicator data of the abnormal IP prefix in the current time period, the indicator data of the normal IP prefix in the current time period, the indicator data of the abnormal IP prefix in the historical time period, and the indicator data of the normal IP prefix in the historical time period includes: Determine a first correlation based on the network traffic of the abnormal IP prefix in M ​​historical time periods and the network traffic of the normal IP prefix in M ​​historical time periods, wherein M is a positive integer greater than 1, and the first correlation is used to characterize the correlation degree between the network traffic of the abnormal IP prefix and the normal IP prefix in the historical time period; Determine a second correlation based on the network traffic of the abnormal IP prefix in the current time period, the network traffic of the normal IP prefix in the current time period, the network traffic of the abnormal IP prefix in M-1 historical time periods, and the network traffic of the normal IP prefix in M-1 historical time periods, wherein the second correlation is used to characterize the degree of correlation between the network traffic of the abnormal IP prefix and the normal IP prefix in the current time period; The second abnormality influence degree is determined based on the first correlation degree and the second correlation degree.

9. The method according to any one of claims 1 to 8, characterized in that: The determining, based on the comparison result, whether there is an abnormal route in the target AS within the current time period includes: If the abnormal impact is greater than or equal to the set threshold, it is determined that an abnormal route exists in the target AS in the current time period; If the abnormal impact is less than the set threshold, it is determined that there is no abnormal route in the target AS within the current time period.

10. A BGP abnormal routing identification device, characterized in that: include: An acquisition module is used to acquire multiple network flow data in the current time period and multiple routing update messages whose source AS of the AS path is the target AS from the border routers of each autonomous system AS; A first determination module, configured to determine an abnormal Internet Protocol IP prefix and a normal IP prefix of the target AS based on route announcement data or route withdrawal data of each route update message; A second determination module is used to determine the indicator data of the abnormal IP prefix in the current time period based on the destination IP address of each network traffic data and the abnormal IP prefix; as well as Based on the destination IP address of each piece of network traffic data and the normal IP prefix, determine the indicator data of the normal IP prefix in the current time period; A third determination module is used to determine the abnormal impact of the abnormal IP prefix based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the normal IP prefix in the current time period, wherein the abnormal impact is used to characterize the degree of influence of the abnormal IP prefix on the network traffic in the current time period; The comparison module is used to compare the abnormal impact degree with a set threshold, and determine whether there is an abnormal route in the target AS within a current time period based on the comparison result.

11. An electronic device, characterized in that: include: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory, and execute the steps included in any one of the methods of claims 1-9 according to the obtained program instructions.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes the method according to any one of claims 1 to 9.

13. A computer program product, characterized in that The computer program product comprises: a computer program code, and when the computer program code is run on a computer, the computer is enabled to execute the method according to any one of claims 1 to 9.

Images