Autonomous system organization mapping method and device based on semi-supervised clustering algorithm

Abstract

The invention discloses an autonomous system organization mapping method and device based on a semi-supervised clustering algorithm, and the method comprises the steps: extracting the original data information of an autonomous system from a preset dimension, and carrying out the preprocessing of the original data information; integrating the preprocessed original data information to generate an autonomous system basic feature matrix and an autonomous system key feature constraint matrix; according to an SC-MP I algorithm, performing multi-round iterative clustering on the autonomous system basic feature matrix and the autonomous system key feature constraint matrix, and determining the number of clustered class clusters in a binary approximation mode to obtain a plurality of class clusters; and according to the characteristic mode of the autonomous system in each class cluster, determining the organization name and code of the class cluster, and obtaining a final autonomous system-organization mapping relationship. It is ensured that the data dimension is wide enough; the model can be easily deployed to a stable production environment, and excessive manual intervention on data is not needed; and the flexibility of the clustering mapping process is improved.

Description

Technical Field

[0001] The present invention belongs to the field of Internet technology, and in particular relates to an autonomous system organization mapping method and device based on a semi-supervised clustering algorithm. Background Art

[0002] The modern Internet divides the network into several autonomous systems. Each autonomous system has certain management and control rights and can independently formulate internal routing strategies and management rules. Through the autonomous system-organization mapping method, the boundaries of different organizations can be clearly divided and certain network management and security responsibilities can be assigned to each organization.

[0003] However, the accuracy of existing autonomous system organization mapping methods still has room for improvement, and the data dimensions they cover are not wide enough, resulting in a lack of universality in their results. More importantly, current autonomous system organization mapping methods often rely heavily on manual correction and optimization, which is difficult to implement in production practice, and it is also difficult to make corrections when faced with frequently updated and complex network data sets. Summary of the invention

[0004] In view of this, the purpose of the present invention is to propose an autonomous system organization mapping method and device based on a semi-supervised clustering algorithm to solve or partially solve the technical problems mentioned in the background technology.

[0005] Based on the above objectives, in a first aspect, the present invention provides an autonomous system organization mapping method based on a semi-supervised clustering algorithm, comprising:

[0006] Extracting raw data information of the autonomous system from a preset dimension, wherein the preset dimension includes at least one dimension of the RIR public knowledge base, the database of WHOIS and RDAP services, the observation data of BGP routing messages, and the CAIDA public data;

[0007] Preprocessing the raw data information, and integrating the preprocessed raw data information to generate an autonomous system basic feature matrix and an autonomous system key feature constraint matrix;

[0008] According to the SC-MPI algorithm, the basic feature matrix of the autonomous system and the key feature constraint matrix of the autonomous system are subjected to multiple rounds of iterative clustering, and the number of clusters of clustering is determined by a binary approximation method to obtain multiple clusters;

[0009] According to the characteristic mode of the autonomous systems in each of the clusters, the organization name and code of the cluster are determined to obtain a final autonomous system-organization mapping relationship.

[0010] As a preferred solution of the autonomous system organization mapping method based on the semi-supervised clustering algorithm, in the process of extracting the original data information of the autonomous system from the preset dimension, the original data information extracted from the RIR public knowledge base includes the AS number, the AS country affiliation, the AS registration time, the field opg_id describing the AS resource assignee, and the number resource status, and constructs a first data table with the AS number as the primary key and the AS country affiliation, the AS registration time, the field opg_id describing the AS resource assignee, and the number resource status as the column fields;

[0011] The original data information extracted from the database of the WHOIS and RDAP services includes AS number, AS name, AS description information, AS administrator information, AS technical contact information, number resource maintainer information, AS routing export rule information, and AS routing import rule information; and construct a second data table with the AS number as the primary key and the AS name, AS description information, AS administrator information, AS technical contact information, and number resource maintainer information as column fields;

[0012] The original data information extracted from the observation data of the BGP routing message includes AS number, AS IPv4 prefix set, AS IPv6 prefix set, AS IPv4 Peer set, and AS IPv6 Peer set; and a third data table is constructed with AS number as the primary key and AS IPv4 prefix set, AS IPv6 prefix set, AS IPv4 Peer set, and AS IPv6 Peer set information as column fields;

[0013] The original data information extracted from the CAIDA public data includes AS number, AS ranking, and AS longitude and latitude location information, and a fourth data table is constructed with AS number as the primary key and AS ranking and AS longitude and latitude location information as column fields.

[0014] As a preferred solution of the autonomous system organization mapping method based on a semi-supervised clustering algorithm, an AS knowledge base is constructed with the AS number as the primary key and the AS ranking information as the column field according to the first data table, the second data table, the third data table, and the fourth data table.

[0015] As a preferred solution of the autonomous system organization mapping method based on the semi-supervised clustering algorithm, during the preprocessing of the raw data information:

[0016] Perform data cleaning on the AS knowledge base; extract data features using natural language processing and string matching technology;

[0017] According to the configuration, the preset characteristics of the AS are weighted;

[0018] Use TF-IDF to vectorize the weighted AS basic features and AS key feature data to generate the original feature matrix;

[0019] Use the SVD algorithm to reduce the data dimension of the original feature matrix;

[0020] Generate the autonomous system basic feature matrix and the autonomous system key feature constraint matrix.

[0021] As a preferred solution of the autonomous system organization mapping method based on the semi-supervised clustering algorithm, according to the SC-MPI algorithm, the autonomous system basic feature matrix and the autonomous system key feature constraint matrix are subjected to multiple rounds of iterative clustering, and the number of clusters is determined by a binary approximation method. The steps of obtaining multiple clusters include:

[0022] T1, normalizing the basic feature matrix of the autonomous system, the key feature constraint matrix of the autonomous system, and the custom constraint matrix to unify the matrix dimensions of the basic feature matrix of the autonomous system, the key feature constraint matrix of the autonomous system, and the custom constraint matrix;

[0023] T2, using the autonomous system basic feature matrix, the autonomous system key feature constraint matrix and the custom constraint matrix as inputs of the SC-MPI algorithm to generate a target matrix Φ′;

[0024] T3, performing Ward-Linkage hierarchical clustering on the first k eigenvectors of the target matrix Φ′ to obtain the final clustering result;

[0025] T4, multiple rounds of iteration steps T1, T2 and T3, select the AS clustering data U with the best clustering effect for data recall and labeling.

[0026] As a preferred solution of the autonomous system organization mapping method based on the semi-supervised clustering algorithm, the steps of determining the organization name and code of the cluster according to the characteristic mode of the autonomous system in each cluster, and obtaining the final autonomous system-organization mapping relationship include:

[0027] For the clustering result U, recall and associate the AS knowledge base;

[0028] The mode feature of the recalled AS knowledge base data is calculated, and the mode feature is used as the unique feature of the cluster.

[0029] The unique feature of each of the clusters is used as a feature field of the organization and persisted as an autonomous system-organization mapping data table. The mapping relationship between the autonomous system and the organization is expressed through the autonomous system-organization mapping data table.

[0030] In a second aspect, the present invention provides an autonomous system organization mapping device based on a semi-supervised clustering algorithm, comprising:

[0031] The raw data information extraction module is used to extract the raw data information of the autonomous system from preset dimensions, wherein the preset dimensions include the RIR public knowledge base, the database of WHOIS and RDAP services, the observation data of BGP routing messages, and CAIDA public data;

[0032] A raw data information preprocessing module, used to preprocess the raw data information, and integrate the preprocessed raw data information to generate an autonomous system basic feature matrix and an autonomous system key feature constraint matrix;

[0033] A matrix cluster analysis module, used to perform multiple rounds of iterative clustering on the basic feature matrix of the autonomous system and the key feature constraint matrix of the autonomous system according to the SC-MPI algorithm, determine the number of clusters by a binary approximation method, and obtain multiple clusters;

[0034] The mapping relationship generation module is used to determine the organization name and code of the cluster according to the characteristic mode of the autonomous system in each cluster, and obtain the final autonomous system-organization mapping relationship.

[0035] As a preferred solution of the autonomous system organization mapping device based on the semi-supervised clustering algorithm, in the raw data information extraction module:

[0036] The original data information extracted from the RIR public knowledge base includes AS number, AS country affiliation, AS registration time, field opg_id describing the AS resource assignee, and number resource status, and constructs a first data table with AS number as the primary key and AS country affiliation, AS registration time, field opg_id describing the AS resource assignee, and number resource status as column fields;

[0037] The original data information extracted from the database of the WHOIS and RDAP services includes AS number, AS name, AS description information, AS administrator information, AS technical contact information, number resource maintainer information, AS routing export rule information, and AS routing import rule information; and construct a second data table with the AS number as the primary key and the AS name, AS description information, AS administrator information, AS technical contact information, and number resource maintainer information as column fields;

[0038] The original data information extracted from the observation data of the BGP routing message includes AS number, AS IPv4 prefix set, AS IPv6 prefix set, AS IPv4 Peer set, and AS IPv6 Peer set; and a third data table is constructed with AS number as the primary key and AS IPv4 prefix set, AS IPv6 prefix set, AS IPv4 Peer set, and AS IPv6 Peer set information as column fields;

[0039] The raw data information extracted from the CAIDA public data includes AS number, AS ranking, and AS longitude and latitude location information, and a fourth data table is constructed with AS number as the primary key and AS ranking and AS longitude and latitude location information as column fields;

[0040] According to the first data table, the second data table, the third data table and the fourth data table, an AS knowledge base is constructed with the AS number as the primary key and the AS ranking information as the column field.

[0041] As a preferred solution of the autonomous system organization mapping device based on the semi-supervised clustering algorithm, the raw data information preprocessing module includes:

[0042] A data cleaning submodule, used for cleaning the data of the AS knowledge base;

[0043] Data feature extraction submodule, used to extract data features using natural language processing and string matching technology;

[0044] A feature weighting submodule is used to weight the preset features of the AS according to the configuration;

[0045] The original feature matrix generation submodule is used to vectorize the weighted AS basic features and AS key feature data respectively using TF-IDF to generate the original feature matrix;

[0046] The data dimension reduction submodule is used to reduce the data dimension of the original feature matrix using the SVD algorithm;

[0047] The matrix generation submodule is used to generate the basic characteristic matrix of the autonomous system and the key characteristic constraint matrix of the autonomous system.

[0048] As a preferred solution of the autonomous system organization mapping device based on the semi-supervised clustering algorithm, the matrix cluster analysis module includes:

[0049] A matrix normalization processing submodule is used to normalize the basic feature matrix of the autonomous system, the key feature constraint matrix of the autonomous system and the custom constraint matrix, and unify the matrix dimensions of the basic feature matrix of the autonomous system, the key feature constraint matrix of the autonomous system and the custom constraint matrix;

[0050] A target matrix generation submodule is used to use the autonomous system basic feature matrix, the autonomous system key feature constraint matrix and the user-defined constraint matrix as inputs of the SC-MPI algorithm to generate a target matrix Φ′;

[0051] A clustering result generation submodule is used to perform Ward-Linkage hierarchical clustering on the first k eigenvectors of the target matrix Φ′ to obtain the final clustering result;

[0052] The iterative processing submodule is used to perform multiple rounds of iterations and select the AS clustering data U with the best clustering effect for data recall and labeling.

[0053] As a preferred solution of the autonomous system organization mapping device based on the semi-supervised clustering algorithm, the mapping relationship generation module includes:

[0054] A knowledge base association submodule, used for recalling and associating the AS knowledge base with respect to the clustering result U;

[0055] The mode feature calculation submodule is used to calculate the mode feature of the recalled AS knowledge base data and use the mode feature as the unique feature of the cluster.

[0056] The mapping data table generation submodule is used to use the unique feature of each cluster as the feature field of the organization and persist it into an autonomous system-organization mapping data table, through which the mapping relationship between the autonomous system and the organization is expressed.

[0057] From the above, it can be seen that the technical solution provided by the present invention generates high-dimensional autonomous system feature vectors through multiple data sources, ensuring that the data dimension is wide enough; the clustering algorithm based on machine learning technology can ensure the accuracy of the mapping relationship generated by the clustering, and at the same time, it can relatively easily deploy the model to a stable production environment without too much manual intervention in the data; the semi-supervised learning framework ensures the upper limit of the error of the cluster mapping result, and also allows additional autonomous system data to be imported into the model through semi-supervised constraints without retraining the model, thereby improving the flexibility of the cluster mapping process; compared with the existing methods, the present invention has the characteristics of high accuracy, high universality and high automation. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions in the present invention or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0059] Figure 1 A schematic diagram of a process flow of an autonomous system organization mapping method based on a semi-supervised clustering algorithm provided in an embodiment of the present invention;

[0060] Figure 2 A schematic diagram of the raw data information preprocessing process in the autonomous system organization mapping method based on the semi-supervised clustering algorithm provided in an embodiment of the present invention;

[0061] Figure 3 A diagram of the device architecture of an autonomous system organization mapping method based on a semi-supervised clustering algorithm provided in an embodiment of the present invention;

[0062] Figure 4 FIG. 4 is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0063] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

[0064] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present invention should have the usual meanings understood by people with ordinary skills in the field to which the present invention belongs. The words "include" or "comprise" and the like used in the embodiments of the present invention mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, but do not exclude other elements or objects.

[0065] The modern Internet divides the network into several autonomous systems, each of which has certain management and control rights and can independently formulate internal routing strategies and management rules. Different technical management departments manage and operate different autonomous systems, and each autonomous system has its own specific organization; similarly, each organization will also have multiple autonomous systems at the same time, such as universities, research institutions, Internet companies, government agencies, operators, etc., and they obtain their own autonomous systems by applying for autonomous system numbers. The autonomous systems of the same organization have certain similarities in network management and security protection strategies, forming an institutional mapping topology of the autonomous system, which to a certain extent reflects the alliance governance relationship of the autonomous system and constitutes an overlay network for cyberspace governance.

[0066] Border Gateway Protocol (BGP) is a protocol used to exchange routing information on the Internet. It is widely used to connect different autonomous systems and realize interconnection and data transmission between autonomous systems. BGP is mainly used to select the best data transmission path between autonomous systems to ensure that data can be efficiently transmitted from one autonomous system to another. Through the BGP protocol, different autonomous systems can exchange routing information, select the best path, and establish data communication across autonomous systems. This hierarchical network structure allows each autonomous system to manage according to its own needs, while being able to communicate with each other on the Internet, thus building a large and efficient Internet system.

[0067] The basic information and specific distribution of autonomous systems can be obtained through the public download addresses opened by major RIRs (Regional Internet Registries). They are the basis of the basic information knowledge base of autonomous systems. WHOIS (Who Is Protocol) and RDAP (Registration Data Access Protocol) are protocols used to obtain information related to Internet resources, mainly used to query the registration information of resources such as domain names, IP addresses and autonomous systems. The five major RIRs all provide WHOIS and RDAP services for public query. The European IP Network Resource Coordination Center (RIPE Network Coordination Centre, RIPE NCC) and the University of Oregon (Route Views Project) have respectively provided observation data of Internet BGP routing messages. The basic information knowledge base of autonomous systems needs to analyze these message data and extract the hidden associations of autonomous systems hidden in the BGP routing path. CAIDA (Center for Applied Internet Data Analysis) is a research organization dedicated to analyzing and understanding Internet data. They have carried out many useful research works in the field of Internet. CAIDA publicly provides ASRank data for ranking autonomous systems, which helps to set the weights of autonomous systems in the basic information knowledge base of autonomous systems.

[0068] There are currently two existing methods for autonomous domain organization mapping. One is to refer to the data information filled in by the registration agency itself, such as PCH (Packet Clearing House), which is an international organization responsible for providing operational support and security for key Internet infrastructure, including Internet exchange points and the core of the domain name system. However, whether the data is filled and reported depends on the organization's own consciousness, lacks authority and accuracy, and is rarely used in the industry. Another method is to achieve organization mapping through AS clustering. Cai et al. first implemented this method using autonomous domain system data obtained from the RIR WHOIS database. First, they created an object for each AS in each database, then considered other objects in the RIR database that were linked to the given AS, and assigned the fields of these objects to the specified AS object. Finally, they used a machine-based learning algorithm to analyze the similarity between objects and complete the organization mapping of the autonomous domain system. Later, CAIDA (Center for Applied Internet Data Analysis) also produced a set of autonomous domain organization mapping data. Their method is similar to that of Cai et al. Their algorithm maintains the original database structure and creates different objects for organizations, ASs, and contacts, and then performs organization mapping based on the object fields and their relationships with other objects. These clustering methods have the problems of low utilization of original data and poor mapping accuracy, and often require manual data correction, with insufficient automation. In the test results provided by CAIDA, the organization with the highest mapping accuracy is ISC, with an accuracy of 96.5%; the organization with the lowest mapping accuracy is Verizon, with an accuracy of 37.7%. The overall average mapping accuracy is 62.3%, and the mapping effect is poor.

[0069] The traditional autonomous domain system topology abstracts the AS-level topology into an undirected graph, where each AS is regarded as a single point in the graph, and the interconnection between ASs through border gateways is regarded as the edge in the graph. The importance and hierarchical relationship of ASs are displayed by the degree of nodes and the business relationship between ASs. The above AS topology focuses on the position and importance of AS in the two-dimensional network space, and ignores the governance and management relationship of the autonomous domain system.

[0070] Through the autonomous system-organization mapping method, the boundaries of different organizations can be clearly demarcated, and certain network management and security responsibilities can be assigned to each organization. This helps to allocate network resources, control traffic, and formulate security policies more finely, thereby ensuring the stable operation of the network and the security of data. It is also possible to more accurately understand the legal jurisdiction and regulatory requirements of each autonomous system to ensure the legality and compliance of network activities. At the same time, by understanding the relationship between different autonomous systems and organizations, the network architecture can be better designed, the data transmission path can be optimized, and the performance and reliability of the network can be improved.

[0071] However, the accuracy of the existing autonomous system organization mapping method still has room for improvement, and the data dimensions it covers are not wide enough, resulting in a lack of universality in its results. More importantly, the current autonomous system organization mapping method is often deeply dependent on manual correction and optimization, which is difficult to implement in production practice, and it is also difficult to make corrections when faced with frequently updated and complex network data sets. In view of this. An embodiment of the present invention proposes an autonomous system organization mapping method based on a semi-supervised clustering algorithm to solve the above problems. The following is the specific content of an embodiment of the present invention.

[0072] See also Figure 1 The embodiment of the present invention provides an autonomous system organization mapping method based on a semi-supervised clustering algorithm, comprising the following steps:

[0073] S1. Extracting raw data information of the autonomous system from preset dimensions, wherein the preset dimensions include RIR public knowledge base, WHOIS, RDAP service database, BGP routing message observation data, and CAIDA public data;

[0074] S2, preprocessing the raw data information, integrating the preprocessed raw data information to generate an autonomous system basic feature matrix and an autonomous system key feature constraint matrix;

[0075] S3, according to the SC-MPI algorithm, the basic feature matrix of the autonomous system and the key feature constraint matrix of the autonomous system are subjected to multiple rounds of iterative clustering, and the number of clusters is determined by a binary approximation method to obtain multiple clusters;

[0076] S4. Determine the organization name and code of the cluster according to the characteristic mode of the autonomous systems in each cluster, and obtain a final autonomous system-organization mapping relationship.

[0077] In this embodiment, step S1 is used to obtain the original data for mapping analysis. Step S1 uses multiple authoritative data sources to ensure the reliability of the original data. At the same time, each original data is basically processed to ensure that the AS number is the primary key to facilitate subsequent integrated analysis. The sub-steps of step S1 specifically include:

[0078] S11, in the process of extracting the original data information of the autonomous system from the preset dimension, the original data information extracted from the RIR public knowledge base includes the AS number, the AS country affiliation, the AS registration time, the field opg_id describing the AS resource assignee, and the number resource status, and constructing a first data table with the AS number as the primary key and the AS country affiliation, the AS registration time, the field opg_id describing the AS resource assignee, and the number resource status as the column fields;

[0079] S12, obtaining detailed information of AS from the database of WHOIS and RDAP services, wherein the original data information extracted from the database of WHOIS and RDAP services includes AS number, AS name, AS description information, AS administrator information, AS technical contact information, number resource maintainer information, AS routing export rule information, and AS routing import rule information; and constructing a second data table with AS number as the primary key and AS name, AS description information, AS administrator information, AS technical contact information, and number resource maintainer information as column fields;

[0080] S13, obtaining the routing prefix contained in the AS and its Peer AS (mutually reachable AS) information from the observation data of the BGP routing message, wherein the original data information extracted from the observation data of the BGP routing message includes the AS number, ASIPv4 prefix set, AS IPv6 prefix set, AS IPv4 Peer set, and AS IPv6 Peer set; and constructing a third data table with the AS number as the primary key and the AS IPv4 prefix set, AS IPv6 prefix set, AS IPv4 Peer set, and AS IPv6 Peer set information as column fields;

[0081] S14, obtaining an AS ranking data table from CAIDA public data, wherein the original data information extracted from the CAIDA public data includes AS number, AS ranking, and AS longitude and latitude location information, and constructing a fourth data table with AS number as the primary key and AS ranking and AS longitude and latitude location information as column fields;

[0082] S15. Construct an AS knowledge base based on the first data table, the second data table, the third data table, and the fourth data table, with the AS number as the primary key and the AS ranking information as the column field.

[0083] In this embodiment, step S2 is to pre-process the original data information. After merging all the original data with the AS number as the unified primary key, the AS feature matrix and the AS constraint matrix can be obtained respectively after data pre-processing. The specific flow chart is shown in Figure 2 The sub-steps of step S2 specifically include:

[0084] S21. Clean the AS knowledge base and retain key high-value fields. As an example, Table 1 shows some key data fields and their descriptions.

[0085] Fields describe asn AS Number country AS belongs to the country opaque_id (Key Features) RIR Registration Logo as_name AS Name descr AS Description orgID (Key feature) orgID of AS org_email AS's organization's physical mailbox admin_email Email of the administrator of AS tech_email AS technical contact email abuse_email Email address for AS abuse reporting contact type AS type (from ASDB)

[0086] Table 1 Examples of some key data fields

[0087] S22. Use natural language processing and string matching technology to extract data features; the main contents include: extracting nouns pointing to organizations in AS data through named entity recognition (NER), and extracting the email domain name of the main contact of each AS through email domain name matching. In addition, it is also necessary to perform pre-processing operations such as stop word filtering, invalid character cleaning, and character encoding unification;

[0088] S23. According to the configuration, weight the preset features of AS; for example, if the technician wants to pay more attention to the mapping relationship of organizations at the national level, the weight of the country field should be increased. It should be noted that this step should distinguish between the basic features and key features of AS and evaluate them with different weight systems;

[0089] S24, using TF-IDF to vectorize the weighted AS basic features and AS key feature data respectively to generate an original feature matrix;

[0090] S25. Use the SVD algorithm to reduce the data dimension of the original feature matrix. Since the data dimension is high after TF-IDF vectorization, it is necessary to use SVD to reduce the data dimension of the feature matrix.

[0091] S26. Generate the autonomous system basic feature matrix and the autonomous system key feature constraint matrix.

[0092] In this embodiment, the sub-steps of step S3 include:

[0093] S31, normalizing the basic feature matrix of the autonomous system, the key feature constraint matrix of the autonomous system, and the custom constraint matrix to unify the matrix dimensions of the basic feature matrix of the autonomous system, the key feature constraint matrix of the autonomous system, and the custom constraint matrix;

[0094] S32, using the autonomous system basic feature matrix, the autonomous system key feature constraint matrix and the custom constraint matrix as inputs of the SC-MPI algorithm to generate a target matrix Φ′;

[0095] S33, performing Ward-Linkage hierarchical clustering on the first k eigenvectors of the target matrix Φ′ to obtain the final clustering result;

[0096] S34, multiple rounds of iteration steps T1, T2 and T3, select the AS clustering data U with the best clustering effect for data recall and labeling.

[0097] Specifically, step S3 performs semi-supervised clustering on AS data through the SC-MPI algorithm. The input of step S3 includes three parts: AS feature matrix (unsupervised operator, required), AS constraint matrix (supervised operator, required) and custom constraint matrix (supervised operator, optional). The output of this step is a set of clusters, each cluster represents an organization, and the cluster contains one or more ASs.

[0098] Specifically, SC-MPI (Semi-supervised clustering with constraints of different types from multiple information sources) is a semi-supervised clustering algorithm. The algorithm first provides a multi-source constraint normalization scheme, which allows the pairwise constraints (constraining whether two data points belong to the same class) and label constraints (constraining whether a data point belongs to a specific class / cluster) from multiple sources to be normalized into a constraint matrix. The algorithm then proves that the k-clustering process based on this constraint matrix is ​​equivalent to finding the first k eigenvectors of the matrix Φ (as shown in Equation (1)):

[0099]

[0100] Among them, α is a balance value greater than 0, which is used to balance the importance of semi-supervised constraints and clustering data. (ij) ] is an n*n dot product matrix, K (ij) is the data point x i and x j The dot product between them, n is the number of data points, and the K matrix represents the clustering characteristics of the original data, which is an unsupervised learning operator. t,t=1…m is the previously normalized constraint matrix of m different sources, which is the supervised learning operator. For a k-clustering problem, after obtaining the first k eigenvectors of the matrix Φ, the k eigenvectors v1,v2…,v k Stack by rows to get the preliminary clustering matrix for each cluster

[0101]

[0102] Then, the classic hierarchical clustering algorithm Ward-Linkage is used to cluster the rows of the matrix After performing secondary clustering, we can get the final clustering result U:

[0103]

[0104] Among them, combined with the characteristics of autonomous system knowledge base data, the SC-MPI algorithm is used to realize the clustering of autonomous systems, and finally the mapping relationship between autonomous systems and organizations is obtained.

[0105] The specific steps of step S32 are as follows:

[0106] a. Since the number of organizational features in AS features is relatively small (no more than 20), it is necessary to use kernel functions to map the features to high dimensions to improve the feature significance of the unsupervised operator, thereby optimizing the clustering results. The present invention uses a Gaussian kernel (also known as Radial Basis Function, RBF kernel) to map the AS feature matrix K to an infinite-dimensional vector space, and calculates its n-dimensional projection K′, where n is the number of AS in the data set, as shown in formula (4);

[0107]

[0108] b. Calculate the target matrix Φ′ according to formula (5), where β ≥ α, which is used to balance the weights of the two supervisory operators;

[0109]

[0110] b-1.K′ is the kernel function feature matrix obtained in step C1;

[0111] b-2. is the custom constraint matrix operator. m is the number of custom constraint features; G t It is a custom constraint matrix that can be freely configured by technicians without introducing this operator;

[0112] b-3. is the AS constraint matrix operator. l is the number of key features. Taking Table 1 as an example, l=2, which refers to the two fields of opaque_id and orgID respectively; t is the weight of the specific self-supervision constraint. Taking Table 1 as an example, if orgID has a higher confidence than opaque_id in expressing the relationship between ASs belonging to the same organization, then λ orgID >λ opaque_id ; S t is the AS constraint matrix;

[0113] c. According to the target matrix Φ′, set the initial value k=n of the number of clusters, and obtain the clustering result U by performing Ward-Linkage hierarchical clustering on the first k eigenvectors;

[0114] d. Iterate and execute sub-step C3 and perform binary approximation on parameter k. The binary evaluation method is the clustering silhouette coefficient. When the clustering silhouette coefficient differential change rate in step S33 is the highest, the binary iteration ends. At this time, parameter k is the optimal value, and the clustering effect of the model output clustering result U is the best;

[0115] In this embodiment, step S4 extracts and analyzes the characteristic mode of each organization cluster obtained in the clustering result U, and further classifies and merges the data to obtain the final AS grouping table. Each AS group represents an organization and its AS resources. The sub-steps of step S4 specifically include:

[0116] S41, for the clustering result U, recall and associate the AS knowledge base obtained in step A;

[0117] S42. Find the majority feature of the recalled AS knowledge base data and use it as the unique feature of the cluster.

[0118] S43. The unique feature of each cluster is the characteristic field of the organization, which is persisted as an autonomous system-organization mapping data table, which can express the mapping relationship between the autonomous system and the organization.

[0119] In summary, the present invention extracts the original data information of the autonomous system from preset dimensions, and the preset dimensions include at least one dimension of the RIR public knowledge base, the database of WHOIS and RDAP services, the observation data of BGP routing messages, and the CAIDA public data; the original data information is preprocessed, and the preprocessed original data information is integrated to generate the basic feature matrix of the autonomous system and the key feature constraint matrix of the autonomous system; according to the SC-MPI algorithm, the basic feature matrix of the autonomous system and the key feature constraint matrix of the autonomous system are subjected to multiple rounds of iterative clustering, and the number of clustering clusters is determined by the binary approximation method to obtain multiple clusters; according to the feature mode of the autonomous system in each of the clusters, the organization name and code of the cluster are determined to obtain the final autonomous system-organization mapping relationship. The technical solution provided by the present invention generates high-dimensional autonomous system feature vectors through multiple data sources, ensuring that the data dimension is wide enough; the clustering algorithm based on machine learning technology can ensure the accuracy of the mapping relationship generated by the clustering, and at the same time, it can relatively easily deploy the model to a stable production environment without too much manual intervention in the data; the semi-supervised learning framework ensures the error upper limit of the cluster mapping result, and also allows additional autonomous system data to be imported into the model through semi-supervised constraints without retraining the model, thereby improving the flexibility of the cluster mapping process; compared with the existing methods, the present invention has the characteristics of high accuracy, high universality and high automation.

[0120] It should be noted that the method of the embodiment of the present invention can be performed by a single device, such as a computer or a server. The method of this embodiment can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present invention, and the multiple devices will interact with each other to complete the described method.

[0121] It should be noted that some embodiments of the present invention are described above. In some cases, the actions or steps recorded can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the process depicted in the accompanying drawings does not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0122] See also Figure 3 Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the embodiment of the present invention further provides an autonomous system organization mapping device based on a semi-supervised clustering algorithm, comprising:

[0123] The raw data information extraction module 100 is used to extract the raw data information of the autonomous system from a preset dimension, wherein the preset dimension includes the RIR public knowledge base, the database of WHOIS and RDAP services, the observation data of BGP routing messages, and CAIDA public data;

[0124] The raw data information preprocessing module 200 is used to preprocess the raw data information and integrate the preprocessed raw data information to generate an autonomous system basic feature matrix and an autonomous system key feature constraint matrix;

[0125] The matrix cluster analysis module 300 is used to perform multiple rounds of iterative clustering on the basic feature matrix of the autonomous system and the key feature constraint matrix of the autonomous system according to the SC-MPI algorithm, determine the number of clusters by a binary approximation method, and obtain multiple clusters;

[0126] The mapping relationship generating module 400 is used to determine the organization name and code of the cluster according to the characteristic mode of the autonomous systems in each cluster, and obtain the final autonomous system-organization mapping relationship.

[0127] In this embodiment, in the raw data information extraction module 100:

[0128] The original data information extracted from the RIR public knowledge base includes AS number, AS country affiliation, AS registration time, field opg_id describing the AS resource assignee, and number resource status, and constructs a first data table with AS number as the primary key and AS country affiliation, AS registration time, field opg_id describing the AS resource assignee, and number resource status as column fields;

[0129] The original data information extracted from the database of the WHOIS and RDAP services includes AS number, AS name, AS description information, AS administrator information, AS technical contact information, number resource maintainer information, AS routing export rule information, and AS routing import rule information; and construct a second data table with the AS number as the primary key and the AS name, AS description information, AS administrator information, AS technical contact information, and number resource maintainer information as column fields;

[0130] The original data information extracted from the observation data of the BGP routing message includes AS number, AS IPv4 prefix set, AS IPv6 prefix set, AS IPv4 Peer set, and AS IPv6 Peer set; and a third data table is constructed with AS number as the primary key and AS IPv4 prefix set, AS IPv6 prefix set, AS IPv4 Peer set, and AS IPv6 Peer set information as column fields;

[0131] The raw data information extracted from the CAIDA public data includes AS number, AS ranking, and AS longitude and latitude location information, and a fourth data table is constructed with AS number as the primary key and AS ranking and AS longitude and latitude location information as column fields;

[0132] According to the first data table, the second data table, the third data table and the fourth data table, an AS knowledge base is constructed with the AS number as the primary key and the AS ranking information as the column field.

[0133] In this embodiment, the raw data information preprocessing module 200 includes:

[0134] A data cleaning submodule 201 is used to clean the data of the AS knowledge base;

[0135] The data feature extraction submodule 202 is used to extract data features using natural language processing and string matching technology;

[0136] The feature weighting submodule 203 is used to weight the preset features of the AS according to the configuration;

[0137] The original feature matrix generation submodule 204 is used to vectorize the weighted AS basic features and AS key feature data respectively using TF-IDF to generate an original feature matrix;

[0138] The data dimension reduction submodule 205 is used to perform data dimension reduction on the original feature matrix using the SVD algorithm;

[0139] The matrix generation submodule 206 is used to generate the autonomous system basic feature matrix and the autonomous system key feature constraint matrix.

[0140] In this embodiment, the matrix cluster analysis module 300 includes:

[0141] The matrix normalization processing submodule 301 is used to normalize the basic feature matrix of the autonomous system, the key feature constraint matrix of the autonomous system and the user-defined constraint matrix, and unify the matrix dimensions of the basic feature matrix of the autonomous system, the key feature constraint matrix of the autonomous system and the user-defined constraint matrix;

[0142] A target matrix generation submodule 302 is used to use the autonomous system basic feature matrix, the autonomous system key feature constraint matrix and the user-defined constraint matrix as inputs of the SC-MPI algorithm to generate a target matrix Φ′;

[0143] The clustering result generation submodule 303 is used to perform Ward-Linkage hierarchical clustering on the first k eigenvectors of the target matrix Φ′ to obtain the final clustering result;

[0144] The iterative processing submodule 304 is used to perform multiple rounds of iterations and select the AS clustering data U with the best clustering effect for data recall and labeling.

[0145] In this embodiment, the mapping relationship generation module 400 includes:

[0146] The knowledge base association submodule 401 is used to recall and associate the AS knowledge base with the clustering result U;

[0147] The mode feature calculation submodule 402 is used to calculate the mode feature of the recalled AS knowledge base data and use the mode feature as the unique feature of the cluster.

[0148] The mapping data table generation submodule 403 is used to use the unique feature of each of the clusters as the feature field of the organization and persist it into an autonomous system-organization mapping data table, through which the mapping relationship between the autonomous system and the organization is expressed.

[0149] The device of the above embodiment is used to implement a corresponding autonomous system organization mapping method based on a semi-supervised clustering algorithm in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0150] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the autonomous system organizational structure mapping method based on the semi-supervised clustering algorithm described in any of the above embodiments is implemented.

[0151] Figure 4 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 510, a memory 520, an input / output interface 530, a communication interface 540, and a bus 550. The processor 510, the memory 520, the input / output interface 530, and the communication interface 540 are connected to each other in communication within the device through the bus 550.

[0152] The processor 510 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0153] The memory 520 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 520 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 520 and are called and executed by the processor 510.

[0154] The input / output interface 530 is used to connect the input / output module to realize information input and output. The input / output module can be configured as a component in the device (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0155] The communication interface 540 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0156] The bus 550 comprises a pathway that transmits information between the various components of the device (eg, the processor 510 , the memory 520 , the input / output interface 530 , and the communication interface 540 ).

[0157] It should be noted that, although the above device only shows the processor 510, the memory 520, the input / output interface 530, the communication interface 540 and the bus 550, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0158] The electronic device of the above embodiment is used to implement a corresponding autonomous system organization mapping method based on a semi-supervised clustering algorithm in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0159] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present invention also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute an autonomous system organization mapping method based on a semi-supervised clustering algorithm as described in any of the above embodiments.

[0160] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0161] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute an autonomous system organization mapping method based on a semi-supervised clustering algorithm as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0162] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present invention is limited to these examples. Under the concept of the present invention, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of different aspects of the embodiments of the present invention as described above, which are not provided in detail for the sake of simplicity.

[0163] In addition, to simplify the description and discussion, and in order not to obscure the embodiments of the present invention, known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided figures. In addition, the devices may be shown in the form of block diagrams to avoid obscuring the embodiments of the present invention, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which the embodiments of the present invention will be implemented (i.e., these details should be fully within the scope of understanding of those skilled in the art). Where specific details (e.g., circuits) are set forth to describe exemplary embodiments of the present invention, it will be apparent to those skilled in the art that embodiments of the present invention may be implemented without these specific details or with variations in these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0164] Although the present invention has been described in conjunction with specific embodiments of the present invention, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0165] The embodiments of the present invention are intended to cover all such substitutions, modifications and variations that fall within the scope of the protection claimed. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present invention should be included in the protection scope of the present invention.

Claims

1. An autonomous system organization mapping method based on a semi-supervised clustering algorithm, where: include: Extracting raw data information of the autonomous system from a preset dimension, wherein the preset dimension includes at least one dimension of the RIR public knowledge base, the database of WHOIS and RDAP services, the observation data of BGP routing messages, and the CAIDA public data; Preprocessing the raw data information, and integrating the preprocessed raw data information to generate an autonomous system basic feature matrix and an autonomous system key feature constraint matrix; According to the SC-MPI algorithm, the basic feature matrix of the autonomous system and the key feature constraint matrix of the autonomous system are subjected to multiple rounds of iterative clustering, and the number of clusters of clustering is determined by a binary approximation method to obtain multiple clusters; According to the characteristic mode of the autonomous systems in each of the clusters, the organization name and code of the cluster are determined to obtain a final autonomous system-organization mapping relationship.

2. The autonomous system organization mapping method based on a semi-supervised clustering algorithm according to claim 1, wherein: In the process of extracting the original data information of the autonomous system from the preset dimension, the original data information extracted from the RIR public knowledge base includes the AS number, the AS country affiliation, the AS registration time, the field opg_id describing the AS resource assignee, and the number resource status, and constructing a first data table with the AS number as the primary key and the AS country affiliation, the AS registration time, the field opg_id describing the AS resource assignee, and the number resource status as the column fields; The original data information extracted from the database of the WHOIS and RDAP services includes AS number, AS name, AS description information, AS administrator information, AS technical contact information, number resource maintainer information, AS routing export rule information, and AS routing import rule information; and construct a second data table with the AS number as the primary key and the AS name, AS description information, AS administrator information, AS technical contact information, and number resource maintainer information as column fields; The original data information extracted from the observation data of the BGP routing message includes AS number, AS IPv4 prefix set, AS IPv6 prefix set, AS IPv4 Peer set, and AS IPv6 Peer set; and a third data table is constructed with AS number as the primary key and AS IPv4 prefix set, AS IPv6 prefix set, AS IPv4 Peer set, and AS IPv6 Peer set information as column fields; The original data information extracted from the CAIDA public data includes AS number, AS ranking, and AS longitude and latitude location information, and a fourth data table is constructed with AS number as the primary key and AS ranking and AS longitude and latitude location information as column fields.

3. The autonomous system organization mapping method based on semi-supervised clustering algorithm according to claim 2, wherein: According to the first data table, the second data table, the third data table and the fourth data table, an AS knowledge base is constructed with the AS number as the primary key and the AS ranking information as the column field.

4. The autonomous system organization mapping method based on semi-supervised clustering algorithm according to claim 3, wherein: During the preprocessing of the raw data information: Performing data cleaning on the AS knowledge base; Use natural language processing and string matching techniques to extract data features; According to the configuration, the preset characteristics of the AS are weighted; Use TF-IDF to vectorize the weighted AS basic features and AS key feature data to generate the original feature matrix; Use the SVD algorithm to reduce the data dimension of the original feature matrix; Generate the autonomous system basic feature matrix and the autonomous system key feature constraint matrix.

5. The autonomous system organization mapping method based on semi-supervised clustering algorithm according to claim 4, wherein: According to the SC-MPI algorithm, the basic feature matrix of the autonomous system and the key feature constraint matrix of the autonomous system are subjected to multiple rounds of iterative clustering, and the number of clusters of clustering is determined by a binary approximation method. The steps of obtaining multiple clusters include: T1, normalizing the basic feature matrix of the autonomous system, the key feature constraint matrix of the autonomous system, and the custom constraint matrix to unify the matrix dimensions of the basic feature matrix of the autonomous system, the key feature constraint matrix of the autonomous system, and the custom constraint matrix; T2, using the autonomous system basic feature matrix, the autonomous system key feature constraint matrix and the custom constraint matrix as inputs of the SC-MPI algorithm to generate a target matrix Φ ′ ; T3, the target matrix Φ ′ The first k eigenvectors of are subjected to Ward-Linkage hierarchical clustering to obtain the final clustering result; T4, multiple rounds of iteration steps T1, T2 and T3, select the AS clustering data U with the best clustering effect for data recall and labeling.

6. The autonomous system organization mapping method based on semi-supervised clustering algorithm according to claim 5, wherein: The steps of determining the organization name and code of the cluster according to the characteristic mode of the autonomous systems in each cluster and obtaining the final autonomous system-organization mapping relationship include: For the clustering result U, recall and associate the AS knowledge base; Calculating the mode feature of the recalled AS knowledge base data, and using the mode feature as the unique feature of the cluster; The unique feature of each of the clusters is used as a feature field of the organization and persisted as an autonomous system-organization mapping data table. The mapping relationship between the autonomous system and the organization is expressed through the autonomous system-organization mapping data table.

7. An autonomous system organization mapping device based on a semi-supervised clustering algorithm, wherein: include: The raw data information extraction module is used to extract the raw data information of the autonomous system from preset dimensions, wherein the preset dimensions include the RIR public knowledge base, the database of WHOIS and RDAP services, the observation data of BGP routing messages, and CAIDA public data; A raw data information preprocessing module, used to preprocess the raw data information, and integrate the preprocessed raw data information to generate an autonomous system basic feature matrix and an autonomous system key feature constraint matrix; A matrix cluster analysis module, used to perform multiple rounds of iterative clustering on the basic feature matrix of the autonomous system and the key feature constraint matrix of the autonomous system according to the SC-MPI algorithm, determine the number of clusters by a binary approximation method, and obtain multiple clusters; The mapping relationship generation module is used to determine the organization name and code of the cluster according to the characteristic mode of the autonomous system in each cluster, and obtain the final autonomous system-organization mapping relationship.

8. The autonomous system organization mapping device based on semi-supervised clustering algorithm according to claim 7, wherein: In the raw data information extraction module: The original data information extracted from the RIR public knowledge base includes AS number, AS country affiliation, AS registration time, field opg_id describing the AS resource assignee, and number resource status, and constructs a first data table with AS number as the primary key and AS country affiliation, AS registration time, field opg_id describing the AS resource assignee, and number resource status as column fields; The original data information extracted from the database of the WHOIS and RDAP services includes AS number, AS name, AS description information, AS administrator information, AS technical contact information, number resource maintainer information, AS routing export rule information, and AS routing import rule information; and construct a second data table with the AS number as the primary key and the AS name, AS description information, AS administrator information, AS technical contact information, and number resource maintainer information as column fields; The original data information extracted from the observation data of the BGP routing message includes AS number, AS IPv4 prefix set, AS IPv6 prefix set, AS IPv4 Peer set, and AS IPv6 Peer set; and a third data table is constructed with AS number as the primary key and AS IPv4 prefix set, AS IPv6 prefix set, AS IPv4 Peer set, and AS IPv6 Peer set information as column fields; The raw data information extracted from the CAIDA public data includes AS number, AS ranking, and AS longitude and latitude location information, and a fourth data table is constructed with AS number as the primary key and AS ranking and AS longitude and latitude location information as column fields; According to the first data table, the second data table, the third data table, and the fourth data table, an AS knowledge base is constructed with the AS number as the primary key and the AS ranking information as the column field; The raw data information preprocessing module includes: A data cleaning submodule, used for cleaning the data of the AS knowledge base; Data feature extraction submodule, used to extract data features using natural language processing and string matching technology; A feature weighting submodule is used to weight the preset features of the AS according to the configuration; The original feature matrix generation submodule is used to vectorize the weighted AS basic features and AS key feature data respectively using TF-IDF to generate the original feature matrix; The data dimension reduction submodule is used to reduce the data dimension of the original feature matrix using the SVD algorithm; The matrix generation submodule is used to generate the basic characteristic matrix of the autonomous system and the key characteristic constraint matrix of the autonomous system.

9. The autonomous system organization mapping device based on semi-supervised clustering algorithm according to claim 8, wherein: The matrix cluster analysis module includes: A matrix normalization processing submodule is used to normalize the basic feature matrix of the autonomous system, the key feature constraint matrix of the autonomous system and the custom constraint matrix, and unify the matrix dimensions of the basic feature matrix of the autonomous system, the key feature constraint matrix of the autonomous system and the custom constraint matrix; The target matrix generation submodule is used to use the autonomous system basic feature matrix, the autonomous system key feature constraint matrix and the custom constraint matrix as inputs of the SC-MPI algorithm to generate a target matrix Φ ′ ; The clustering result generation submodule is used to generate the target matrix Φ ′ The first k eigenvectors of are subjected to Ward-Linkage hierarchical clustering to obtain the final clustering result; The iterative processing submodule is used to perform multiple rounds of iterations and select the AS clustering data U with the best clustering effect for data recall and labeling.

10. The autonomous system organization mapping device based on semi-supervised clustering algorithm according to claim 9, wherein: The mapping relationship generation module includes: A knowledge base association submodule, used for recalling and associating the AS knowledge base with respect to the clustering result U; A mode feature calculation submodule, used to calculate the mode feature of the recalled AS knowledge base data, and use the mode feature as the unique feature of the cluster; The mapping data table generation submodule is used to use the unique feature of each cluster as the feature field of the organization and persist it into an autonomous system-organization mapping data table, through which the mapping relationship between the autonomous system and the organization is expressed.

Images