Address attribution analysis method
Through Flow traffic association BGP routing and aggregation analysis, the accuracy problem of the existing IP address home analysis methods is solved, and more accurate address home analysis is achieved.
Patent Information
- Application Number
- CN202411475496.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-22
- Publication Date
- 2025-03-07
AI Technical Summary
The existing IP address homeopathy analysis methods have accuracy problems, dynamically changing addresses are difficult to accurately belong, and the address homes of different cities and customers are difficult to determine.
By associating the BGP route through Flow traffic, aggregating the device address, incoming/incoming interface index and source/destination AS-PATH, determining the connection direction of the outgoing/incoming interface, collecting Flow traffic, aggregating the address space, and determining the home of the Flow address.
It improves the accuracy of address attribution analysis and can more accurately determine the location and IDC computer room of the Flow address.
Smart Images
Figure CN119583511A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of address attribution analysis, and in particular to an address attribution analysis method. Background Art
[0002] The existing IP address ownership is static, but in actual application, it is found that the address changes dynamically, and new addresses are often put into use. The existing analysis scheme is generally based on AS, but there are scenarios where different cities use the same AS. In addition, it is impossible to determine the ownership location of the customer address. Another common scheme is to determine the address ownership based on routing, but the routing range is large, which may amplify the address range and lead to inaccurate address ownership. Another scheme is to determine the uplink and downlink ports through the interface descriptor to determine the ownership of the address, but the interface descriptor configuration rules of each province are different, resulting in inaccurate judgments based on the interface descriptor, which leads to inaccurate address analysis. Summary of the invention
[0003] In order to solve the above problems existing in the prior art, the present invention provides an address attribution analysis method, which improves the accuracy of address attribution analysis.
[0004] To achieve the above purpose, the present invention adopts the following technical solutions:
[0005] In one embodiment of the present invention, a method for analyzing address attribution is proposed, the method comprising:
[0006] Associate BGP routes with Flow traffic and aggregate it according to device address, inbound / outbound interface index, and source / destination AS-PATH;
[0007] Aggregate the source / destination AS-PATH under the inbound / outbound interface index, and determine the connection direction of the inbound / outbound interface based on the source / destination AS-PATH.
[0008] Collect the flow traffic of the inbound / outbound interfaces according to the connection direction of the inbound / outbound interfaces, aggregate the data according to the device address, source / destination AS-PATH, flow address, and flow address prefix, and determine the address space of the inbound / outbound interfaces and devices;
[0009] The ownership of the flow address is determined based on the device address, source / destination AS-PATH, and the connection direction of the inbound / outbound interface.
[0010] Furthermore, the connection direction of the input / output interface is determined based on the relationship between the source / destination AS-PATH under the input / output interface index and the local AS; the connection direction includes an upstream link and a downstream link; if the source / destination AS-PATH under the input interface contains the local AS, and the source / destination AS-PATH under the output interface contains multiple ASs, then the input interface is a downstream port and the output interface is an upstream port.
[0011] Furthermore, the Flow address prefix is compared. If the Flow address prefix contains the Flow address prefix of other devices, the longest Flow address prefix is the address space of the device, and the address space of other devices is determined by the Flow source address aggregation.
[0012] Furthermore, the address space of the downlink port of the device is aggregated according to the device address, thereby determining the city to which the Flow address belongs.
[0013] Furthermore, the IDC room to which the Flow address belongs is determined based on the downlink port of the device.
[0014] In one embodiment of the present invention, a computer device is also proposed, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the aforementioned address attribution analysis method is designed.
[0015] In one embodiment of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium stores a computer program for executing the address attribution analysis method.
[0016] Beneficial effects:
[0017] The present invention determines the connection direction of the input / output interface through the Flow flow, thereby determining the ownership of the Flow address, thereby improving the accuracy of the address ownership analysis. BRIEF DESCRIPTION OF THE DRAWINGS
[0018] Figure 1 It is a flow chart of the address attribution analysis method of the present invention;
[0019] Figure 2 It is a schematic diagram of the computer device structure of the present invention. DETAILED DESCRIPTION
[0020] The principles and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and design the present invention, and are not intended to limit the scope of the present invention in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.
[0021] Those skilled in the art will appreciate that the embodiments of the present invention may be designed as a device, apparatus, equipment, method or computer program product. Therefore, the present disclosure may be specifically designed in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.
[0022] According to an implementation manner of the present invention, a method for analyzing address attribution is proposed, in which Flow traffic is associated with BGP routing, and is aggregated according to the device address, inbound / outbound interface index, and source / destination AS-PATH; the source / destination AS-PATH under the inbound / outbound interface index is aggregated, and the connection direction of the inbound / outbound interface is determined according to the source / destination AS-PATH; the Flow traffic of the inbound / outbound interface is collected according to the connection direction of the inbound / outbound interface, and data is aggregated according to the device address, source / destination AS-PATH, Flow address, and Flow address prefix to determine the address space of the inbound / outbound interface and the device; the attribution of the Flow address is determined according to the device address, source / destination AS-PATH, and the connection direction of the inbound / outbound interface.
[0023] The principle and spirit of the present invention are explained in detail below with reference to several representative embodiments of the present invention.
[0024] Figure 1 Schematic diagram of the address attribution analysis method of the present invention. Figure 1 As shown, the method includes:
[0025] S1. Associate BGP routes with Flow traffic and aggregate it according to device address, inbound / outbound interface index, and source / destination AS-PATH.
[0026] Associate BGP routes with Flow traffic, match BGP routes with the source and destination addresses of Flow, and add source and destination AS-PATH to Flow traffic.
[0027] Flow traffic is aggregated according to device address, inbound / outbound interface index, and source / destination AS-PATH.
[0028] The device address is the address of the Flow device, through which you can determine the city, network type, and public AS to which the device belongs.
[0029] S2, aggregate the source / destination AS-PATH under the inbound / outbound interface index, and determine the connection direction of the inbound / outbound interface based on the source / destination AS-PATH;
[0030] Aggregate device address, inbound / outbound interface index, and source / destination AS-PATH under the inbound / outbound interface index; determine the connection direction of the inbound / outbound interface based on the relationship between the source / destination AS-PATH under the inbound / outbound interface index and the local AS; the connection direction includes uplink and downlink; if the source / destination AS-PATH under the inbound interface includes the local AS, and the source / destination AS-PATH under the outbound interface includes multiple ASs, the inbound interface is a downlink port, and the outbound interface is an uplink port.
[0031] Specifically, the local AS is the AS associated with the Flow device.
[0032] Specifically, the address and name of the input / output interface are determined according to the input / output interface index, and the connection direction of the input / output interface is recorded through the input / output interface address and the input / output interface name.
[0033] S3. Collect the flow traffic of the inbound / outbound interfaces according to the connection direction of the inbound / outbound interfaces, aggregate the data according to the device address, source / destination AS-PATH, flow address, and flow address prefix, and determine the address space of the inbound / outbound interfaces and the devices.
[0034] Specifically, the flow volume under the inbound / outbound interface is collected according to the connection direction of the inbound / outbound interface to determine the address space of the device and the downstream interface.
[0035] Specifically, if the Flow traffic of the uplink port is collected, the inbound traffic is collected, and the address space formed by the destination address of the Flow is the address space of the downlink port; the addresses of all the downlink ports are aggregated to form the address space of the device.
[0036] Specifically, if the Flow traffic of the downlink port is collected, the inbound traffic is collected, and the address space formed by the source address of the Flow is the address space of the downlink port; the addresses of all downlink ports are aggregated to form the address space of the device.
[0037] Specifically, the address spaces of all Flow devices under the city are aggregated to form the address space of the city.
[0038] Specifically, the Flow address prefix is first compared. If the Flow address prefix contains the Flow address prefix of other devices, the longest Flow address prefix is the address space of the device, and the address space of other devices is determined by Flow address aggregation.
[0039] S4. Determine the ownership of the Flow address based on the device address, source / destination AS-PATH, and the connection direction of the inbound / outbound interface.
[0040] The address space of the downlink port of the device is aggregated according to the device address, and the city to which the Flow address belongs is determined according to the Flow device address.
[0041] Determine the AS to which the Flow address belongs and the customer to which the Flow address belongs based on the source / destination AS-PATH.
[0042] Determine the IDC room to which the Flow address belongs based on the device's downstream port.
[0043] It should be noted that, although the operations of the method of the present invention are described in a specific order in the above embodiments and the accompanying drawings, this does not require or imply that the operations must be performed in the specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.
[0044] In order to explain the above-mentioned address attribution analysis method more clearly, a specific embodiment is described below. However, it should be noted that this embodiment is only for better illustrating the present invention and does not constitute an improper limitation to the present invention.
[0045] Example:
[0046] In this embodiment, a border router of a metropolitan area network or an IDC is taken as an example for description.
[0047] The implementation steps are as follows:
[0048] S1. Associate BGP routes with Flow traffic and aggregate it according to device address, inbound / outbound interface index, and source / destination AS-PATH.
[0049] Associate BGP routes with Flow traffic, match BGP routes with the source and destination addresses of Flow, and add source and destination AS-PATH to Flow traffic.
[0050] Flow traffic is aggregated according to device address, inbound / outbound interface index, and source / destination AS-PATH.
[0051] The device address is the address of the Flow device, through which you can determine the city, network type, and public AS to which the device belongs.
[0052] S2, aggregate the source / destination AS-PATH under the inbound / outbound interface index, and determine the connection direction of the inbound / outbound interface based on the source / destination AS-PATH;
[0053] Aggregate device address, inbound / outbound interface index, and source / destination AS-PATH under the inbound / outbound interface index; determine the connection direction of the inbound / outbound interface based on the relationship between the source / destination AS-PATH under the inbound / outbound interface index and the local AS; the connection direction includes uplink and downlink; if the source / destination AS-PATH under the inbound interface includes the local AS, and the source / destination AS-PATH under the outbound interface includes multiple ASs, the inbound interface is a downlink port, and the outbound interface is an uplink port.
[0054] For example, in a Flow device in Hangzhou, the AS-PATH under its PORT1 interface includes 58461, 58461, and 37963. With this interface as the input interface, the AS-PATH under its output interface PORT2 / PORT3 is 23724, 4811, and 4816, etc. It can be determined that PORT1 is the downlink port connected to the intranet; PORT2 / PORT3 is the uplink port connected to the extranet.
[0055] Specifically, the local AS is the public AS associated with the Flow device.
[0056] Specifically, the address and name of the input / output interface are determined according to the input / output interface index, and the connection direction of the input / output interface is recorded through the input / output interface address and the input / output interface name.
[0057] S3. Collect the flow traffic of the inbound / outbound interfaces according to the connection direction of the inbound / outbound interfaces, aggregate the data according to the device address, source / destination AS-PATH, flow address, and flow address prefix, and determine the address space of the inbound / outbound interfaces and the devices.
[0058] Specifically, the flow volume under the inbound / outbound interface is collected according to the connection direction of the inbound / outbound interface to determine the address space of the device and the downstream interface.
[0059] Specifically, if the Flow traffic of the uplink port is collected, the inbound traffic is collected, and the address space formed by the destination address of the Flow is the address space of the downlink port; the addresses of all the downlink ports are aggregated to form the address space of the device.
[0060] Specifically, if the Flow traffic of the downlink port is collected, the inbound traffic is collected, and the address space formed by the source address of the Flow is the address space of the downlink port; the addresses of all downlink ports are aggregated to form the address space of the device.
[0061] In specific implementation, there is no restriction on the inbound / outbound interface and traffic direction. The source address is taken for outbound traffic, and the destination address is taken for inbound traffic.
[0062] Specifically, the address spaces of all Flow devices under the city are aggregated to form the address space of the city.
[0063] Specifically, the Flow address prefix is first compared. If the Flow address prefix contains the Flow address prefix of other devices, the longest Flow address prefix is the address space of the device, and the address space of other devices is determined by Flow address aggregation.
[0064] For example, the address prefix of the Flow device in City A is 139.10.10.0 / 24, but the address prefix of the Flow device in City B is 139.10.0.0 / 16. Then the space formed by the address prefix of the device in City A is 139.10.10.0 / 24. The address prefix of City B cannot be used as the address space. The address space range needs to be determined based on the maximum and minimum values of the Flow address.
[0065] S4. Determine the ownership of the Flow address based on the device address, source / destination AS-PATH, and the connection direction of the inbound / outbound interface.
[0066] The address space of the downlink port of the device is aggregated according to the device address, and the city to which the Flow address belongs is determined according to the city to which the Flow device belongs.
[0067] Determine the AS to which the Flow address belongs and the customer to which the Flow address belongs based on the source / destination AS-PATH. The source / destination AS-PATH includes the customer AS and the public AS. If the source / destination AS-PATH contains the customer AS, it means that the Flow address belongs to the city and also to a major IDC customer.
[0068] Determine the IDC room to which the Flow address belongs based on the device's downstream port. Specifically, the edge Flow device is generally connected to multiple IDC rooms, so its IDC room is determined based on the interface connection direction.
[0069] Based on the above invention concept, Figure 2 As shown, the present invention also proposes a computer device 100, including a memory 110, a processor 120, and a computer program 130 stored in the memory 110 and executable on the processor 120. When the processor 120 executes the computer program 130, the aforementioned address attribution analysis method is designed.
[0070] Based on the aforementioned inventive concept, the present invention further proposes a computer-readable storage medium, which stores a computer program for executing the aforementioned address attribution analysis method.
[0071] The address attribution analysis method proposed in the present invention determines the connection direction of the input / output interface through the Flow flow, thereby determining the attribution of the Flow address, thereby improving the accuracy of the address attribution analysis.
[0072] Although the spirit and principle of the present invention have been described with reference to several specific embodiments, it should be understood that the present invention is not limited to the disclosed specific embodiments, and the division of various aspects does not mean that the features in these aspects cannot be combined to benefit, and such division is only for the convenience of expression. The present invention is intended to cover various modifications and equivalent arrangements contained in the spirit and scope of the attached claims.
[0073] Regarding the limitation of the protection scope of the present invention, those skilled in the art should understand that, based on the technical solution of the present invention, various modifications or variations that can be made by those skilled in the art without creative work are still within the protection scope of the present invention.
Claims
1. A method for analyzing address attribution, characterized in that: The method includes: Associate BGP routes with Flow traffic and aggregate it according to device address, inbound / outbound interface index, and source / destination AS-PATH; Aggregate the source / destination AS-PATH under the inbound / outbound interface index, and determine the connection direction of the inbound / outbound interface based on the source / destination AS-PATH. Collect the flow traffic of the inbound / outbound interfaces according to the connection direction of the inbound / outbound interfaces, aggregate the data according to the device address, source / destination AS-PATH, flow address, and flow address prefix, and determine the address space of the inbound / outbound interfaces and devices; The ownership of the flow address is determined based on the device address, source / destination AS-PATH, and the connection direction of the inbound / outbound interface.
2. The address attribution analysis method according to claim 1, characterized in that: The connection direction of the inbound / outbound interface is determined based on the relationship between the source / destination AS-PATH under the inbound / outbound interface index and the local AS; the connection direction includes an uplink and a downlink; if the source / destination AS-PATH under the inbound interface includes the local AS, and the source / destination AS-PATH under the outbound interface includes multiple ASs, then the inbound interface is a downlink port, and the outbound interface is an uplink port.
3. The address attribution analysis method according to claim 1, characterized in that: The flow address prefix is compared. If the flow address prefix contains the flow address prefix of other devices, the longest flow address prefix is the address space of the device. The address space of other devices is determined by the flow source address aggregation.
4. The address attribution analysis method according to claim 1, characterized in that: The address space of the downlink port of the device is aggregated according to the device address to determine the city to which the Flow address belongs.
5. The address attribution analysis method according to claim 4, characterized in that: Determine the IDC room to which the Flow address belongs based on the device's downstream port.
6. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 5 is implemented.
7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 5.