Routing interruption detection method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a routing interruption detection method and device, electronic equipment and a storage medium. The method comprises the following steps: collecting routing table original data and routing registration data in a target autonomous domain range; establishing a prefix tree based on a prefix of each routing entry in the routing table original data, and establishing a mapping dictionary based on a mapping relationship between each target autonomous domain and the prefix in the routing registration data; on the basis of the mapping dictionary and the on-off state of the corresponding prefix stored by each prefix node in the prefix tree, aggregating the on-off state of each target autonomous domain, and establishing a prefix matrix; for each timestamp, if the prefix statistical information under the timestamp meets a preset interruption condition, determining that a routing interruption event occurs; according to the method and the device, the data structure of the prefix tree is used for basic data storage of routing interruption detection, and the searching efficiency of the IP prefix is greatly optimized by utilizing the binary characteristics of the IP address, so that a data basis is provided for improving the detection efficiency of the routing interruption.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a routing interruption detection method, device, electronic device and storage medium. Background Art

[0002] Border Gateway Protocol (BGP) is a decentralized dynamic routing protocol between Internet autonomous systems. It allows different autonomous systems (AS) on the Internet to automatically exchange Internet Protocol (IP) routing information and reachability information.

[0003] Although BGP plays a key role in the Internet, its security is very fragile. BGP's security vulnerability makes it very easy to be attacked. When facing direct or indirect influences such as various malicious attacks and configuration errors, it is easy to cause large-scale routing fluctuations, resulting in routing interruptions.

[0004] In the face of the above problems, the related technologies often detect and analyze IP prefixes to determine whether a routing interruption occurs. However, the related technologies apply traditional data structures to IP addresses and IP prefixes, resulting in low processing efficiency during retrieval. For example, when using traditional data structures such as hash tables to store IP addresses, operations such as prefix merging, splitting, and searching are involved, which have high time complexity. For millions of routing entries, related operations often take hours or days, resulting in low efficiency when using the entire network routing data for abnormal analysis.

[0005] In summary, how to improve the detection efficiency of routing interruption is an urgent problem to be solved. Summary of the invention

[0006] The embodiments of the present application provide a routing interruption detection method, device, electronic device and storage medium to improve the accuracy and comprehensiveness of IP attribution calculation.

[0007] In a first aspect, an embodiment of the present application provides a method for detecting a routing interruption, comprising:

[0008] Collect the original data of the routing table and the routing registration data within the target autonomous domain;

[0009] A prefix tree is established based on the prefixes of each routing entry in the original data of the routing table, and a mapping dictionary is established based on the mapping relationship between each target autonomous domain and the prefix in the routing registration data; the prefix node in the prefix tree is obtained by recursively calculating the network bit of the Internet Protocol IP address corresponding to the prefix;

[0010] Based on the mapping dictionary and the on-off status corresponding to the prefix stored in each prefix node in the prefix tree, the on-off status of each target autonomous domain is aggregated to establish a prefix matrix; the on-off status includes the prefix declaration status or prefix revocation status of the prefix at each timestamp; the prefix at each timestamp in the prefix matrix is ​​the prefix whose on-off status changes;

[0011] For each of the timestamps, if the prefix statistics under the timestamp meets the preset interruption condition, it is determined that a routing interruption event occurs; the prefix statistics include at least one of the number of prefixes and the number of IPs corresponding to the prefixes.

[0012] In a second aspect, an embodiment of the present application provides a routing interruption detection device, including:

[0013] A collection unit, used to collect original data of routing tables and routing registration data within the target autonomous domain;

[0014] An establishing unit is used to establish a prefix tree based on the prefixes of each routing entry in the original data of the routing table, and to establish a mapping dictionary based on the mapping relationship between each target autonomous domain and the prefix in the routing registration data; the prefix node in the prefix tree is obtained by recursively calculating the network bit of the Internet Protocol IP address corresponding to the prefix;

[0015] an aggregation unit, configured to aggregate the on-off status of each of the target autonomous domains based on the mapping dictionary and the on-off status of the prefix stored in each prefix node in the prefix tree, and establish a prefix matrix; the on-off status includes the prefix declaration status or prefix revocation status of the prefix at each timestamp; the prefix at each timestamp in the prefix matrix is ​​a prefix whose on-off status changes;

[0016] A determination unit is used to determine, for each of the timestamps, that a routing interruption event has occurred if the prefix statistics under the timestamp meets a preset interruption condition; the prefix statistics include at least one of the number of prefixes and the number of IPs corresponding to the prefixes.

[0017] In some embodiments, the establishing unit is specifically configured to:

[0018] For each of the target autonomous domains, traverse each of the prefixes mapped by the target autonomous domain in the mapping dictionary, and read the on / off status stored in the prefix node corresponding to each prefix from the prefix tree;

[0019] For each timestamp, if the on / off state of at least one target prefix at the timestamp is different from the on / off state of the target prefix at the previous timestamp, the prefix matrix is ​​established based on the timestamp and the on / off states of each prefix at the timestamp.

[0020] In some embodiments, if the prefix statistical information includes the number of prefixes, the preset interruption condition in the determination unit includes:

[0021] The number of prefixes at the first timestamp is less than a first preset interruption occurrence threshold, the number of prefixes at the second timestamp is greater than or equal to a first preset interruption recovery threshold, and the time difference between the first timestamp and the second timestamp is greater than a preset interruption duration;

[0022] The number of prefixes is the number of prefixes in the prefix matrix that are in a prefix announcement state.

[0023] In some embodiments, if the prefix statistical information includes the number of IPs, the preset interruption condition in the determination unit includes:

[0024] The number of IPs at the third timestamp is less than the second preset interruption occurrence threshold, the number of IPs at the fourth timestamp is greater than or equal to the second preset interruption recovery threshold, and the time difference between the third timestamp and the fourth timestamp is greater than the preset interruption duration;

[0025] The number of IPs is the number of IPs corresponding to prefixes in the prefix matrix that are in a prefix announcement state.

[0026] In some embodiments, after determining that a routing interruption event occurs if the prefix statistics information at each timestamp satisfies a preset interruption condition, the apparatus further includes:

[0027] An update unit, used to update the timestamp;

[0028] If the routing interruption event does not occur at the updated timestamp, then recording the updated prefix statistics information at the updated timestamp;

[0029] If the updated prefix statistical information does not change within the preset change time, the preset interruption condition is updated according to the updated prefix statistical information.

[0030] In some embodiments, the establishing unit is specifically configured to:

[0031] Read the original data of the routing table, and perform the following operations on each prefix:

[0032] Converting the network bits corresponding to the prefix into binary form;

[0033] According to the order of each bit in the network bit, traverse and search each bit in the prefix tree;

[0034] For each bit, if the node corresponding to the bit does not exist in the prefix tree, then add the corresponding node in the prefix tree;

[0035] Until the recursive depth is equal to the mask length of the prefix, stop the recursive operation and use the current node as the prefix node;

[0036] The on-off state of the prefix is ​​stored in the prefix node.

[0037] In a third aspect, an embodiment of the present application provides an electronic device, including:

[0038] A memory for storing program instructions;

[0039] The processor is used to call the program instructions stored in the memory and execute the above-mentioned route interruption detection method according to the obtained program instructions.

[0040] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned routing interruption detection method is implemented.

[0041] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which is stored in a computer-readable storage medium; when a processor of an electronic device reads the computer program from the computer-readable storage medium, the processor executes the computer program, so that the electronic device performs the above-mentioned routing interruption detection method.

[0042] The embodiment of the present application provides a method, device, electronic device and storage medium for detecting route interruption. First, the original data of the routing table and the route registration data within the scope of the target autonomous domain are collected; so that the subsequent route interruption detection steps can be performed through these control plane data. Secondly, based on the prefixes of each routing entry in the original data of the routing table, a prefix tree is established, and based on the mapping relationship between each target autonomous domain and the prefix in the route registration data, a mapping dictionary is established; the embodiment of the present application uses the data structure of the prefix tree for basic data storage of route interruption detection, and uses the binary characteristics of the IP address to greatly optimize the search efficiency of the IP prefix, providing a data basis for high real-time anomaly detection capabilities. Furthermore, based on the mapping dictionary and the on-off status of the corresponding prefix stored in each prefix node in the prefix tree, the on-off status of each target autonomous domain is aggregated to establish a prefix matrix; the embodiment of the present application uses the characteristics of the prefix tree to provide efficient prefix node comparison, realizes data aggregation to obtain the BGP interruption situation of the autonomous domain dimension, and helps to discover operation and maintenance faults. Finally, for each timestamp, if the prefix statistics under the timestamp meet the preset interruption condition, it is determined that a route interruption event has occurred; the prefix statistics include at least one of the number of prefixes and the number of IPs corresponding to the prefix. The embodiment of the present application detects routing interruption events from two aspects: the number of prefixes / the number of reachable IP addresses, by presetting interruption conditions, thereby achieving long-term and stable anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 A schematic diagram of an application scenario of a routing interruption detection method provided in an embodiment of the present application;

[0044] Figure 2 A flowchart of a method for detecting a routing interruption provided in an embodiment of the present application;

[0045] Figure 3 A schematic diagram of a prefix tree provided in an embodiment of the present application;

[0046] Figure 4 A schematic diagram of a prefix matrix provided in an embodiment of the present application;

[0047] Figure 5 A schematic diagram of updating a preset interruption condition provided in an embodiment of the present application;

[0048] Figure 6 A module flow chart provided for an embodiment of the present application;

[0049] Figure 7 A flowchart of another routing interruption detection method provided in an embodiment of the present application;

[0050] Figure 8 A schematic diagram of the structure of an electronic device for detecting route interruption in an embodiment of the present application;

[0051] Fig. 9 A schematic diagram of a hardware structure of an electronic device to which an embodiment of the present application is applied;

[0052] Fig.10 A schematic diagram of the hardware composition structure of a computing device using an embodiment of the present application. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solutions and advantages of this application clearer, this application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0054] The following is an introduction to some concepts involved in the embodiments of the present application.

[0055] Autonomous System (AS): In the Internet, AS refers to the combination of all IP networks and routers under the jurisdiction of one or more entities, which implement a common routing policy for the Internet.

[0056] Border Gateway Protocol (BGP): It is a decentralized dynamic routing protocol between Internet autonomous systems. It allows different ASes on the Internet to automatically exchange IP routing information and reachability information.

[0057] Before introducing the route interruption detection method provided by the embodiment of the present application, in order to facilitate understanding, the technical background of the embodiment of the present application is first introduced in detail.

[0058] BGP is a decentralized dynamic routing protocol between Internet autonomous systems. It allows different ASes on the Internet to automatically exchange IP routing information and reachability information. Although BGP plays a key role in the Internet, its security is very fragile. ASes interconnected by BGP lack an effective authentication mechanism for the received prefix routes, which leads to unconditional reception or dissemination of neighboring AS routes, creating security risks.

[0059] BGP's security vulnerability makes it an easy target for attack. When faced with direct or indirect impacts such as various malicious attacks and configuration errors, large-scale routing fluctuations are prone to occur.

[0060] When faced with the above problems, the related technologies often detect and analyze IP prefixes, or determine whether routing interruption occurs based on feature extraction. However, the related technologies have low processing efficiency when applying traditional data structures to IP addresses and IP prefixes: When using traditional data structures such as hash tables to store IP addresses, operations such as prefix merging, splitting, and searching are involved, which have high time complexity. For millions of routing entries, related operations often take hours or days, resulting in low efficiency when using the routing data of the entire network for anomaly analysis. In addition, the real-time performance of routing anomaly detection based on feature extraction is poor: the common method of extracting features based on routing data and then performing anomaly detection through machine learning or statistical models has poor interpretability, and the model complexity is high, and it is impossible to achieve real-time detection of streaming routing data at the second level.

[0061] In addition, the current research on routing anomalies lacks detection of BGP interruption events: the current detection of routing anomalies focuses on detecting routing hijacking and path leakage, but lacks detection of routing interruptions. The detection of routing interruptions is based on the announcement and withdrawal of routing prefixes. The existence of routing entries is directly related to network accessibility and stability. The number of routing interruptions caused by various direct or indirect reasons every day is far greater than routing hijacking and leakage, which deserves special attention.

[0062] In view of this, the embodiment of the present application provides a method, device, electronic device and storage medium for detecting route interruption. First, the original data of the routing table and the route registration data within the scope of the target autonomous domain are collected; so that the subsequent route interruption detection steps can be performed through these control plane data. Secondly, based on the prefixes of each routing entry in the original data of the routing table, a prefix tree is established, and based on the mapping relationship between each target autonomous domain and the prefix in the route registration data, a mapping dictionary is established; the embodiment of the present application uses the data structure of the prefix tree for basic data storage of route interruption detection, and uses the binary characteristics of the IP address to greatly optimize the search efficiency of the IP prefix, providing a data basis for high real-time anomaly detection capabilities. Furthermore, based on the mapping dictionary and the on-off status of the corresponding prefix stored in each prefix node in the prefix tree, the on-off status of each target autonomous domain is aggregated to establish a prefix matrix; the embodiment of the present application uses the characteristics of the prefix tree to provide efficient prefix node comparison, realizes data aggregation to obtain the BGP interruption situation of the autonomous domain dimension, and helps to discover operation and maintenance faults. Finally, for each timestamp, if the prefix statistics under the timestamp meet the preset interruption condition, it is determined that a route interruption event has occurred; the prefix statistics include at least one of the number of prefixes and the number of IPs corresponding to the prefix. The embodiment of the present application detects routing interruption events from two aspects: the number of prefixes / the number of reachable IP addresses, by presetting interruption conditions, thereby achieving long-term and stable anomaly detection.

[0063] It should be noted that the application scenarios described in the following embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. A person of ordinary skill in the art can know that with the emergence of new application scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0064] The following first briefly introduces the application scenarios to which the technical solutions of the embodiments of the present application can be applied. It should be noted that the application scenarios introduced below are only used to illustrate the embodiments of the present application and are not limited. In specific implementation, the technical solutions provided by the embodiments of the present application can be flexibly applied according to actual needs.

[0065] The embodiments of the present application can be applied to the following network security scenarios:

[0066] (1) Detect and respond to routing security threats such as BGP outages.

[0067] The embodiments of the present application can realize automatic high-real-time detection of routing interruption events based on BGP routing control plane data. By selecting different routing observation points, routing interruption detection models from different perspectives can be constructed. For example, based on the operator's existing network data, routing interruptions in the AS dimension can be detected from the Chinese perspective, which is helpful for further research on solutions when routing interruptions occur.

[0068] (2) Construct the basic structure of routing data storage in the prefix dimension.

[0069] The embodiment of the present application realizes the prefix dimension storage of basic routing table data by constructing a prefix tree and a prefix node class. The data structure of the prefix tree is used for IP and routing related scenarios, which can make full use of the binary characteristics of the IP address and greatly improve the computational efficiency of data analysis compared to traditional methods. At the same time, the nodes in the tree store various information of the prefix dimension, which can be used for BGP interruption detection, as well as other types of routing anomaly detection such as hijacking and leakage, or for other control plane routing data research work such as historical data analysis.

[0070] (3) Provide auxiliary analysis and judgment for other network security failure scenarios.

[0071] In addition to the operation and maintenance of the routing system itself, various network attacks or network anomalies will cause BGP to be abnormal at the control level, indirectly leading to a large number of related prefixes being announced or revoked, and the number of prefixes or the number of reachable IPs changing significantly. For example, the system is blocked or black-holed due to route hijacking or leakage, which in turn causes rerouting, or the route switching of related prefixes due to physical line interruption and distributed denial of service (DDoS) attacks. The route interruption detection method provided in the embodiment of the present application performs route interruption detection during the time period when the anomaly occurs, and the detection results can serve as a strong basis for related anomaly analysis and tracing.

[0072] like Figure 1 As shown, it is a schematic diagram of an application scenario of a routing interruption detection method provided by an embodiment of the present application. The application scenario diagram includes a terminal device 110, a server 120 and a target autonomous domain 130.

[0073] It should be noted that the routing interruption detection method in the embodiment of the present application can be executed by an electronic device, which may be a server 120 or a terminal device 110, that is, the method can be executed by the server 120 or the terminal device 110 alone, or can be executed jointly by the server 120 and the terminal device 110. For example, when the server 120 and the terminal device 110 execute together, the object sends a routing interruption detection request for the target autonomous domain 130 to the server 120 on the terminal device 110. After receiving the request, the server 120 collects the original data of the routing table and the routing registration data within the scope of the target autonomous domain 130; the server 120 establishes a prefix tree based on the prefix of each routing entry in the original data of the routing table, and establishes a mapping dictionary based on the mapping relationship between each target autonomous domain and the prefix in the routing registration data; the server 120 aggregates the on-off status of each target autonomous domain based on the mapping dictionary and the on-off status of the corresponding prefix stored in each prefix node in the prefix tree, and establishes a prefix matrix; for each timestamp, if the prefix statistical information under the timestamp meets the preset interruption condition, the server 120 determines that a routing interruption event has occurred, and feeds back the detection result to the terminal device 110.

[0074] In an optional implementation, the terminal device 110 and the server 120 may communicate with each other via a communication network.

[0075] In an optional implementation, the communication network is a wired network or a wireless network.

[0076] It should be noted that Figure 1 The figure is only an example. In fact, the number of terminal devices and servers is not limited and is not specifically limited in the embodiments of the present application.

[0077] The routing interruption detection method provided in the embodiment of the present application can be divided into multiple modules: a data collection module, a prefix tree module, a mapping dictionary module, an event aggregation module and a routing interruption analysis module.

[0078] Figure 2 A flow chart of a method for detecting a route interruption provided by an embodiment of the present application is shown, taking a server as an example. Figure 2 As shown, the method may include the following steps S21 to S24:

[0079] S21: Collect the original data of the routing table and the routing registration data within the target autonomous domain.

[0080] The target autonomous domain range is preset on demand for the object, and can generally be the entire network AS.

[0081] The raw data of the routing table refers to the data that records the routing information between ASs, including routing tables (Routing Information Bases, RIBs) and update messages (UPDATE Messages, UPDATEs). The collected raw data of the routing table is usually in the Multi-Threaded Routing Toolkit (MRT) format. The BGP data dump tool (bgpdump) tool needs to be used to parse the file to obtain a data file containing readable fields in a fixed format.

[0082] Routing registration data refers to the registration information registered by each AS with the address allocation agency to which it belongs, including country name, IP prefix owned, update time and other information.

[0083] S21 is a specific step implemented by the above data collection module. The data collection module uses the original routing table data in MRT format collected from the observation point router and parses it using the bgpdump tool; and collects routing registration data such as AS prefix lists from routing registration agencies such as the European IP Network (Réseaux IP Européens, RIPE).

[0084] In the above implementation mode, in order to realize the analysis of BGP abnormal events and perform real-time detection of BGP interruption events in the AS dimension, the embodiment of the present application collects the original data of the routing table and the routing registration data, so as to facilitate the subsequent establishment of the mapping relationship between the prefix tree and the prefix and the AS to which it belongs, and realize event aggregation in the AS dimension.

[0085] After the data collection step of the data collection module is implemented in the above manner, the embodiment of the present application implements the steps of establishing the prefix tree module and the mapping dictionary module in the following manner:

[0086] S22: Building a prefix tree based on the prefixes of each routing entry in the original data of the routing table, and building a mapping dictionary based on the mapping relationship between each target autonomous domain and the prefix in the routing registration data;

[0087] The prefix node in the prefix tree is obtained by the network bit of the Internet Protocol IP address corresponding to the recursive prefix.

[0088] Specifically, the prefix tree module extracts the prefix of the routing entry and the Autonomous System Path (ASpath) information from the original RIBs file based on the original data of the routing table, uses Python to define the node class (TrieNode) and the prefix tree type (Trie), and converts the IP prefix into a binary 01 sequence and inserts it into the prefix tree.

[0089] In the embodiment of the present application, when the prefix tree module establishes a prefix tree, an optional implementation method is as follows:

[0090] Read the original data of the routing table and perform the following operations on each prefix:

[0091] Convert the network bits corresponding to the prefix into binary form; traverse and search for each bit in the prefix tree in the order of the bits in the network; for each bit, if the node corresponding to the bit does not exist in the prefix tree, add the corresponding node to the prefix tree; until the recursive depth is equal to the mask length of the prefix, stop the recursive operation and use the current node as the prefix node; store the on and off status of the prefix in the prefix node.

[0092] Specifically, Python is used to create a node class (TrieNode) and a prefix tree class (Trie).

[0093] Taking Internet Protocol Version 4 (IPv4) as an example, the composition of the IP prefix in the form of Classless Inter-Domain Routing (cidr) is xxx.xxx.xxx.xxx / xx, where the IP address composed of 32 binary digits is before the " / ", and the subnet mask is after the " / ", which is used to mark the network bit. According to the binary digits corresponding to the IP address, a prefix tree can be established for it based on the binary tree data structure. Starting from the root node, each node in the binary tree uses 0 and 1 to mark its left and right child nodes respectively. Each time a new prefix is ​​inserted, the child node of the current node is recursively searched from the root node according to the network bits of the binary expansion of the IP prefix. If it does not exist, a new one is created until the recursive depth is equal to the mask length, and the current node is marked as a prefix node.

[0094] like Figure 3 As shown, it is a schematic diagram of a prefix tree provided in an embodiment of the present application. Figure 3 The four IP prefixes are presented in the figure: 192.0.0.0 / 2, 64.0.0.0 / 2, 32.0.0.0 / 3 and 224.0.0.0 / 3. Among them, the IP address 192.0.0.0 of 192.0.0.0 / 2 is converted into binary: 11000000 00000000 00000000000000000, so starting from the root node, recursively search along the right node marked as 1 until the recursive depth is the mask length 2, and the node at 301 is used as the prefix node. Similarly, the prefix node corresponding to 64.0.0.0 / 2 in the prefix tree is 302, the prefix node corresponding to 32.0.0.0 / 3 in the prefix tree is 303, and the prefix node corresponding to 224.0.0.0 / 3 in the prefix tree is 304.

[0095] For each prefix node in the prefix tree, a newly created instance of the node class is used to represent it. Each prefix node corresponds to a routing entry in the original RIBs data, and the node also stores the specific information of the routing entry.

[0096] The specific information stored in the node includes the storage of child nodes (children), whether the current node represents a prefix (is_end_of_prefix), the AS path information in the routing entry (ASpath), the observation point IP information in the routing entry (peer_ip), and the on / off status information (updates) including timestamp and update type, etc.

[0097] After the prefix tree is established in the above manner, in order to record the route update history data of the prefix dimension, the embodiment of the present application also provides a prefix tree update function:

[0098] Read the UPDATEs file within the observation range in chronological order, extract the IP prefix, update type (declare or withdraw), and AS_PATH of each routing data, and search for the prefix node corresponding to the prefix in the prefix tree. If the prefix tree does not contain the prefix, insert the prefix node, and record the update type and timestamp of the routing entry in the corresponding prefix node; if the prefix tree already contains the prefix node, add the timestamp and update type of the current routing entry update to the updates stored in the corresponding node.

[0099] In the above implementation, the embodiment of the present application realizes the prefix dimension storage of the original data of the routing table by constructing a prefix tree and a prefix node class. The data structure of the prefix tree is used for IP and routing related scenarios, which can make full use of the binary characteristics of the IP address. Compared with the traditional data structure, the use of the prefix tree can greatly improve the computational efficiency of data analysis. At the same time, the prefix nodes in the prefix tree store various information of the prefix dimension, which can be used for BGP interruption detection, as well as other types of routing anomaly detection such as hijacking and leakage, or for other control plane routing data research work such as historical data analysis.

[0100] The mapping dictionary module in the embodiment of the present application is based on the AS-prefix relationship file of RIPE and uses a dictionary structure to store the ownership relationship of prefixes.

[0101] Specifically, a mapping dictionary is created based on the AS basic information file of RIPE. The key of the mapping dictionary is the AS number, and the value is the prefix node in the prefix tree corresponding to the prefix owned by the AS. Because the key of the mapping dictionary and the prefix node of the prefix tree point to the same object, when the information stored in the prefix node in the prefix tree is modified, the corresponding information in the mapping dictionary will also be modified synchronously.

[0102] The following introduces the event aggregation module based on the above prefix tree and mapping dictionary.

[0103] S23: Based on the mapping dictionary and the on-off status of the corresponding prefix stored in each prefix node in the prefix tree, the on-off status of each target autonomous domain is aggregated to establish a prefix matrix.

[0104] Among them, the on-off state includes the prefix declaration state (A) or prefix revocation state (W) of the prefix at each timestamp; the prefix at each timestamp in the prefix matrix (also called the timestamp-prefix matrix) is the prefix whose on-off state changes. It can be understood that in each timestamp in the prefix matrix, there is at least one prefix whose on-off state is different from that at the previous timestamp.

[0105] Specifically, the event aggregation module aggregates the on / off status of prefixes in the same AS in chronological order according to the on / off status information stored in each prefix node in the prefix tree and the prefix-AS affiliation relationship stored in the mapping dictionary, and obtains the on / off event aggregation result in the AS dimension, which is presented in the form of a prefix matrix.

[0106] In the embodiment of the present application, when establishing a prefix matrix, an optional implementation method is as follows:

[0107] For each target autonomous domain, traverse each prefix mapped by the target autonomous domain in the mapping dictionary, and read the on-off status stored in the prefix node corresponding to each prefix from the prefix tree; for each timestamp, if the on-off status of at least one target prefix under the timestamp is different from the on-off status of the target prefix under the previous timestamp, then establish a prefix matrix based on the timestamp and the on-off status of each prefix under the timestamp.

[0108] Specifically, the prefix tree stores the on / off information of the prefix dimension, which now needs to be aggregated to the AS dimension. According to each AS in the selected target AS range, traverse each prefix node in the AS-prefix mapping dictionary, read the on / off status information (timestamp and A / W) of the prefix node, and establish a timestamp-prefix matrix, where the timestamp is used as the first key value, to ensure that only the timestamps with prefix changes exist in the timestamp-prefix matrix.

[0109] like Figure 4 As shown, it is a schematic diagram of a prefix matrix provided in an embodiment of the present application. Figure 4 The prefix matrix in lists three timestamps t1, t2, and t3, and each timestamp has three prefixes p1, p2, and p3. Among them, the on-off state of prefix p1 at timestamp t1 is A, that is, the prefix announcement state, the on-off state of prefix p2 is W, that is, the prefix revocation state, and the on-off state of prefix p3 is None, that is, the on-off state has not changed, which is the same as the on-off state of the previous timestamp t1. Similarly, the on-off state of prefix p1 at timestamp t2 is None, that is, the on-off state has not changed, which is the same as the on-off state of t1, that is, the prefix announcement state, the on-off state of prefix p2 is A, that is, the prefix announcement state, and the on-off state of prefix p3 is A, that is, the prefix announcement state. The on-off state of prefix p1 at timestamp t3 is W, that is, the prefix revocation state, the on-off state of prefix p2 is W, that is, the prefix revocation state, and the on-off state of prefix p3 is W, that is, the prefix revocation state.

[0110] In the above implementation, by establishing a prefix matrix, the on / off status is converted from the prefix dimension to the AS dimension, which is helpful for further studying the solution when the route is interrupted.

[0111] The following is an introduction to the routing interruption analysis module.

[0112] S24: For each timestamp, if the prefix statistics under the timestamp meets the preset interruption condition, it is determined that a routing interruption event occurs;

[0113] The prefix statistics include at least one of the number of prefixes and the number of IPs corresponding to the prefixes. The number of prefixes is the number of prefixes in the prefix matrix that are in the prefix declaration state at a certain timestamp. The number of IPs (also called the number of reachable IPs) is the number of IPs corresponding to the prefixes in the prefix matrix that are in the prefix declaration state.

[0114] Specifically, the routing interruption analysis module extracts interruption events that meet the conditions from the aggregated data according to the preset interruption conditions.

[0115] When counting route interruption events, if the number of IP addresses in a certain AS is used as the basis for judgment, the prefixes in the prefix tree need to be merged before counting. If a prefix and its sub-prefixes exist in the prefix tree at the same time and their paths are consistent, it is considered that the connection and disconnection of the sub-prefix will not affect the number of reachable IP addresses.

[0116] Therefore, before detecting a routing interruption event based on the data in the prefix matrix, the embodiment of the present application may pre-process the prefix matrix in the following manner:

[0117] (1) Number of prefixes.

[0118] If the routing interruption event is determined based on the relationship between the prefix number and the preset interruption threshold, then for each target timestamp, the prefix matrix is ​​traversed, and the number of prefix nodes whose prefix state corresponding to each target timestamp is prefix declaration is counted to establish a prefix number change table.

[0119] Specifically, if detection is performed based on the number of prefixes, the timestamp-prefix matrix is ​​traversed, and the number of prefixes in the routing table at the timestamp is counted according to the prefix announcement situation to obtain a prefix number change table (prefix number-time change table).

[0120] (2) Number of IP addresses.

[0121] If the routing interruption event is determined based on the relationship between the number of IPs and the preset interruption threshold, then for each target timestamp, the prefix matrix is ​​traversed, and the number of IPs of the prefix nodes whose prefix state corresponding to each target timestamp is prefix declaration is counted to establish an IP number change table.

[0122] Specifically, if the detection is performed based on the number of IPs, when the prefix whose on / off state changes is a sub-prefix of a prefix that already exists in the routing table, it can be considered that the number of reachable IPs of the prefix does not change due to the announcement and cancellation of its sub-prefix. Therefore, for each timestamp in the prefix matrix, the current prefixes are counted in the prefix tree, and recursion is used for pre-order traversal during the statistics. If it passes through a node marked as a prefix or a node that has been counted, it means that its parent prefix exists in the observation range, and the function returns. If the current prefix node has not been counted, the number of reachable IPs of the current node is increased. Finally, the IP number change table (reachable IP number-time change table) is obtained.

[0123] After counting the number of prefixes or IPs in the above manner, before extracting the routing interruption event through the routing interruption analysis module, first introduce and define the relevant indicators.

[0124] Interruption quantity basis: the number of prefixes or the number of IPs. Each threshold will be judged according to the number of prefixes or IPs belonging to a certain AS, and routing interruption events will be extracted.

[0125] Steady-state value benchmark: The steady-state value of the number of prefixes or IP addresses used as the basis for determining route interruption.

[0126] Interruption occurrence percentage: It is used to determine the percentage of the start of routing interruption events. When the number of prefixes or IPs currently in the prefix announcement state of a certain AS drops below the preset interruption occurrence threshold (steady-state value × interruption occurrence percentage), the routing interruption event is considered to have started.

[0127] Interruption recovery percentage: It is used to determine the percentage of the end of the routing interruption event. When the number of prefixes or IPs currently in the prefix announcement state of a certain AS rises to above the preset interruption recovery threshold (steady-state value × interruption recovery percentage), the current routing interruption event is considered to be over.

[0128] Interruption duration (also called interruption duration lower limit): An interruption event is considered abnormal only if the interruption duration (route interruption event end time - route interruption event start time) exceeds this value.

[0129] After defining the above-mentioned related indicators, the embodiment of the present application uses a sliding window to extract the routing interruption events from the prefix change or IP quantity change table in the time dimension. According to the set interruption occurrence threshold, the quantity change table is traversed. If the prefix quantity / reachable IP quantity at the current timestamp is lower than the interruption occurrence threshold, it is considered that an interruption has occurred, and the traversal continues until the current prefix quantity / reachable IP quantity is higher than the interruption recovery threshold, and the interruption is considered to be recovered. The time difference between the two is the interruption duration. If the value is higher than the set lower limit of the interruption duration, it is considered that this is an interruption event and is recorded.

[0130] In an embodiment of the present application, when monitoring a routing interruption event according to prefix statistical information, an optional implementation method is as follows:

[0131] (1) If the prefix statistics information includes the number of prefixes, the preset interruption conditions include:

[0132] The number of prefixes at the first timestamp is less than the first preset interruption occurrence threshold, the number of prefixes at the second timestamp is greater than or equal to the first preset interruption recovery threshold, and the time difference between the first timestamp and the second timestamp is greater than the preset interruption duration.

[0133] Specifically, first, a preset occurrence threshold is determined according to the product of a preset steady-state value of a prefix and an interruption occurrence percentage, and a preset recovery threshold is determined according to the product of a preset steady-state value of a prefix and an interruption recovery percentage. Then, a prefix matrix is ​​traversed, or a prefix quantity change table generated according to the prefix matrix is ​​traversed, and a first timestamp when the prefix quantity is less than the preset interruption occurrence threshold is determined, and the traversal is continued to determine a second timestamp when the prefix quantity is greater than or equal to the preset interruption recovery threshold. If the time difference between the first timestamp and the second timestamp is greater than the preset interruption duration, it is determined that a routing interruption event has occurred.

[0134] (2) If the prefix statistics include the number of IP addresses, the preset interruption conditions include:

[0135] The number of IPs at the third timestamp is less than the second preset interruption occurrence threshold, the number of IPs at the fourth timestamp is greater than or equal to the second preset interruption recovery threshold, and the time difference between the third timestamp and the fourth timestamp is greater than the preset interruption duration.

[0136] Specifically, first, a preset interruption occurrence threshold is determined according to the product of a preset steady-state value of the IP and the interruption occurrence percentage, and a preset interruption recovery threshold is determined according to the product of a preset steady-state value of the IP and the interruption recovery percentage. Then, the prefix matrix is ​​traversed, or the IP quantity change table generated according to the prefix matrix is ​​traversed to determine the third timestamp when the number of IPs is less than the above-mentioned preset interruption occurrence threshold, and the traversal is continued to determine the fourth timestamp when the number of IPs is greater than or equal to the above-mentioned preset interruption recovery threshold. If the time difference between the third timestamp and the fourth timestamp is greater than the preset interruption duration, it is determined that a routing interruption event has occurred.

[0137] Considering that when observing routing interruption events for a long time, the continuously unchanged interruption occurrence threshold and interruption recovery threshold are difficult to adapt to changes in routing conditions, therefore, the embodiment of the present application provides a preset interruption condition update function.

[0138] Specifically, since the interruption occurrence threshold and the interruption recovery threshold in the embodiment of the present application are both determined based on steady-state values, the embodiment of the present application updates the preset interruption condition by updating the steady-state values.

[0139] In the embodiment of the present application, when the preset interruption condition is updated, an optional implementation method is as follows:

[0140] The timestamp is updated; if no routing interruption event occurs at the updated timestamp, the updated prefix statistics at the updated timestamp are recorded; if the updated prefix statistics do not change within the preset change time, the preset interruption condition is updated according to the updated prefix statistics.

[0141] Specifically, when judging the route interruption event for the first time, the RIB file collected when the observing router starts observing is selected as the benchmark, and the number of prefixes / reachable IPs in the declaration state in each AS is counted as the steady-state value to calculate the two thresholds in the preset interruption condition. However, with the declaration and withdrawal of the route, the steady-state value used as the benchmark may change. Therefore, after each timestamp update, it is determined whether to update the steady-state value and the corresponding interruption occurrence threshold and interruption recovery threshold based on the change in the number of prefixes / reachable IPs in the prefix declaration state. The number of prefixes / reachable IPs currently in the prefix declaration state is recorded each time. If it continues to remain unchanged for more than the preset change time, the number of prefixes / reachable IPs currently in the prefix declaration state is used as the new steady-state value.

[0142] like Figure 5 As shown, it is a schematic diagram of updating a preset interruption condition provided by an embodiment of the present application. After the timestamp is updated, whether to trigger an interruption is detected according to the number of prefixes or IPs under this timestamp.

[0143] If the interruption is not triggered, determine whether to update the two thresholds in the preset interruption condition according to the above implementation mode, and determine whether the number of prefixes or the number of IPs is less than the preset interruption recovery threshold, record it and then update the timestamp;

[0144] If an interruption is triggered, determine whether the number of prefixes or IPs is greater than or equal to the preset interruption recovery threshold. If recovery is not triggered, update the timestamp; if recovery is triggered, record the routing interruption event, reset the interruption status and update the timestamp.

[0145] The routing interruption detection method provided in the embodiment of the present application is described below with reference to specific embodiments.

[0146] Step 1: Select the target autonomous domain range and collect data. For example, if you want to observe the route interruption events of AS in country M from July 1, 2024 to the present, obtain the RIBs file of the observation point at 0:00 on July 1, 2024 from public data such as routeviews or operator backbone network data, as well as all UPDATEs files from this moment to the present. At the same time, obtain the route registration data such as the AS number of the entire network from RIPE.

[0147] Step 2: Initialize the IP prefix tree. Create a prefix tree class Trie and a node class TrieNode, read the RIBs file, insert the prefix in each line of routing entries into the prefix tree, and store the valid information in the routing entry into the node class.

[0148] Step 3: Create a prefix-AS mapping. According to the RIPE AS basic information file, create a mapping dictionary with the keys being all AS numbers in the entire network and the values ​​being the nodes in the prefix tree corresponding to the prefix owned by the AS.

[0149] Step 4: Update the prefix tree. Read the UPDATEs file in chronological order, and add change information such as (timestamp, A / W (announcement / withdrawal)) to the corresponding prefix node in the prefix tree according to the announcement and withdrawal attributes of each routing entry.

[0150] Step 5: Prefix dimension on-off statistics. According to the observed object, find the prefix owned by country M in the prefix tree, read the declaration / cancellation change history of all country M prefixes, and create a timestamp-prefix matrix.

[0151] Step 6: Define interrupt detection indicators and thresholds.

[0152] Interruption number basis: In this example, select the number of IPs. Each threshold will be judged based on the number of reachable IPs belonging to a certain AS to extract the interruption events.

[0153] Steady-state value benchmark: The steady-state value of the number of IP addresses used as the basis for judgment. The initial value is the number of reachable IP addresses for each AS in the first RIB file read.

[0154] Interruption occurrence percentage: It is used to determine the percentage of the start of an interruption event. When the number of IPs currently existing in a certain AS drops below the interruption occurrence threshold (steady-state value × interruption occurrence percentage), the interruption event is considered to have started. In this example, 10% is used.

[0155] Interruption recovery percentage: It is used to determine the percentage of the end of the interruption event. When the number of prefixes or IPs currently existing in a certain AS rises above the interruption recovery threshold (steady-state value × interruption recovery percentage), the current interruption event is considered to be over. In this example, 90% is used.

[0156] Interrupt duration lower limit: An interruption event is considered abnormal only if the interruption duration exceeds this value. In this example, 60s is used.

[0157] Steady-state value update: used to adaptively update the steady-state value benchmark. When the current AS is not in an interruption state, if the number of reachable IPs remains unchanged for a certain period of time longer than the preset interruption duration T, the steady-state value is updated, and then the preset interruption occurrence threshold and the preset interruption recovery threshold are updated synchronously.

[0158] Step 7: Based on the timestamp-prefix matrix, the number of reachable IPs for each timestamp where the prefix has changed is obtained. When counting, it is necessary to pay attention to the inclusion relationship of the prefixes. When the prefix that has changed is a sub-prefix of a prefix that already exists in the routing table, it is considered that the number of reachable IPs does not change due to the announcement and cancellation of the sub-prefix. Therefore, for each timestamp that has changed, the current prefix is ​​counted in the prefix tree. When counting, recursion is used for pre-order traversal. If it passes through a node marked as a prefix or a node that has been counted, it means that its parent prefix exists in the observation range, and the function returns. If the current prefix node has not been counted, the number of reachable IPs of the current node is increased. Finally, the table of reachable IP number-time change is obtained.

[0159] Step 8: Extract routing interruption events. Traverse the reachable IP number-time change table according to the set threshold. If the number of reachable IPs at the current time point is lower than 10% of the steady-state value, it is considered that an interruption has occurred. Continue traversing until the current number of reachable IPs is higher than 90% of the steady-state value. It is considered that the interruption has been restored. The time difference between the two is t. If t is greater than or equal to the interruption duration of 60s, it is considered that this is an AS-dimensional routing interruption event and is recorded. At the same time, if no interruption has occurred at the current moment, record the current number of reachable IPs and compare it with the previous record result. If the number of reachable IPs continues to exceed the preset change time without changing, the steady-state value of the AS is updated to the current number of reachable IPs. After that, the interruption occurrence threshold and the interruption recovery threshold are updated synchronously.

[0160] Step 9: Based on the obtained AS dimension interruption event set, provide auxiliary analysis for other network security events. For example, if a security event such as routing hijacking or network attack occurs on a certain day in July 2024, search for the interruption event in the corresponding time range in the interruption event set, that is, observe the impact of abnormal network events on the connectivity of BGP routes, and then realize risk tracing, network optimization and other in-depth research.

[0161] like Figure 6 As shown, it is a module flow chart provided in an embodiment of the present application.

[0162] Data collection module: Use the original routing table data in MRT format collected from the observation point router and parse it with the bgpdump tool; collect routing registration data such as AS prefix lists from routing registration agencies such as the European IP Network (Réseaux IP Européens, RIPE).

[0163] Prefix tree module: Based on the original data of the routing table, the prefix of the routing entry and the Autonomous System Path (ASpath) information are extracted from the original RIBs file, and the node class (TrieNode) and prefix tree type (Trie) are defined using Python to convert the IP prefix into a binary 01 sequence and insert it into the prefix tree.

[0164] Mapping dictionary module: Based on RIPE's AS-prefix relationship file, it uses a dictionary structure to store prefix ownership relationships.

[0165] Event aggregation module: Based on the on / off status information stored in each prefix node in the prefix tree and the prefix-AS affiliation relationship stored in the mapping dictionary, the on / off events of the prefixes in the same AS are aggregated in chronological order to obtain the on / off event aggregation results in the AS dimension, which are presented in the form of a prefix matrix.

[0166] Routing interruption analysis module: according to the preset interruption conditions, the interruption events that meet the conditions are extracted from the aggregated data.

[0167] like Figure 7 As shown, it is a flowchart of another routing interruption detection method provided in an embodiment of the present application. Figure 7 First, the original data of the routing table and the routing registration data are obtained through data collection. Secondly, the prefix tree and mapping dictionary are established according to the RIBs file, and the prefix tree is updated according to the UPDATEs culture. After the on-off statistics of the prefix dimension, the on-off aggregation of the AS dimension is performed according to the prefix matrix to determine whether the two thresholds (preset interruption threshold and preset interruption recovery threshold) need to be updated, and the relevant indicators are defined. Finally, the routing interruption event is determined according to the on-off aggregation of the AS dimension.

[0168] The embodiments of the present application provide a method, device, electronic device and storage medium for detecting route interruption. By establishing a prefix tree to store prefix dimension information and utilizing the binary characteristics of IP prefixes and masks, the time complexity of route table lookup, sub-prefix merging and splitting is greatly reduced. The data structure of the prefix tree is used for basic data storage for route interruption detection, and the search efficiency of the IP prefix is ​​greatly optimized by utilizing the binary characteristics of the IP address. At the same time, the characteristics of the prefix tree are utilized to provide efficient prefix node comparison, deletion and parent-child prefix merging methods, providing a data basis for high real-time anomaly detection capabilities. At the same time, by adaptively recording IP prefix dimension interruption information for a long time and performing multi-dimensional route interruption event aggregation from the bottom up, it is possible to trace the interruption event, analyze and expand the specific prefix that caused the interruption and the overall picture of the event, thereby realizing quasi-real-time detection and analysis of route interruption events.

[0169] Based on the same inventive concept, a routing interruption detection device is also provided in the embodiment of the present application, such as Figure 8 As shown, the route interruption detection device 8000 includes:

[0170] The collection unit 8001 is used to collect the original data of the routing table and the routing registration data within the target autonomous domain;

[0171] Establishing unit 8002, used to establish a prefix tree based on the prefix of each routing entry in the original data of the routing table, and establish a mapping dictionary based on the mapping relationship between each target autonomous domain and the prefix in the routing registration data; the prefix node in the prefix tree is: the network bit of the Internet Protocol IP address corresponding to the recursive prefix;

[0172] Aggregation unit 8003, for aggregating the on-off status of each target autonomous domain based on the mapping dictionary and the on-off status of the corresponding prefix stored in each prefix node in the prefix tree, and establishing a prefix matrix; the on-off status includes the prefix declaration status or prefix revocation status of the prefix at each timestamp; the prefix at each timestamp in the prefix matrix is ​​the prefix whose on-off status changes;

[0173] The determining unit 8004 is used to determine, for each timestamp, that a routing interruption event occurs if the prefix statistics under the timestamp meets a preset interruption condition; the prefix statistics include at least one of the number of prefixes and the number of IPs corresponding to the prefixes.

[0174] In some embodiments, the establishing unit 8002 is specifically used to:

[0175] For each target autonomous domain, traverse each prefix mapped by the target autonomous domain in the mapping dictionary, and read the on / off status stored in the prefix node corresponding to each prefix from the prefix tree;

[0176] For each timestamp, if the on / off state of at least one target prefix at the timestamp is different from the on / off state of the target prefix at the previous timestamp, a prefix matrix is ​​established based on the timestamp and the on / off states of each prefix at the timestamp.

[0177] In some embodiments, if the prefix statistics information includes the number of prefixes, the preset interruption condition in the determination unit 8004 includes:

[0178] The number of prefixes at the first timestamp is less than the first preset interruption occurrence threshold, the number of prefixes at the second timestamp is greater than or equal to the first preset interruption recovery threshold, and the time difference between the first timestamp and the second timestamp is greater than the preset interruption duration;

[0179] The number of prefixes is the number of prefixes in the prefix matrix that are in the prefix announcement state.

[0180] In some embodiments, if the prefix statistics include the number of IPs, the preset interruption condition in the determination unit 8004 includes:

[0181] The number of IPs at the third timestamp is less than the second preset interruption occurrence threshold, the number of IPs at the fourth timestamp is greater than or equal to the second preset interruption recovery threshold, and the time difference between the third timestamp and the fourth timestamp is greater than the preset interruption duration;

[0182] The number of IPs is the number of IPs corresponding to prefixes in the prefix announcement state in the prefix matrix.

[0183] In some embodiments, after determining that a routing interruption event occurs for each timestamp and the prefix statistics under the timestamp meet a preset interruption condition, the apparatus further includes:

[0184] An updating unit 8005, used for updating a timestamp;

[0185] If no routing interruption event occurs at the post-update timestamp, the post-update prefix statistics at the post-update timestamp are recorded;

[0186] If the updated prefix statistical information does not change within the preset change time, the preset interruption condition is updated according to the updated prefix statistical information.

[0187] In some embodiments, the establishing unit 8002 is specifically used to:

[0188] Read the original data of the routing table and perform the following operations on each prefix:

[0189] Convert the network bits corresponding to the prefix into binary form;

[0190] According to the order of each bit in the network bit, traverse the prefix tree to find each bit;

[0191] For each bit, if the node corresponding to the bit does not exist in the prefix tree, add the corresponding node in the prefix tree;

[0192] When the recursive depth is equal to the mask length of the prefix, stop the recursive operation and use the current node as the prefix node;

[0193] The on / off status of the prefix is ​​stored in the prefix node.

[0194] Based on the same inventive concept, an electronic device is also provided in an embodiment of the present application. In one embodiment, the electronic device may be Figure 1 The terminal device 110 shown in FIG. 1 is a terminal device 110 shown in FIG. 1 . In this embodiment, the structure of the electronic device can be as follows: Fig. 9 As shown, it includes a memory 901 , a communication module 903 and one or more processors 902 .

[0195] The memory 901 is used to store computer programs executed by the processor 902. The memory 901 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and programs required for running the instant messaging function, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0196] The memory 901 may be a volatile memory, such as a random-access memory (RAM); the memory 901 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or the memory 901 may be any other medium that can be used to carry or store a desired computer program in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 901 may be a combination of the above memories.

[0197] The processor 902 may include one or more central processing units (CPU) or a digital processing unit, etc. The processor 902 is configured to implement the above-mentioned routing interruption detection method when calling the computer program stored in the memory 901 .

[0198] The communication module 903 is used to communicate with terminal devices and other servers.

[0199] The specific connection medium between the memory 901, the communication module 903 and the processor 902 is not limited in the embodiment of the present application. Fig. 9 In the embodiment, the memory 901 and the processor 902 are connected via a bus 904. The bus 904 is connected to the processor 902 via a bus 904. Fig. 9 The connections between the other components are only for illustration and are not intended to be limiting. The bus 904 can be divided into an address bus, a data bus, a control bus, etc. For ease of description, Fig. 9 The diagram shows that only one thick line is used, but this does not mean that there is only one bus or only one type of bus.

[0200] The memory 901 stores a computer storage medium, and the computer storage medium stores computer executable instructions, and the computer executable instructions are used to implement the routing interruption detection method of the embodiment of the present application. The processor 902 is used to execute the above-mentioned routing interruption detection method. Based on the same inventive concept, the embodiment of the present application provides a computer-readable storage medium, and the computer program product includes: a computer program code, when the computer program code is run on a computer, the computer executes any communication method discussed above. Since the principle of solving the problem by the above-mentioned computer-readable storage medium is similar to that of the routing interruption detection method, the implementation of the above-mentioned computer-readable storage medium can refer to the implementation of the method, and the repeated parts will not be repeated.

[0201] Refer to the following Fig.10 hereinafter, a computing device 1000 according to this embodiment of the present application is described. Fig.10 The computing device 1000 is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0202] like Fig.10 The computing device 1000 is in the form of a general computing device. The components of the computing device 1000 may include but are not limited to: at least one processing unit 1001, at least one storage unit 1002, and a bus 1003 connecting different system components (including the storage unit 1002 and the processing unit 1001).

[0203] Bus 1003 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor, or a local bus using any of a variety of bus architectures.

[0204] The storage unit 1002 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1021 and / or a cache memory 1022 , and may further include a read-only memory (ROM) 1023 .

[0205] The storage unit 1002 may also include a program / utility 1025 having a set (at least one) of program modules 1024, such program modules 1024 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0206] The computing device 1000 may also communicate with one or more external devices 1004 (e.g., keyboards, pointing devices, etc.), one or more devices that enable a user to interact with the computing device 1000, and / or any device that enables the computing device 1000 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 1005. Furthermore, the computing device 1000 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 1006. Fig.10 As shown, the network adapter 1006 communicates with other modules for the computing device 1000 via the bus 1003. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with the computing device 1000, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0207] The embodiment of the present application also provides a computer program product, and the method in the present application can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instruction is loaded and executed on a computer, the process or function described in the present application is executed in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user device, a core network device, an OAM or other programmable device.

[0208] The computer-readable storage medium can be implemented as a computer program product, that is, an embodiment of the present application also provides a computer-readable storage medium, which includes a computer program. When the computer program is executed by a processor, it implements any of the above-mentioned routing interruption detection methods.

[0209] The computer program or instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer program or instructions may be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired or wireless means. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, a hard disk, or a magnetic tape; it may also be an optical medium, such as a digital video disk; it may also be a semiconductor medium, such as a solid-state drive. The computer-readable storage medium may be a volatile or non-volatile storage medium, or may include both volatile and non-volatile types of storage media.

[0210] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0211] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0212] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0213] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0214] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for detecting a routing interruption, characterized in that: include: Collect the original data of the routing table and the routing registration data within the target autonomous domain; A prefix tree is established based on the prefixes of each routing entry in the original data of the routing table, and a mapping dictionary is established based on the mapping relationship between each target autonomous domain and the prefix in the routing registration data; the prefix node in the prefix tree is obtained by recursively calculating the network bit of the Internet Protocol IP address corresponding to the prefix; Based on the mapping dictionary and the on-off state corresponding to the prefix stored in each prefix node in the prefix tree, the on-off state of each target autonomous domain is aggregated to establish a prefix matrix; The on / off status includes a prefix declaration status or a prefix revocation status of the prefix at each timestamp; The prefixes under each time stamp in the prefix matrix are prefixes whose on / off states change; For each of the timestamps, if the prefix statistics under the timestamp meets the preset interruption condition, it is determined that a routing interruption event occurs; the prefix statistics include at least one of the number of prefixes and the number of IPs corresponding to the prefixes.

2. The method according to claim 1, characterized in that The on-off state of each target autonomous domain is aggregated based on the mapping dictionary and the on-off state of the prefix stored in each prefix node in the prefix tree to establish a prefix matrix, including: For each of the target autonomous domains, traverse each of the prefixes mapped by the target autonomous domain in the mapping dictionary, and read the on / off status stored in the prefix node corresponding to each prefix from the prefix tree; For each timestamp, if the on / off state of at least one target prefix at the timestamp is different from the on / off state of the target prefix at the previous timestamp, the prefix matrix is ​​established based on the timestamp and the on / off states of each prefix at the timestamp.

3. The method according to claim 1, characterized in that If the prefix statistical information includes the number of prefixes, the preset interruption condition includes: The number of prefixes at the first timestamp is less than a first preset interruption occurrence threshold, the number of prefixes at the second timestamp is greater than or equal to a first preset interruption recovery threshold, and the time difference between the first timestamp and the second timestamp is greater than a preset interruption duration; The number of prefixes is the number of prefixes in the prefix matrix that are in a prefix announcement state.

4. The method according to claim 1, characterized in that If the prefix statistics include the number of IP addresses, the preset interruption condition includes: The number of IPs at the third timestamp is less than the second preset interruption occurrence threshold, the number of IPs at the fourth timestamp is greater than or equal to the second preset interruption recovery threshold, and the time difference between the third timestamp and the fourth timestamp is greater than the preset interruption duration; The number of IPs is the number of IPs corresponding to prefixes in the prefix matrix that are in a prefix announcement state.

5. The method according to claim 1, characterized in that After determining that a routing interruption event occurs if the prefix statistics information at each timestamp satisfies a preset interruption condition, the method further includes: Update timestamp; If the routing interruption event does not occur at the updated timestamp, then recording the updated prefix statistics information at the updated timestamp; If the updated prefix statistical information does not change within the preset change time, the preset interruption condition is updated according to the updated prefix statistical information.

6. The method according to any one of claims 1 to 5, characterized in that: The step of establishing a prefix tree based on the prefixes of each routing entry in the original data of the routing table includes: Read the original data of the routing table, and perform the following operations on each prefix: Converting the network bits corresponding to the prefix into binary form; According to the order of each bit in the network bit, traverse and search each bit in the prefix tree; For each bit, if the node corresponding to the bit does not exist in the prefix tree, then add the corresponding node in the prefix tree; Until the recursive depth is equal to the mask length of the prefix, stop the recursive operation and use the current node as the prefix node; The on-off state of the prefix is ​​stored in the prefix node.

7. A routing interruption detection device, characterized in that: include: A collection unit, used to collect original data of routing tables and routing registration data within the target autonomous domain; An establishing unit is used to establish a prefix tree based on the prefixes of each routing entry in the original data of the routing table, and to establish a mapping dictionary based on the mapping relationship between each target autonomous domain and the prefix in the routing registration data; the prefix node in the prefix tree is obtained by recursively calculating the network bit of the Internet Protocol IP address corresponding to the prefix; an aggregation unit, configured to aggregate the on-off state of each of the target autonomous domains based on the mapping dictionary and the on-off state of the prefix stored in each prefix node in the prefix tree, and establish a prefix matrix; The on / off status includes a prefix declaration status or a prefix revocation status of the prefix at each timestamp; The prefixes under each time stamp in the prefix matrix are prefixes whose on / off states change; A determination unit is used to determine, for each of the timestamps, that a routing interruption event has occurred if the prefix statistics under the timestamp meets a preset interruption condition; the prefix statistics include at least one of the number of prefixes and the number of IPs corresponding to the prefixes.

8. An electronic device, characterized in that: include: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory, and execute the steps included in the method according to any one of claims 1 to 6 according to the obtained program instructions.

9. A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that The method comprises a computer program stored in a computer-readable storage medium; when a processor of an electronic device reads the computer program from the computer-readable storage medium, the processor executes the computer program, so that the electronic device executes the steps of the method according to any one of claims 1 to 6.

Images