A method, apparatus, electronic device, and storage medium for detecting routing interruptions.

Abstract

This application provides a routing interruption detection method, apparatus, electronic device, and storage medium. The method includes: collecting raw routing table data and routing registration data within a target autonomous system; establishing a prefix tree based on the prefixes of each routing entry in the raw routing table data, and establishing a mapping dictionary based on the mapping relationship between each target autonomous system and the prefix in the routing registration data; aggregating the connectivity status of each target autonomous system based on the mapping dictionary and the connectivity status of the corresponding prefix stored in each prefix node of the prefix tree to establish a prefix matrix; and determining that a routing interruption event has occurred if the prefix statistics under each timestamp meet a preset interruption condition. This application uses the prefix tree data structure as the basic data storage for routing interruption detection and significantly optimizes the lookup efficiency of IP prefixes by utilizing the binary characteristics of IP addresses, thus providing a data foundation for improving the detection efficiency of routing interruptions.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a routing interruption detection method, device, electronic device, and storage medium. Background Technology

[0002] Border Gateway Protocol (BGP) is a decentralized dynamic routing protocol between Autonomous Systems (AS) on the Internet. It allows different ASs on the Internet to automatically exchange Internet Protocol (IP) routing and reachability information.

[0003] Although BGP plays a crucial role in the Internet, its security is quite vulnerable. This vulnerability makes BGP highly susceptible to attacks, and it is prone to large-scale routing fluctuations and even routing outages when subjected to various malicious attacks, configuration errors, or other direct or indirect influences.

[0004] When faced with the above problems, related technologies often detect and analyze IP prefixes to determine whether a routing interruption has occurred. However, these technologies apply traditional data structures to IP addresses and IP prefixes, resulting in low processing efficiency during retrieval. For example, when using traditional data structures such as hash tables to store IP addresses, operations such as prefix merging, splitting, and searching are involved, which have high time complexity. For millions of routing entries, these operations often take hours or days, leading to low efficiency when using the entire network routing data for anomaly analysis.

[0005] In summary, improving the efficiency of routing interruption detection is an urgent issue that needs to be addressed. Summary of the Invention

[0006] This application provides a routing interruption detection method, apparatus, electronic device, and storage medium to improve the accuracy and comprehensiveness of IP address calculation.

[0007] In a first aspect, embodiments of this application provide a routing interruption detection method, including:

[0008] Collect raw routing table data and route registration data within the target autonomous system;

[0009] Based on the prefixes of each route entry in the original routing table data, a prefix tree is established, and based on the mapping relationship between each target autonomous system and the prefix in the route registration data, a mapping dictionary is established; the prefix nodes in the prefix tree are obtained by recursively recursively examining the network bits of the Internet Protocol IP address corresponding to the prefix.

[0010] Based on the mapping dictionary and the on / off states of the corresponding prefix stored in each prefix node of the prefix tree, the on / off states of each target autonomous region are aggregated to establish a prefix matrix; the on / off states include the prefix declaration state or prefix revocation state at each timestamp; the prefixes at each timestamp in the prefix matrix are the prefixes whose on / off states have changed.

[0011] If the prefix statistics under each timestamp meet the preset interruption conditions, then a routing interruption event is determined to have occurred; the prefix statistics include at least one of the number of prefixes and the number of IPs corresponding to the prefixes.

[0012] Secondly, embodiments of this application provide a routing interruption detection device, comprising:

[0013] The acquisition unit is used to collect raw routing table data and routing registration data within the target autonomous system.

[0014] The establishment unit is used to establish a prefix tree based on the prefixes of each route entry in the original routing table data, and to establish a mapping dictionary based on the mapping relationship between each target autonomous system and the prefix in the route registration data; the prefix nodes in the prefix tree are obtained by recursively recursively examining the network bits of the Internet Protocol IP address corresponding to the prefix;

[0015] An aggregation unit is used to aggregate the connectivity status of each target autonomous region based on the mapping dictionary and the connectivity status of the corresponding prefix stored in each prefix node of the prefix tree, and to establish a prefix matrix; the connectivity status includes the prefix declaration status or prefix revocation status of the prefix at each timestamp; the prefixes at each timestamp in the prefix matrix are the prefixes whose connectivity status has changed;

[0016] The determining unit is configured to determine that a routing interruption event has occurred if the prefix statistics under each timestamp meet a preset interruption condition; the prefix statistics include at least one of the number of prefixes and the number of IPs corresponding to the prefixes.

[0017] In some embodiments, the establishing unit is specifically used for:

[0018] For each target autonomous region, traverse each prefix mapped to the target autonomous region in the mapping dictionary, and read the on / off status stored in the prefix node corresponding to each prefix from the prefix tree;

[0019] For each timestamp, if the on / off state of at least one target prefix under the timestamp is different from the on / off state of the target prefix under the previous timestamp, then the prefix matrix is ​​established based on the timestamp and the on / off state of each prefix under the timestamp.

[0020] In some embodiments, if the prefix statistics include the number of prefixes, then the preset interruption condition in the determining unit includes:

[0021] The number of prefixes under the first timestamp is less than the first preset interruption threshold, the number of prefixes under the second timestamp is greater than or equal to the first preset interruption recovery threshold, and the time difference between the first timestamp and the second timestamp is greater than the preset interruption duration.

[0022] Wherein, the number of prefixes is the number of prefixes in the prefix matrix that are in the prefix declaration state.

[0023] In some embodiments, if the prefix statistics include the number of IP addresses, then the preset interruption condition in the determining unit includes:

[0024] The number of IPs under the third timestamp is less than the second preset interruption threshold, the number of IPs under the fourth timestamp is greater than or equal to the second preset interruption recovery threshold, and the time difference between the third timestamp and the fourth timestamp is greater than the preset interruption duration.

[0025] The number of IPs refers to the number of IPs corresponding to the prefixes that are in the prefix declaration state in the prefix matrix.

[0026] In some embodiments, after determining that a routing interruption event has occurred for each timestamp, the apparatus further includes:

[0027] Update unit, used to update timestamps;

[0028] If the route interruption event does not occur under the updated timestamp, then record the updated prefix statistics under the updated timestamp;

[0029] If the updated prefix statistics do not change within a preset change time, the preset interruption condition is updated based on the updated prefix statistics.

[0030] In some embodiments, the establishing unit is specifically used for:

[0031] Read the raw data of the routing table and perform the following operations for each prefix:

[0032] Convert the network bit corresponding to the prefix into binary form;

[0033] According to the order of each bit in the network bit, traverse the prefix tree to find each bit;

[0034] For each bit, if the node corresponding to the bit does not exist in the prefix tree, then the corresponding node is added to the prefix tree;

[0035] The recursion operation stops when the recursion depth equals the mask length of the prefix, and the current node is used as the prefix node.

[0036] The on / off state of the prefix is ​​stored in the prefix node.

[0037] Thirdly, embodiments of this application provide an electronic device, including:

[0038] Memory, used to store program instructions;

[0039] The processor is used to call the program instructions stored in the memory and execute the above-mentioned routing interruption detection method according to the obtained program instructions.

[0040] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the aforementioned routing interruption detection method.

[0041] Fifthly, embodiments of this application provide a computer program product, including a computer program stored in a computer-readable storage medium; when a processor of an electronic device reads the computer program from the computer-readable storage medium, the processor executes the computer program, causing the electronic device to perform the aforementioned routing interruption detection method.

[0042] This application provides a route interruption detection method, apparatus, electronic device, and storage medium. First, raw routing table data and route registration data within the target autonomous system (AAS) are collected to facilitate subsequent route interruption detection steps using this control plane data. Second, a prefix tree is established based on the prefixes of each route entry in the raw routing table data, and a mapping dictionary is established based on the mapping relationship between each target AAS and its prefix in the route registration data. This application uses the prefix tree data structure as the basic data storage for route interruption detection, significantly optimizing the IP prefix lookup efficiency by leveraging the binary characteristics of IP addresses, providing a data foundation for high-real-time anomaly detection capabilities. Furthermore, based on the mapping dictionary and the connectivity status of the corresponding prefix stored in each prefix node of the prefix tree, the connectivity status of each target AAS is aggregated to establish a prefix matrix. This application utilizes the characteristics of the prefix tree to provide efficient prefix node comparison, achieving data aggregation to obtain BGP interruption status at the AAS level, which helps in discovering operational faults. Finally, for each timestamp, if the prefix statistics under the timestamp meet preset interruption conditions, a route interruption event is determined to have occurred; the prefix statistics include at least one of the number of prefixes and the number of IPs corresponding to the prefixes. This application embodiment achieves long-term stable anomaly detection by pre-setting interruption conditions to detect routing interruption events from two aspects: the number of prefixes and the number of reachable IPs. Attached Figure Description

[0043] Figure 1 This is a schematic diagram illustrating an application scenario of a routing interruption detection method provided in an embodiment of this application.

[0044] Figure 2 A flowchart illustrating a routing interruption detection method provided in this application embodiment;

[0045] Figure 3 A schematic diagram of a prefix tree provided for an embodiment of this application;

[0046] Figure 4 A schematic diagram of a prefix matrix provided in an embodiment of this application;

[0047] Figure 5 A schematic diagram illustrating an update of a preset interruption condition provided in an embodiment of this application;

[0048] Figure 6 A module flowchart provided for an embodiment of this application;

[0049] Figure 7 A flowchart illustrating another routing interruption detection method provided in this application embodiment;

[0050] Figure 8 This is a schematic diagram of the structure of an electronic device for route interruption detection in an embodiment of this application;

[0051] Figure 9 This is a schematic diagram of the hardware structure of an electronic device using an embodiment of this application;

[0052] Figure 10 This is a schematic diagram of the hardware structure of a computing device according to an embodiment of this application. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0054] The following describes some of the concepts involved in the embodiments of this application.

[0055] Autonomous System (AS): In the Internet, an AS refers to a combination of all IP networks and routers under the jurisdiction of one or more entities that enforce a common routing policy on the Internet.

[0056] Border Gateway Protocol (BGP) is a decentralized dynamic routing protocol between Autonomous Systems (AS) on the Internet. It allows different ASs on the Internet to automatically exchange IP routing information and reachability information.

[0057] Before introducing the routing interruption detection method provided in the embodiments of this application, the technical background of the embodiments of this application will be described in detail below for ease of understanding.

[0058] BGP is a decentralized dynamic routing protocol between Autonomous Systems (AS) on the Internet. It allows different ASs on the Internet to automatically exchange IP routing and reachability information. While BGP plays a crucial role in the Internet, its security is vulnerable. ASs interconnected via BGP lack an effective authentication mechanism for received prefix routes, leading to the unconditional acceptance or propagation of routes from neighboring ASs, thus creating security risks.

[0059] BGP's security vulnerabilities make it highly susceptible to attacks, and it is prone to large-scale routing fluctuations when faced with various malicious attacks, configuration errors, or other direct or indirect impacts.

[0060] When faced with the above problems, related technologies often detect and analyze IP prefixes or determine whether a routing interruption has occurred based on feature extraction. However, applying traditional data structures to IP addresses and IP prefixes in these technologies results in low processing efficiency. Storing IP addresses using traditional data structures such as hash tables involves prefix merging, splitting, and lookup operations, leading to high time complexity. For millions of routing entries, these operations often take hours or days, resulting in low efficiency when using network-wide routing data for anomaly analysis. Furthermore, feature-based routing anomaly detection suffers from poor real-time performance. Common methods that extract features from routing data and then use machine learning or statistical models for anomaly detection have poor interpretability and high model complexity, making real-time detection of second-level streaming routing data impossible.

[0061] Furthermore, current research on routing anomalies lacks detection of BGP outage events: current detection methods focus on route hijacking and path leakage, neglecting the detection of route outages. Route outage detection relies on the declaration and revocation of route prefixes. The continuation of route entries directly affects network reachability and stability. The number of route outages caused daily by various direct or indirect reasons far exceeds that of route hijacking and leakage, warranting significant attention.

[0062] In view of this, embodiments of this application provide a routing interruption detection method, apparatus, electronic device, and storage medium. First, raw routing table data and routing registration data within the target autonomous system (AAS) are collected to facilitate subsequent routing interruption detection steps using this control plane data. Second, a prefix tree is established based on the prefixes of each routing entry in the raw routing table data, and a mapping dictionary is established based on the mapping relationship between each target AAS and its prefix in the routing registration data. This embodiment uses the prefix tree data structure as the basic data storage for routing interruption detection, significantly optimizing the IP prefix lookup efficiency by leveraging the binary characteristics of IP addresses, providing a data foundation for high-real-time anomaly detection capabilities. Furthermore, based on the mapping dictionary and the connectivity status of the corresponding prefix stored in each prefix node of the prefix tree, the connectivity status of each target AAS is aggregated to establish a prefix matrix. This embodiment utilizes the characteristics of the prefix tree to provide efficient prefix node comparison, achieving data aggregation to obtain BGP interruption status at the AAS level, which helps in discovering operational faults. Finally, for each timestamp, if the prefix statistics under the timestamp meet preset interruption conditions, a routing interruption event is determined to have occurred; the prefix statistics include at least one of the number of prefixes and the number of IPs corresponding to the prefixes. This application embodiment achieves long-term stable anomaly detection by pre-setting interruption conditions to detect routing interruption events from two aspects: the number of prefixes and the number of reachable IPs.

[0063] It should be noted that the application scenarios described in the following embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0064] The following is a brief introduction to the application scenarios to which the technical solutions of the embodiments of this application are applicable. It should be noted that the application scenarios described below are only for illustrating the embodiments of this application and are not intended to limit the scope. In specific implementation, the technical solutions provided by the embodiments of this application can be flexibly applied according to actual needs.

[0065] The embodiments of this application can be applied to the following network security scenarios:

[0066] (1) Detect and respond to routing security threats such as BGP outages.

[0067] The embodiments of this application can achieve automated, high real-time detection of route interruption events based on BGP routing control plane data. By selecting different route observation points, route interruption detection models from different perspectives can be constructed. For example, based on the operator's existing network data, route interruptions at the AS level can be detected from a Chinese perspective, which is helpful for further research on solutions to route interruptions.

[0068] (2) Construct the basic structure for routing data storage in the prefix dimension.

[0069] This application embodiment implements prefix-dimensional storage of basic routing table data by constructing a prefix tree and prefix node classes. Using the prefix tree data structure for IP and routing-related scenarios fully utilizes the binary characteristics of IP addresses, significantly improving computational efficiency for data analysis compared to traditional methods. Simultaneously, the nodes in the tree store various prefix-dimensional information, which can be used not only for BGP interruption detection but also for detecting other types of routing anomalies such as hijacking and leakage, or for historical data analysis and other control plane routing data research.

[0070] (3) Provide auxiliary analysis for other network security failure scenarios.

[0071] Besides the operation and maintenance of the routing system itself, various network attacks or anomalies can cause BGP to malfunction at the control level, indirectly leading to the declaration or revocation of a large number of related prefixes, and significant changes in the number of prefixes or reachable IPs. For example, system congestion or black holes caused by route hijacking or leakage can trigger rerouting, or route switching of related prefixes can occur due to physical line interruptions or Distributed Denial of Service (DDoS) attacks. The route interruption detection method provided in this application detects route interruptions within the time period of the anomaly, and the detection results can serve as a strong basis for related anomaly analysis and source tracing.

[0072] like Figure 1 The diagram shown illustrates an application scenario of a routing interruption detection method provided in this embodiment of the application. The application scenario diagram includes a terminal device 110, a server 120, and a target autonomous system 130.

[0073] It should be noted that the routing interruption detection method in this application embodiment can be executed by an electronic device, which can be a server 120 or a terminal device 110. That is, the method can be executed by the server 120 or the terminal device 110 alone, or by the server 120 and the terminal device 110 together. For example, when executed jointly by server 120 and terminal device 110, the object sends a route interruption detection request for target autonomous system 130 to server 120 on terminal device 110. After receiving the request, server 120 collects the original routing table data and route registration data within the target autonomous system 130. Server 120 establishes a prefix tree based on the prefixes of each route entry in the original routing table data, and establishes a mapping dictionary based on the mapping relationship between each target autonomous system and the prefix in the route registration data. Server 120 aggregates the connectivity status of each target autonomous system based on the mapping dictionary and the connectivity status of the corresponding prefix stored in each prefix node in the prefix tree, and establishes a prefix matrix. For each timestamp, if the prefix statistics under the timestamp meet the preset interruption conditions, server 120 determines that a route interruption event has occurred and feeds back the detection result to terminal device 110.

[0074] In one alternative implementation, the terminal device 110 and the server 120 can communicate via a communication network.

[0075] In one alternative implementation, the communication network is a wired network or a wireless network.

[0076] It should be noted that, Figure 1 The examples shown are merely illustrative; in reality, the number of terminal devices and servers is unlimited and is not specifically limited in the embodiments of this application.

[0077] The routing interruption detection method provided in this application can be divided into multiple modules: a data acquisition module, a prefix tree module, a mapping dictionary module, an event aggregation module, and a routing interruption analysis module.

[0078] Figure 2 The flowchart of a routing interruption detection method provided in an embodiment of this application is shown, taking a server as the execution subject as an example. Figure 2 As shown, the method may include the following steps S21 to S24:

[0079] S21: Collect raw routing table data and routing registration data within the target autonomous system.

[0080] The target autonomous system (AS) is preset as needed for the object and can generally be the entire network AS.

[0081] Raw routing table data refers to data that records routing information between ASs, including two types: routing information bases (RIBs) and update messages (UPDATEs). The collected raw routing table data is usually in Multi-Threaded Routing Toolkit (MRT) format, and the file needs to be parsed using the BGP data dump tool (bgpdump) to obtain a data file containing readable fields in a fixed format.

[0082] Routing registration data refers to the registration information that each AS registers with its respective address allocation authority, including the country name, the IP prefix it owns, the update time, and other information.

[0083] S21 refers to the specific steps implemented by the data acquisition module mentioned above. The data acquisition module uses the raw routing table data in MRT format collected from the observation point router and parses it using the bgpdump tool; it also collects routing registration data such as AS prefix lists from routing registration agencies such as the European IP Network (Réseaux IP Européens, RIPE).

[0084] In the above embodiments, in order to analyze BGP abnormal events and detect BGP interruption events at the AS level in real time, the embodiments of this application collect raw routing table data and route registration data to facilitate the subsequent establishment of a prefix tree and the mapping relationship between the prefix and its AS, thereby realizing event aggregation at the AS level.

[0085] After implementing the data acquisition steps of the data acquisition module in the above manner, the embodiments of this application implement the establishment steps of the prefix tree module and the mapping dictionary module in the following manner:

[0086] S22: Based on the prefixes of each route entry in the original routing table data, establish a prefix tree, and based on the mapping relationship between each target autonomous system and the prefix in the route registration data, establish a mapping dictionary;

[0087] In the prefix tree, the prefix node is obtained by recursively checking the network bits of the Internet Protocol IP address corresponding to the prefix.

[0088] Specifically, the prefix tree module extracts the prefixes and Autonomous System Path (ASpath) information of the routing entries from the original RIBs file based on the original routing table data. It uses Python to define the node class (TrieNode) and the prefix tree type (Trie), and converts the IP prefix into a binary 01 sequence and inserts it into the prefix tree.

[0089] In this embodiment of the application, when the prefix tree module builds the prefix tree, one optional implementation is as follows:

[0090] Read the raw data from the routing table and perform the following operations for each prefix:

[0091] Convert the network bits corresponding to the prefix to binary form; traverse the prefix tree according to the order of the bits in the network bits; for each bit, if there is no corresponding node in the prefix tree, add the corresponding node in the prefix tree; stop the recursion operation and set the current node as the prefix node when the recursion depth is equal to the mask length of the prefix; store the on / off state of the prefix in the prefix node.

[0092] Specifically, Python is used to create a node class (TrieNode) and a prefix tree class (Trie).

[0093] Taking Internet Protocol Version 4 (IPv4) as an example, the IP prefix in Classless Inter-Domain Routing (CIDR) is composed of xxx.xxx.xxx.xxx / xx, where the part before the " / " is the 32-bit binary IP address, and the part after the " / " is the subnet mask used to mark the network bits. Based on the binary numbers corresponding to the IP address, a prefix tree can be built using a binary tree data structure. Starting from the root node, each node in the binary tree uses 0 and 1 to mark its left and right child nodes, respectively. Each time a new prefix is ​​inserted, the network bits of the IP prefix are expanded according to the binary representation. Starting from the root node, the child nodes of the current node are recursively searched. If they do not exist, they are created. This process continues until the recursion depth equals the mask length, and the current node is marked as a prefix node.

[0094] like Figure 3 As shown, it is a schematic diagram of a prefix tree provided in an embodiment of this application. Figure 3 The code presents four IP prefixes: 192.0.0.0 / 2, 64.0.0.0 / 2, 32.0.0.0 / 3, and 224.0.0.0 / 3. The IP address 192.0.0.0 / 2, converted to binary, is 11000000 00000000 0000000000000000. Therefore, starting from the root node, a recursive search is performed along the right node marked with 1 until the recursion depth reaches the mask length of 2. The node at position 301 is then chosen as the prefix node. Similarly, the prefix node corresponding to 64.0.0.0 / 2 is 302, 32.0.0.0 / 3 is 303, and 224.0.0.0 / 3 is 304.

[0095] Each prefix node in the prefix tree is represented by a newly created instance of the node class. Each prefix node corresponds to a route entry in the original RIBs data, and the node also stores the specific information of the route entry.

[0096] The specific information stored in a node includes the storage of child nodes, whether the current node represents a prefix, AS path information in the routing entry, peer IP information in the routing entry, and on / off status information including timestamps and update types, etc.

[0097] After establishing the prefix tree in the above manner, in order to record the routing update history data of the prefix dimension, this application embodiment also provides a prefix tree update function:

[0098] Read the UPDATEs file within the observation range in chronological order, extract the IP prefix, update type (advertise or withdraw), and AS_PATH for each route entry, and search for the corresponding prefix node in the prefix tree. If the prefix is ​​not contained in the prefix tree, insert the prefix node and record the update type and timestamp of the route entry in the corresponding prefix node; if the prefix node is already contained in the prefix tree, add the timestamp and update type of the current route entry update to the updates stored in the corresponding node.

[0099] In the above embodiments, this application implements prefix dimension storage of the original routing table data by constructing a prefix tree and prefix node classes. Using the prefix tree data structure for IP and routing-related scenarios can fully utilize the binary characteristics of IP addresses. Compared to traditional data structures, using a prefix tree can significantly improve the computational efficiency of data analysis. Simultaneously, the prefix nodes in the prefix tree store various information about the prefix dimension, which can be used not only for BGP interruption detection but also for detecting other types of routing anomalies such as hijacking and leakage, or for other control plane routing data research work such as historical data analysis.

[0100] The mapping dictionary module in this application embodiment is based on RIPE's AS-prefix relationship file and uses a dictionary structure to store the prefix attribution relationship.

[0101] Specifically, based on RIPE's AS basic information file, a mapping dictionary is created. The key of this mapping dictionary is the AS number, and the value is the prefix node in the prefix tree corresponding to the prefix possessed by that AS. Because the key of the mapping dictionary and the prefix node of the prefix tree point to the same object, when the information stored in the prefix node in the prefix tree is modified, the corresponding information in the mapping dictionary will also be modified synchronously.

[0102] The event aggregation module will now be introduced based on the aforementioned prefix tree and mapping dictionary.

[0103] S23: Based on the mapping dictionary and the on / off states of the corresponding prefix stored in each prefix node of the prefix tree, aggregate the on / off states of each target autonomous region to establish a prefix matrix.

[0104] The on / off states include the prefix declaration state (A) or prefix cancellation state (W) at each timestamp; the prefixes at each timestamp in the prefix matrix (also known as the timestamp-prefix matrix) are the prefixes whose on / off states have changed. It can be understood that at each timestamp in the prefix matrix, at least one prefix has an on / off state that is different from that of the previous timestamp.

[0105] Specifically, the event aggregation module aggregates the on / off status information stored in each prefix node of the prefix tree and the prefix-AS affiliation relationship stored in the mapping dictionary, according to the time order, to obtain the on / off event aggregation result of the AS dimension, which is presented in the form of a prefix matrix.

[0106] In this embodiment of the application, an optional implementation method for establishing the prefix matrix is ​​as follows:

[0107] For each target autonomous system, traverse each prefix mapped to the target autonomous system in the mapping dictionary, and read the on / off state stored in the prefix node corresponding to each prefix from the prefix tree; for each timestamp, if the on / off state of at least one target prefix under the timestamp is different from the on / off state of the target prefix under the previous timestamp, then establish a prefix matrix based on the timestamp and the on / off state of each prefix under the timestamp.

[0108] Specifically, the prefix tree stores the connectivity information of the prefix dimension, which now needs to be aggregated to the AS dimension. For each AS in the selected target AS range, traverse each prefix node in the mapping dictionary of that AS-prefix, read the connectivity information (timestamp and A / W) of the prefix node, and build a timestamp-prefix matrix, where the timestamp is used as the first key value, ensuring that the timestamp-prefix matrix only contains timestamps of prefix changes.

[0109] like Figure 4 As shown, it is a schematic diagram of a prefix matrix provided in an embodiment of this application. Figure 4 The prefix matrix lists three timestamps t1, t2, and t3, each with three prefixes p1, p2, and p3. For timestamp t1, the on / off state of prefix p1 is A (prefix declared), the on / off state of prefix p2 is W (prefix withdrawn), and the on / off state of prefix p3 is None (unchanged, the same as the state of the previous timestamp t1). Similarly, for timestamp t2, the on / off state of prefix p1 is None (unchanged, the same as the state of t1, prefix declared), the on / off state of prefix p2 is A (prefix declared), and the on / off state of prefix p3 is A (prefix declared). For timestamp t3, the on / off state of prefix p1 is W (prefix withdrawn), the on / off state of prefix p2 is W (prefix withdrawn), and the on / off state of prefix p3 is W (prefix withdrawn).

[0110] In the above implementation, by establishing a prefix matrix, the connectivity status is transformed from the prefix dimension to the AS dimension, which helps to further study solutions when routing is interrupted.

[0111] The following section introduces the routing interruption analysis module.

[0112] S24: If the prefix statistics under each timestamp meet the preset interruption conditions, then a routing interruption event is determined to have occurred.

[0113] The prefix statistics include at least one of the following: the number of prefixes and the number of IPs corresponding to each prefix. The number of prefixes is the number of prefixes in the prefix matrix that are in the prefix declaration state at a certain timestamp. The number of IPs (also known as the number of reachable IPs) is the number of IPs corresponding to the prefixes in the prefix matrix that are in the prefix declaration state.

[0114] Specifically, the routing interruption analysis module extracts interruption events that meet the preset interruption conditions from the aggregated data.

[0115] When counting routing outage events, if the number of IPs in a certain AS is used as the criterion, the prefixes in the prefix tree need to be merged before counting. If a prefix and its subprefix coexist in the prefix tree and their paths are consistent, it is assumed that the connectivity of the subprefix will not affect the number of reachable IPs.

[0116] Therefore, before detecting routing interruption events based on the data in the prefix matrix, embodiments of this application can preprocess the prefix matrix in the following manner:

[0117] (1) Number of prefixes.

[0118] If the routing interruption event is determined based on the relationship between the number of prefixes and the preset interruption threshold, then for each target timestamp, the prefix matrix is ​​traversed, and the number of prefix nodes with prefix declarations corresponding to each target timestamp is counted, and a prefix number change table is established.

[0119] Specifically, if the detection is based on the number of prefixes, the timestamp-prefix matrix is ​​traversed, and the number of prefixes existing in the routing table at that timestamp is counted according to the prefix declaration, resulting in a prefix number change table (prefix number-time change table).

[0120] (2) Number of IPs.

[0121] If the routing interruption event is determined based on the relationship between the number of IPs and the preset interruption threshold, then for each target timestamp, the prefix matrix is ​​traversed, and the number of IPs of prefix nodes with prefix declaration corresponding to each target timestamp is counted, and an IP count change table is established.

[0122] Specifically, if the detection is based on the number of IPs, and the prefix whose connectivity status changes is a sub-prefix of an existing prefix in the routing table, then the reachable IP count of that prefix can be considered unaffected by the declaration and withdrawal of its sub-prefix. Therefore, for each timestamp in the prefix matrix, the current prefixes in the prefix tree are counted. During the count, a recursive preorder traversal is used. If a node marked as a prefix or a node that has already been counted is passed, it indicates that its parent prefix exists within the observation range, and the function returns. If the current prefix node has not been counted, the reachable IP count of the current node is increased. Finally, an IP count change table (reachable IP count - time change table) is obtained.

[0123] After counting the number of prefixes or IPs using the methods described above, before extracting routing interruption events through the routing interruption analysis module, the relevant metrics are first introduced and defined.

[0124] The number of interruptions is based on either the number of prefixes or the number of IPs. Each threshold will be determined based on the number of prefixes or IPs belonging to a certain AS to extract routing interruption events.

[0125] Steady-state numerical benchmark: The steady-state value of the number of prefixes or IPs used as the basis for determining route interruption.

[0126] Interruption Percentage: Used to determine the percentage of time a routing interruption event has started. When the number of prefixes or IPs currently in the prefix declaration state of an AS drops below the preset interruption threshold (steady-state value × interruption percentage), a routing interruption event is considered to have started.

[0127] Interruption recovery percentage: Used to determine the percentage of time a routing interruption event has ended. When the number of prefixes or IPs currently in the prefix declaration state of an AS rises to or above the preset interruption recovery threshold (steady-state value × interruption recovery percentage), the current routing interruption event is considered to have ended.

[0128] Interruption duration (also known as the lower limit of interruption duration): Only interruption events whose interruption duration (end time of routing interruption event - start time of routing interruption event) exceeds this value are considered abnormal interruption events.

[0129] After defining the aforementioned relevant indicators, this embodiment of the application uses a sliding window to extract routing interruption events from the prefix change or IP number change table in the time dimension. The table is traversed according to a set interruption occurrence threshold. If the number of prefixes / reachable IPs at the current timestamp is lower than the interruption occurrence threshold, an interruption is considered to have occurred. The traversal continues until the current number of prefixes / reachable IPs is higher than the interruption recovery threshold, at which point the interruption is considered to have recovered. The time difference between the two is the interruption duration. If this value is higher than the set lower limit for interruption duration, it is considered an interruption event and recorded.

[0130] In this application embodiment, when monitoring routing interruption events based on prefix statistics, an optional implementation method is as follows:

[0131] (1) If the prefix statistics include the number of prefixes, then the preset interruption conditions include:

[0132] The number of prefixes under the first timestamp is less than the first preset interruption threshold, the number of prefixes under the second timestamp is greater than or equal to the first preset interruption recovery threshold, and the time difference between the first timestamp and the second timestamp is greater than the preset interruption duration.

[0133] Specifically, firstly, a preset occurrence threshold is determined based on the product of the preset steady-state value of the prefix and the percentage of interruptions. Then, a preset recovery threshold is determined based on the product of the preset steady-state value of the prefix and the percentage of interruption recovery. Next, the prefix matrix is ​​traversed, or a prefix quantity change table generated from the prefix matrix is ​​traversed, to determine a first timestamp where the prefix quantity is less than the preset interruption occurrence threshold. This traversal continues until a second timestamp where the prefix quantity is greater than or equal to the preset interruption recovery threshold is determined. If the time difference between the first and second timestamps is greater than a preset interruption duration, then a routing interruption event is determined to have occurred.

[0134] (2) If the prefix statistics include the number of IPs, the preset interruption conditions include:

[0135] The number of IPs under the third timestamp is less than the second preset interruption threshold, the number of IPs under the fourth timestamp is greater than or equal to the second preset interruption recovery threshold, and the time difference between the third and fourth timestamps is greater than the preset interruption duration.

[0136] Specifically, firstly, a preset interruption threshold is determined by multiplying the preset steady-state value of the IP address by the percentage of interruptions, and a preset interruption recovery threshold is determined by multiplying the preset steady-state value of the IP address by the percentage of interruptions recovered. Then, the prefix matrix is ​​traversed, or the IP address count change table generated from the prefix matrix is ​​traversed, to determine a third timestamp where the number of IP addresses is less than the preset interruption threshold. This traversal continues until a fourth timestamp where the number of IP addresses is greater than or equal to the preset interruption recovery threshold. If the time difference between the third and fourth timestamps is greater than the preset interruption duration, a routing interruption event is determined to have occurred.

[0137] Considering that when observing routing interruption events over a long period of time, the unchanging interruption occurrence threshold and interruption recovery threshold are difficult to adapt to changes in routing conditions, this application provides a preset interruption condition update function.

[0138] Specifically, since the interruption occurrence threshold and interruption recovery threshold in this application embodiment are both determined based on steady-state values, this application embodiment updates the preset interruption conditions by updating the steady-state values.

[0139] In this application embodiment, when updating the preset interruption condition, an optional implementation method is as follows:

[0140] Update the timestamp; if no routing interruption event occurs under the updated timestamp, record the updated prefix statistics under the updated timestamp; if the updated prefix statistics do not change within the preset change time, update the preset interruption conditions based on the updated prefix statistics.

[0141] Specifically, when initially determining a route outage event, the RIB file collected when the observing router begins observation is selected as the baseline. The number of prefixes / reachable IPs in the advertised state in each AS is counted as a steady-state value, used to calculate the two thresholds in the preset outage conditions. However, as routes are advertised and withdrawn, the steady-state value used as the baseline may change. Therefore, after each timestamp update, the change in the number of prefixes / reachable IPs in the prefix advertised state is used to determine whether to update the steady-state value and the corresponding outage occurrence threshold and outage recovery threshold. Each time, the current number of prefixes / reachable IPs in the prefix advertised state is recorded. If the number remains unchanged for more than a preset change time, the current number of prefixes / reachable IPs in the prefix advertised state is taken as the new steady-state value.

[0142] like Figure 5 The diagram illustrates an update of preset interruption conditions provided in an embodiment of this application. After the timestamp is updated, an interruption is detected based on the number of prefixes or IP addresses under the current timestamp.

[0143] If no interruption is triggered, determine whether to update the two thresholds in the preset interruption conditions according to the above implementation method, and determine whether the number of prefixes or the number of IPs is less than the preset interruption recovery threshold, record and update the timestamp.

[0144] If an interruption is triggered, check if the number of prefixes or IPs is greater than or equal to the preset interruption recovery threshold. If recovery is not triggered, update the timestamp. If recovery is triggered, record the routing interruption event, reset the interruption status, and update the timestamp.

[0145] The routing interruption detection method provided in this application will be illustrated below with specific examples.

[0146] Step 1: Select the target Autonomous System (AS) and collect data. For example, if you want to observe routing outage events in Country M's AS from July 1, 2024 to the present, obtain the observation point RIBs file at 00:00 on July 1, 2024, and all UPDATEs files from that time to the present from publicly available data such as routeviews or operator backbone network data. Simultaneously, obtain routing registration data such as AS numbers from the entire network from RIPE.

[0147] Step 2: Initialize the IP prefix tree. Create the prefix tree class Trie and the node class TrieNode. Read the RIBs file, insert the prefix from each routing entry into the prefix tree, and store the valid information from the routing entry into the node class.

[0148] Step 3: Establish prefix-AS mapping. Based on the RIPE's AS basic information file, create a mapping dictionary where the keys are all AS numbers in the entire network, and the values ​​are the nodes in the prefix tree corresponding to the prefixes possessed by that AS.

[0149] Step 4: Update the prefix tree. Read the UPDATEs file in chronological order, and based on the declaration / revocation attribute of each route entry, add change information to the corresponding prefix node in the prefix tree, such as (timestamp, A / W (declare / revocation)).

[0150] Step 5: Prefix Dimension Connectivity and Disconnection Statistics. Based on the observed object, find the prefixes owned by country M in the prefix tree, read the declaration / revocation change history of all prefixes of country M, and create a timestamp-prefix matrix.

[0151] Step 6: Define the interruption detection metrics and thresholds.

[0152] Interruption count criteria: In this example, the number of IPs is selected. The interruption events will be extracted based on the number of reachable IPs belonging to a certain AS, and various thresholds will be used to determine the interruption events.

[0153] Steady-state numerical baseline: The steady-state value of the number of IPs used as the basis for judgment. The initial value is the number of reachable IPs for each AS in the first RIB file read.

[0154] Interrupt occurrence percentage: Used to determine the percentage of interrupt events that have started. When the number of currently active IPs in an AS drops below the interrupt occurrence threshold (steady-state value × interrupt occurrence percentage), an interrupt event is considered to have started. In this example, it is set to 10%.

[0155] Interruption recovery percentage: Used to determine the percentage of interruption event completion. When the number of prefixes or IPs currently existing in an AS rises above the interruption recovery threshold (steady-state value × interruption recovery percentage), the current interruption event is considered to have ended. In this example, it is set to 90%.

[0156] Interruption duration lower limit: Only interruption events whose duration exceeds this value are considered abnormal interruption events. In this example, it is set to 60s.

[0157] Steady-state value update: Used for adaptive update of steady-state value reference value. If the number of reachable IPs remains unchanged for more than the preset interruption duration T when the current AS is not in an interruption state, the steady-state value is updated. After that, the preset interruption occurrence threshold and the preset interruption recovery threshold are updated synchronously.

[0158] Step 7: Based on the timestamp-prefix matrix, obtain the number of reachable IPs for each timestamp where a prefix change occurred. When counting, pay attention to the prefix inclusion relationship. If the changed prefix is ​​a sub-prefix of an existing prefix in the routing table, the number of reachable IPs is considered unaffected by the prefix's declaration or withdrawal. Therefore, for each changed timestamp, count the currently existing prefixes in the prefix tree. Use recursion for preorder traversal. If a node marked as a prefix or a node already counted is passed, it means its parent prefix exists within the observation range, and the function returns. If the current prefix node has not been counted, increment the reachable IP count of the current node. Finally, obtain the reachable IP count-time change table.

[0159] Step 8: Extract Routing Interruption Events. Iterate through the reachable IP count-time change table according to the set thresholds. If the reachable IP count at the current time is less than 10% of the steady-state value, an interruption is considered to have occurred. Continue iterating until the current reachable IP count is greater than 90% of the steady-state value, at which point the interruption is considered to have recovered. The time difference between these two values ​​is t. If t is greater than or equal to the interruption duration of 60 seconds, this is considered an AS-level routing interruption event and is recorded. Simultaneously, if no interruption has occurred at the current time, record the current reachable IP count and compare it with the previous record. If the reachable IP count remains unchanged for more than the preset change time, update the steady-state value of the AS to the current reachable IP count. Afterward, the interruption occurrence threshold and interruption recovery threshold are updated synchronously.

[0160] Step 9: Based on the obtained AS-dimensional outage event set, provide auxiliary analysis for other network security events. For example, if a security event such as route hijacking or network attack occurs on a certain day in July 2024, then search for outage events within the corresponding time range in the outage event set. This allows us to observe the impact of abnormal network events on BGP route connectivity, thereby enabling in-depth research such as risk tracing and network optimization.

[0161] like Figure 6 As shown, it is a module flowchart provided in an embodiment of this application.

[0162] Data acquisition module: Uses raw routing table data in MRT format collected from observation point routers and parses it using the bgpdump tool; collects routing registration data such as AS prefix lists from routing registries such as the European IP Network (Réseaux IP Européens, RIPE).

[0163] Prefix tree module: Based on the original routing table data, it extracts the prefixes and Autonomous System Path (ASpath) information of the routing entries from the original RIBs file, uses Python to define the node class (TrieNode) and the prefix tree type (Trie), and converts the IP prefix into a binary 01 sequence and inserts it into the prefix tree.

[0164] Mapping dictionary module: Based on RIPE, the AS-prefix relationship file uses a dictionary structure to store the prefix attribution relationship.

[0165] Event aggregation module: Based on the on / off status information stored in each prefix node in the prefix tree and the prefix and AS affiliation relationship stored in the mapping dictionary, the on / off status of the prefixes of the same AS is aggregated in chronological order to obtain the on / off event aggregation result of the AS dimension, which is presented in the form of a prefix matrix.

[0166] Routing interruption analysis module: Extracts interruption events that meet the preset interruption conditions from the aggregated data.

[0167] like Figure 7 As shown, it is a flowchart of another routing interruption detection method provided in the embodiments of this application. Figure 7 First, data collection is performed to obtain the original routing table data and route registration data. Second, a prefix tree and mapping dictionary are built based on the RIBs file, and the prefix tree is updated according to the UPDATEs culture. After performing connectivity statistics at the prefix dimension, connectivity aggregation at the AS dimension is performed based on the prefix matrix to determine whether two thresholds (preset interruption occurrence threshold and preset interruption recovery threshold) need to be updated, and relevant indicators are defined. Finally, routing interruption events are determined based on the connectivity aggregation at the AS dimension.

[0168] This application provides a routing interruption detection method, apparatus, electronic device, and storage medium. By establishing a prefix tree to store prefix-dimensional information, and utilizing the binary characteristics of IP prefixes and masks, the time complexity of routing table lookups, sub-prefix merging, and splitting is significantly reduced. The prefix tree data structure is used as the basic data storage for routing interruption detection. The binary characteristics of IP addresses are used to greatly optimize the lookup efficiency of IP prefixes. Simultaneously, the prefix tree provides efficient methods for prefix node comparison, deletion, and parent-child prefix merging, providing a data foundation for high real-time anomaly detection capabilities. Furthermore, by adaptively recording IP prefix-dimensional interruption information over a long period and aggregating multi-dimensional routing interruption events from the bottom up, interruption event tracing can be achieved. The specific prefix that caused the interruption and the overall event can be analyzed and expanded, thereby realizing near real-time detection and analysis of routing interruption events.

[0169] Based on the same inventive concept, this application also provides a routing interruption detection device, such as... Figure 8 As shown, the routing interruption detection device 8000 includes:

[0170] The acquisition unit 8001 is used to acquire raw routing table data and routing registration data within the target autonomous system.

[0171] Establishment unit 8002 is used to build a prefix tree based on the prefixes of each route entry in the original routing table data, and to build a mapping dictionary based on the mapping relationship between each target autonomous system and the prefix in the route registration data; the prefix nodes in the prefix tree are obtained by recursively recursively analyzing the network bits of the Internet Protocol IP address corresponding to the prefix.

[0172] Aggregation unit 8003 is used to aggregate the on / off states of each target autonomous region based on the mapping dictionary and the on / off states of the corresponding prefix stored in each prefix node in the prefix tree, and to establish a prefix matrix; the on / off states include the prefix declaration state or prefix revocation state at each timestamp; the prefixes at each timestamp in the prefix matrix are the prefixes whose on / off states have changed.

[0173] The determination unit 8004 is used to determine that a routing interruption event has occurred if the prefix statistics under each timestamp meet the preset interruption conditions; the prefix statistics include at least one of the number of prefixes and the number of IPs corresponding to the prefixes.

[0174] In some embodiments, the establishing unit 8002 is specifically used for:

[0175] For each target autonomous system, traverse each prefix of the target autonomous system mapping in the mapping dictionary, and read the on / off state stored in the prefix node corresponding to each prefix from the prefix tree;

[0176] For each timestamp, if the on / off state of at least one target prefix under the timestamp is different from the on / off state of the target prefix under the previous timestamp, then a prefix matrix is ​​established based on the timestamp and the on / off state of each prefix under the timestamp.

[0177] In some embodiments, if the prefix statistics include the number of prefixes, the preset interruption condition in the determining unit 8004 includes:

[0178] The number of prefixes under the first timestamp is less than the first preset interruption threshold, the number of prefixes under the second timestamp is greater than or equal to the first preset interruption recovery threshold, and the time difference between the first timestamp and the second timestamp is greater than the preset interruption duration.

[0179] The prefix count is the number of prefixes in the prefix matrix that are in the prefix declaration state.

[0180] In some embodiments, if the prefix statistics include the number of IP addresses, the preset interruption condition in the determining unit 8004 includes:

[0181] The number of IPs under the third timestamp is less than the second preset interruption threshold, the number of IPs under the fourth timestamp is greater than or equal to the second preset interruption recovery threshold, and the time difference between the third timestamp and the fourth timestamp is greater than the preset interruption duration.

[0182] The number of IPs refers to the number of IPs corresponding to prefixes that are in the prefix declaration state in the prefix matrix.

[0183] In some embodiments, after determining that a routing interruption event has occurred, if the prefix statistics under each timestamp meet a preset interruption condition, the device further includes:

[0184] Update unit 8005 is used to update the timestamp;

[0185] If no routing interruption event occurs under the updated timestamp, then record the updated prefix statistics under the updated timestamp;

[0186] If the updated prefix statistics do not change within the preset change time, the preset interruption conditions will be updated based on the updated prefix statistics.

[0187] In some embodiments, the establishing unit 8002 is specifically used for:

[0188] Read the raw data from the routing table and perform the following operations for each prefix:

[0189] Convert the network bits corresponding to the prefix into binary form;

[0190] According to the order of each bit in the network bit, traverse the prefix tree to find each bit;

[0191] For each bit, if there is no corresponding node in the prefix tree, then add the corresponding node in the prefix tree;

[0192] Stop the recursion operation and set the current node as the prefix node when the recursion depth equals the length of the prefix mask.

[0193] Store the connectivity status of the prefix in the prefix node.

[0194] Based on the same inventive concept, this application also provides an electronic device. In one embodiment, the electronic device may be... Figure 1 The terminal device 110 is shown. In this embodiment, the electronic device can be structured as follows: Figure 9 As shown, it includes a memory 901, a communication module 903, and one or more processors 902.

[0195] The memory 901 is used to store computer programs executed by the processor 902. The memory 901 may mainly include a program storage area and a data storage area. The program storage area may store the operating system and programs required to run instant messaging functions, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0196] Memory 901 may be volatile memory, such as random-access memory (RAM); memory 901 may also be non-volatile memory, such as read-only memory, flash memory, hard disk drive (HDD), or solid-state drive (SSD); or memory 901 may be any other medium capable of carrying or storing a desired computer program having the form of instructions or data structures and accessible by a computer, but is not limited thereto. Memory 901 may be a combination of the above-described memories.

[0197] Processor 902 may include one or more central processing units (CPUs) or digital processing units, etc. Processor 902 is used to implement the above-mentioned routing interruption detection method when calling the computer program stored in memory 901.

[0198] The communication module 903 is used to communicate with terminal devices and other servers.

[0199] This application embodiment does not limit the specific connection medium between the memory 901, communication module 903, and processor 902 described above. This application embodiment... Figure 9 The memory 901 and the processor 902 are connected via a bus 904, which is in... Figure 9 The diagram uses thick lines to describe the connections between other components; these are for illustrative purposes only and should not be considered limiting. The 904 bus can be divided into address bus, data bus, control bus, etc. For ease of description, Figure 9 It is described using only a thick line, but does not indicate that there is only one bus or one type of bus.

[0200] The memory 901 stores a computer storage medium containing computer-executable instructions for implementing the routing interruption detection method of this application embodiment. The processor 902 executes the aforementioned routing interruption detection method. Based on the same inventive concept, this application embodiment provides a computer-readable storage medium containing computer program product including computer program code. When the computer program code is run on a computer, it causes the computer to execute any of the communication methods discussed above. Since the principle by which the aforementioned computer-readable storage medium solves the problem is similar to that of the routing interruption detection method, the implementation of the aforementioned computer-readable storage medium can be referred to the implementation of the method, and repeated details will not be elaborated further.

[0201] The following reference Figure 10 To describe a computing device 1000 according to this embodiment of the present application. Figure 10 The computing device 1000 is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0202] like Figure 10 The computing device 1000 is manifested in the form of a general-purpose computing device. The components of the computing device 1000 may include, but are not limited to: at least one processing unit 1001, at least one storage unit 1002, and a bus 1003 connecting different system components (including storage unit 1002 and processing unit 1001).

[0203] Bus 1003 represents one or more of several bus structures, including a memory bus or memory controller, peripheral bus, processor, or a local bus using any of the various bus structures.

[0204] Storage unit 1002 may include a readable medium in the form of volatile memory, such as random access memory (RAM) 1021 and / or cache memory 1022, and may further include read-only memory (ROM) 1023.

[0205] Storage unit 1002 may also include a program / utility 1025 having a set (at least one) of program modules 1024, such program modules 1024 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0206] The computing device 1000 can also communicate with one or more external devices 1004 (e.g., keyboard, pointing device, etc.), and with one or more devices that enable a user to interact with the computing device 1000, and / or with any device that enables the computing device 1000 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via the input / output (I / O) interface 1005. Furthermore, the computing device 1000 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via the network adapter 1006. Figure 10 As shown, network adapter 1006 communicates with other modules for computing device 1000 via bus 1003. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with computing device 1000, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0207] This application also provides a computer program product. The methods in this application can be implemented, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software, they can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instructions are loaded and executed on a computer, the processes or functions described in this application are executed, in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, network equipment, user equipment, core network equipment, OAM, or other programmable devices.

[0208] A computer-readable storage medium can be an implementation of a computer program product. That is, this application also provides a computer-readable storage medium that includes a computer program, which, when executed by a processor, implements any of the routing interruption detection methods described above.

[0209] The computer program or instructions may be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, the computer program or instructions may be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means. The computer-readable storage medium may be any available medium that a computer can access, or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, hard disk, or magnetic tape; or an optical medium, such as a digital video optical disc; or a semiconductor medium, such as a solid-state drive. The computer-readable storage medium may be a volatile or non-volatile storage medium, or may include both volatile and non-volatile types of storage media.

[0210] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0211] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0212] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0213] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0214] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for detecting routing interruptions, characterized in that, include: Collect raw routing table data and route registration data within the target autonomous system; Based on the prefixes of each route entry in the original routing table data, a prefix tree is established, and based on the mapping relationship between each target autonomous system and the prefix in the route registration data, a mapping dictionary is established; the prefix nodes in the prefix tree are obtained by recursively recursively examining the network bits of the Internet Protocol IP address corresponding to the prefix. Based on the mapping dictionary and the connectivity status of the corresponding prefix stored in each prefix node of the prefix tree, the connectivity status of each target autonomous region is aggregated to establish a prefix matrix; The on / off status includes the prefix declaration status or prefix revocation status at each timestamp; The prefixes under each timestamp in the prefix matrix are the prefixes whose on / off states have changed; If the prefix statistics under each timestamp meet the preset interruption conditions, then a routing interruption event is determined to have occurred. The prefix statistics include at least one of the number of prefixes and the number of IPs corresponding to the prefixes; wherein, if the prefix statistics include the number of prefixes, the preset interruption conditions include: the number of prefixes at a first timestamp is less than a first preset interruption occurrence threshold, the number of prefixes at a second timestamp is greater than or equal to a first preset interruption recovery threshold, and the time difference between the first timestamp and the second timestamp is greater than a preset interruption duration; wherein, the number of prefixes is the number of prefixes in the prefix matrix that are in the prefix declaration state; if the prefix statistics include the number of IPs, the preset interruption conditions include: the number of IPs at a third timestamp is less than a second preset interruption occurrence threshold, the number of IPs at a fourth timestamp is greater than or equal to a second preset interruption recovery threshold, and the time difference between the third timestamp and the fourth timestamp is greater than a preset interruption duration; wherein, the number of IPs is the number of IPs corresponding to prefixes in the prefix matrix that are in the prefix declaration state.

2. The method as described in claim 1, characterized in that, The step of aggregating the connectivity states of each target autonomous region based on the mapping dictionary and the connectivity states of the corresponding prefix stored in each prefix node of the prefix tree to establish a prefix matrix includes: For each target autonomous region, traverse each prefix mapped to the target autonomous region in the mapping dictionary, and read the on / off status stored in the prefix node corresponding to each prefix from the prefix tree; For each timestamp, if the on / off state of at least one target prefix under the timestamp is different from the on / off state of the target prefix under the previous timestamp, then the prefix matrix is ​​established based on the timestamp and the on / off state of each prefix under the timestamp.

3. The method as described in claim 1, characterized in that, After determining that a routing interruption event has occurred for each timestamp, the method further includes: Update timestamp; If the route interruption event does not occur under the updated timestamp, then record the updated prefix statistics under the updated timestamp; If the updated prefix statistics do not change within a preset change time, the preset interruption condition is updated based on the updated prefix statistics.

4. The method according to any one of claims 1 to 3, characterized in that, The step of building a prefix tree based on the prefixes of each route entry in the original routing table data includes: Read the raw data of the routing table and perform the following operations for each prefix: Convert the network bit corresponding to the prefix into binary form; According to the order of each bit in the network bit, traverse the prefix tree to find each bit; For each bit, if the node corresponding to the bit does not exist in the prefix tree, then the corresponding node is added to the prefix tree; The recursion operation stops when the recursion depth equals the mask length of the prefix, and the current node is used as the prefix node. The on / off state of the prefix is ​​stored in the prefix node.

5. A routing interruption detection device, characterized in that, include: The acquisition unit is used to collect raw routing table data and routing registration data within the target autonomous system. The establishment unit is used to establish a prefix tree based on the prefixes of each route entry in the original routing table data, and to establish a mapping dictionary based on the mapping relationship between each target autonomous system and the prefix in the route registration data; the prefix nodes in the prefix tree are obtained by recursively recursively examining the network bits of the Internet Protocol IP address corresponding to the prefix; An aggregation unit is used to aggregate the connectivity status of each target autonomous region based on the mapping dictionary and the connectivity status of the corresponding prefix stored in each prefix node of the prefix tree, and to establish a prefix matrix. The on / off status includes the prefix declaration status or prefix revocation status at each timestamp; The prefixes under each timestamp in the prefix matrix are the prefixes whose on / off states have changed; The determining unit is configured to determine that a routing interruption event has occurred if, for each timestamp, the prefix statistics under the timestamp meet a preset interruption condition. The prefix statistics include at least one of the number of prefixes and the number of IPs corresponding to the prefixes; wherein, if the prefix statistics include the number of prefixes, the preset interruption conditions include: the number of prefixes at a first timestamp is less than a first preset interruption occurrence threshold, the number of prefixes at a second timestamp is greater than or equal to a first preset interruption recovery threshold, and the time difference between the first timestamp and the second timestamp is greater than a preset interruption duration; wherein, the number of prefixes is the number of prefixes in the prefix matrix that are in the prefix declaration state; if the prefix statistics include the number of IPs, the preset interruption conditions include: the number of IPs at a third timestamp is less than a second preset interruption occurrence threshold, the number of IPs at a fourth timestamp is greater than or equal to a second preset interruption recovery threshold, and the time difference between the third timestamp and the fourth timestamp is greater than a preset interruption duration; wherein, the number of IPs is the number of IPs corresponding to prefixes in the prefix matrix that are in the prefix declaration state.

6. An electronic device, characterized in that, include: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the steps of the method according to any one of claims 1 to 4.

7. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, it implements the method of any one of claims 1 to 4.

8. A computer program product, characterized in that, The method includes a computer program stored in a computer-readable storage medium; when a processor of an electronic device reads the computer program from the computer-readable storage medium, the processor executes the computer program, causing the electronic device to perform the steps of the method according to any one of claims 1 to 4.

Images