BGP routing anomaly detection method

Abstract

The invention discloses a BGP (Border Gateway Protocol) routing anomaly detection method. The method comprises the following steps: acquiring BGP routing data from a network and preprocessing the BGP routing data, extracting features from the preprocessed BGP routing data, and inputting the extracted features into a trained BGP routing anomaly detection network to obtain a BGP routing anomaly detection result. The training process of the detection network comprises the following steps: acquiring a training sample and positive and negative labels thereof, and preprocessing to obtain a seven-tuple file of an updated message; constructing a directed AS-level network topological graph, and generating forward and reverse adjacency matrixes and forward and reverse initial feature matrixes; inputting the forward adjacency matrix and the forward initial feature matrix into a forward branch network of the GCN, inputting the reverse adjacency matrix and the reverse initial feature matrix into a reverse branch network of the GCN, splicing and aggregating output results of the forward branch network and the reverse branch network of the GCN, and inputting a feature matrix into a graph attention mechanism layer; and calculating the classification loss of the output result, and optimizing the BGP routing anomaly detection network through the loss. The accuracy of the detection result is obviously improved.

Description

Technical Field

[0001] The invention belongs to the technical field of network security, and in particular relates to a BGP routing anomaly detection method. Background Art

[0002] The Internet is a globally interconnected network system, consisting of a large number of autonomous systems (AS). Each autonomous system exchanges routing information through the Border Gateway Protocol (BGP) to achieve interconnection between different networks and ensure the normal operation of the global Internet. As the core protocol of the Internet, BGP is responsible for the dissemination of global routing information and path selection. Its stability and security directly affect the overall performance of the Internet.

[0003] With the rapid expansion of the Internet, the application of BGP protocol has covered the world, processing billions of routing updates every day. BGP exchanges routing information between autonomous systems to ensure that each autonomous system can choose the best path for data transmission, thereby maintaining the efficient operation of the network. However, when the BGP protocol was originally designed, it was developed only based on the trust model and relied on the trust relationship between autonomous systems, without a strong built-in security mechanism. Although this architecture worked well in the early days of the Internet, with the increase in network complexity and the frequent occurrence of malicious attacks, it exposed significant security risks. Typical anomalies include but are not limited to:

[0004] 1. Route hijacking refers to a malicious announcement of the routing prefix of another autonomous system by an autonomous system AS or a forged non-existent path to the prefix. Specifically, the same prefix is ​​announced by multiple autonomous systems at the same time, and the connection relationship between the two autonomous systems in the AS path does not conform to the actual situation.

[0005] 2. Route leakage. Generally, route propagation violates the no-bottom routing principle. When Internet traffic is transmitted back to the route leaking party, it may cause a route black hole because the leaking party does not have the ability to forward traffic. It may also cause the traffic to be directed to an unexpected path, leading to security issues such as eavesdropping or traffic analysis.

[0006] 3. Routing interruption: due to force majeure factors such as power outages, equipment overload, natural disasters, etc. in BGP backbone routing equipment, or due to human configuration errors and network attacks, the prefix of the source AS is revoked, thereby causing the target prefix route to be unreachable. Routing interruption not only affects the normal transmission of data, but may also trigger a chain reaction, leading to large-scale network service interruption.

[0007] BGP routing security has been a hot topic since the birth of the BGP protocol. Research has focused on the following three directions: (1) Security reinforcement at the protocol level. Although there are mechanisms such as TCP MD5 and GTSM, these measures have failed to solve core problems such as routing hijacking and path tampering; (2) Trusted verification mechanism for inter-domain routing, which verifies the authenticity and integrity of routing information by establishing a trusted data source; (3) BGP routing security analysis and detection, which mainly detects anomalies through monitoring of the control plane and data plane. In recent years, BGP security detection methods have continued to develop, covering a variety of technologies such as statistical pattern recognition, historical BGP update messages, reachability verification, and time series analysis. These methods have their own advantages and disadvantages, but their application in large-scale network environments is still challenging, especially in terms of detection efficiency, deployment cost, and data processing capability accuracy. In addition, in recent years, research on border gateway protocol anomaly detection based on machine learning models has become increasingly popular. From the perspective of machine learning, the anomaly detection problem can be regarded as a binary classification problem. The message structure of the border gateway protocol has a relatively complex structure, and some features extracted from messages such as update messages can be used to classify normal and abnormal data. In this regard, many researchers have proposed a variety of classification methods using different features, such as: classification models based on support vector machines, classification models based on decision trees, etc. The main idea of ​​this type of BGP routing anomaly detection based on machine learning is: first, statistics are performed based on the update message volume and the characteristics of the "AS_PATH" attribute changes when the anomaly occurs. Then, feature weighting is performed based on the changes in multiple features to obtain feature evaluation factors, or classifiers such as support vector machines or decision trees are used to train samples. Finally, the inter-domain security situation is evaluated based on the feature evaluation factors or trained classifiers.

[0008] Traditional machine learning classification models cannot process non-Euclidean structured data such as graphs. Feature extraction and selection are required before abnormal route classification to organize them into structured data that can be processed by traditional machine learning models.

[0009] In recent years, graph neural network technology has gradually become a new hot spot in academia, and has made great progress in algorithm maturity, model adaptability, and basic tool development. Graph neural networks can directly process non-Euclidean data such as graph structures and extract higher-order features. As a classic model of graph neural networks, graph convolutional neural networks extend convolution operations to graph structure data, which can extract node features of local connections and learn feature representations of different neighbor nodes. At present, the application of graph neural network technology to BGP routing anomaly detection still faces challenges, and the accuracy of its detection results still needs to be further improved. Summary of the invention

[0010] In order to solve the above technical problems, the present invention proposes a BGP routing anomaly detection method, which comprises: obtaining BGP routing data from a network and preprocessing it, extracting features from the preprocessed BGP routing data, inputting the extracted features into a trained BGP routing anomaly detection network, and obtaining a BGP routing anomaly detection result;

[0011] The training process of the BGP routing anomaly detection network specifically includes:

[0012] S1: Obtain BGP routing data before and after BGP routing anomalies as training samples, obtain positive and negative labels after annotation, pre-process the training samples, and convert them into a seven-tuple file of update messages;

[0013] S2: Based on the seven-tuple of the update message, a directed AS-level network topology graph is constructed, and a forward and reverse adjacency matrix is ​​generated according to the AS-level network topology graph, and a forward and reverse initial feature matrix is ​​generated according to the seven-tuple of the update message;

[0014] S3: Input the forward adjacency matrix and the forward initial feature matrix into the forward branch network of GCN, input the reverse adjacency matrix and the reverse initial feature matrix into the reverse branch network of GCN, and concatenate and aggregate the output results of the forward and reverse branch networks of GCN;

[0015] S4: Input the concatenated and aggregated feature matrix into the graph attention mechanism layer GAT, perform pooling and activation processing on the output results of the graph attention mechanism layer, and output the probability distribution corresponding to the positive and negative labels;

[0016] S5: Calculate the classification loss according to the probability distribution corresponding to the positive and negative labels and the marked positive and negative labels, and optimize the BGP routing anomaly detection network through the loss.

[0017] Beneficial effects of the present invention: The present invention constructs a graph model of BGP routing topology, combines the changes in node features, and uses GCN to automatically learn the deep features of the graph, ultimately achieving accurate classification of BGP anomalies. Compared with traditional machine learning, the present invention does not require manual design of deep features. GCN can automatically extract deep features from the topology based on the graph structure, aggregate the information of nodes and their neighbors during the GCN training process, make full use of the network topology, and significantly improve the performance of GCN. The present invention can significantly improve the accuracy of BGP anomaly detection results. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 is a flowchart of steps of an embodiment of the present invention;

[0019] Figure 2 The figure is a schematic diagram of the training process of the BGP routing anomaly detection network in an embodiment of the present invention.

[0020] Figure 3 This is a schematic diagram of the containerized simulation of BGP routing anomaly detection in an embodiment of the present invention. DETAILED DESCRIPTION

[0021] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] The embodiment of the present invention proposes a BGP routing anomaly detection method, which includes: acquiring BGP routing data from a network and preprocessing it, extracting features from the preprocessed BGP routing data, inputting the extracted features into a trained BGP routing anomaly detection network, and obtaining a BGP routing anomaly detection result.

[0023] This paper collects data, extracts and analyzes the correlation of real BGP routes at different locations in the network. The original data of the protocol is obtained from the RIPE and RouteViews projects in the Border Gateway Protocol direct data source. The RIPE project provides routing information services, using remote routing collectors deployed around the world to collect and store routing data in the network. Each remote routing collector stores two types of data: (1) All Border Gateway Protocol update messages starting with "updates", which are created every 5 minutes; (2) Complete routing tables starting with "bview", which are created every 8 hours. The data is stored in the multi-threaded routing toolkit routing information export format. The RouteViews project also has multiple collectors around the world to collect relevant routing data. Among them, routing table data is created every 2 hours, and routing update data is created every 15 minutes.

[0024] Reference Figure 1 , 2 As shown, the training process of the BGP routing anomaly detection network specifically includes:

[0025] S1: Obtain BGP routing data before and after BGP routing anomalies as training samples, obtain positive and negative labels after annotation, pre-process the training samples, and convert them into a seven-tuple file of update messages.

[0026] Specifically, the TM event, namely the Telekom Malaysia event, is selected from RouteViews. This event is that AS 4788 leaked one-third of the IP prefixes in the global routing table to the backbone network provider Level3 (AS 3549). The data one hour before the leakage time is selected as the normal sample and the data within the first hour after the event is selected as the abnormal sample, and the samples are selected at a time interval of 2 minutes. The data collected at the time interval is taken as a sample. 30 BGP routing data samples under normal network conditions and 30 BGP routing data samples when BGP routing is abnormal are collected from the above event to obtain a balanced data set. The balanced data set is used as the training sample set of an embodiment of the present invention, and positive and negative labels are obtained after labeling. The positive label represents the BGP routing data corresponding to normal BGP routing, and the negative label represents the BGP routing data corresponding to abnormal BGP routing.

[0027] Since the data format of the collected balanced data set (i.e., training sample set) is in MRT format, it needs to be preprocessed. Specifically, the PyBGPdump tool is used to parse it and convert it into a csv format update message seven-tuple file (collector, dump_time, type, time, peer_address, peer_asn, fields).

[0028] Preferably, the seven-tuple file of the update message is specifically expressed as: (collector, dump_time, type, time, peer_address, peer_asn, fields), wherein "collector" represents the collection point information; "dump_time" represents the data storage time of the collection point; "type" represents the message type; "peer_address" represents the IP address of the peer receiving this message; "peer_asn" represents the autonomous system number of the peer receiving this message; "fields" represents that different information is contained according to different message types, and the main contents include AS path information, prefix information, next hop IP and other contents.

[0029] S2: Based on the seven-tuple of the update message, a directed AS-level network topology graph is constructed, and a forward and reverse adjacency matrix is ​​generated according to the AS-level network topology graph, and a forward and reverse initial feature matrix is ​​generated according to the seven-tuple of the update message.

[0030] Specifically, each update message is parsed one by one, and the autonomous system number in the seven-tuple of the BGP update message is obtained as a node, and the path information (i.e., the propagation order from one AS to another AS) is taken as the edge (connection relationship) between the nodes and stored in json format to obtain a json file.

[0031] Using the visualization tool NetworkX and writing Python scripts to read the json file, after parsing and adding edges, we get an AS-level directed topology graph G = (V, E) based on the BGP update message, which consists of nodes (V = v 1 ,v 2 ,,v n ) and edge (E=e 1 ,e 2 ,,,e n ), where n represents the number of nodes and edges.

[0032] After building the AS-level directed graph, call the adjacency_matrix method provided by NetworkX to generate the forward adjacency matrix A forward And the reverse adjacency matrix A backward . The element A in the forward adjacency matrix ij Indicates whether there is a connection between node i and node j. If there is a directed edge from node i to node j, that is, routing information is propagated from node i to node j, then A ij =1, otherwise A ij = 0. Similarly, the reverse adjacency matrix is ​​similar.

[0033] For common BGP anomalies, such as route leakage and prefix hijacking, in large-scale scenarios, the basic features in the BGP update message (AS number, path information, next hop information, etc.) cannot meet the effectiveness of anomaly detection. Therefore, the embodiment of the present invention proposes to reference the timing of BGP routing, routing jitter suppression characteristics and routing propagation delay as supplementary initial features.

[0034] BGP routing timing can reflect the frequency and pattern of routing updates (such as common DDoS attacks, which are usually accompanied by a large amount of routing update data in a short period of time). BGP routing timing characteristics mainly include update frequency, which requires counting the number of routing update entries of the node in the current sample. i , according to the interval time of selecting samples, the node update frequency is U i / 2min.

[0035] BGP route jitter reflects the signal that the network is unstable or may be attacked. It obtains the Withdraw quantity M of the node from the seven-tuple of the BGP update message. i and Announce number N i , through M i / max(N i ,1) Get the node's withdrawal announcement ratio (max(N i ,1) represents from N i and 1) as the BGP route jitter feature.

[0036] BGP route propagation delay can indicate the current network congestion and may reflect equipment failure or configuration errors. It first obtains the timestamp and AS path of each node from the seven-tuple of the BGP update message. Because the BGP route propagation delay refers to the time required for propagation from an autonomous system to its adjacent nodes, it is essentially to calculate the delay of the update message propagating from one node to another based on the timestamp. According to the timestamp T of each node, i and AS path, and obtain the timestamp T of the adjacent nodes in the AS path. i+1 , and finally according to T i+1 -T i Get the propagation delay characteristics of this node.

[0037] These newly proposed initial features can better locate abnormal situations in large-scale BGP networks and effectively improve the accuracy of anomaly detection.

[0038] Preferably, in the AS-level network topology diagram, the forward and reverse initial feature matrices are generated according to the seven-tuple of the update message, and the forward and reverse initial feature matrices include the node's in-degree, the node's out-degree, the node's AS number, the number of prefixes accessible by the node, the update frequency, the withdrawal announcement ratio, and the routing propagation delay. The in-degree of the node in the forward initial feature matrix is ​​0, and the out-degree of the node in the reverse initial feature matrix is ​​0.

[0039] Specifically, the forward initial feature matrix (in-degree is 0) is generated based on the basic initial features of each node and the temporal features of BGP routing, routing jitter suppression features and routing propagation delay features as the content of the initial feature matrix [node in-degree, node out-degree, node AS number, number of prefixes accessible by the node, update frequency, withdrawal announcement ratio, routing propagation delay]. forward =[x 1 ,x 2 ,…,x n ] and the reverse initial characteristic matrix (out-degree is 0) X backward =[x 1 ,x 2 ,…,x n ].

[0040] Usually, graph convolutional neural networks (GCNs) are only applicable to undirected graphs, because the Laplacian matrix itself is defined on undirected graphs. Compared with undirected graphs, the biggest difference between directed graphs and undirected graphs is that the adjacency matrix becomes an asymmetric matrix, so the Laplacian matrix and its spectral decomposition cannot be directly defined. Therefore, GCN is suitable for processing undirected graph data. However, in the BGP protocol, routing information is propagated from one autonomous system (AS) to another autonomous system (AS), with obvious directionality. The topological structure of BGP is essentially directed: an AS may announce a routing prefix to another AS, and this information propagation is directional; therefore, the structure of the BGP network should be represented by a directed graph. A directed graph can better reflect the routing propagation process, and the process of routing hijacking and routing leakage is also directional. If it is an undirected graph, it will be impossible to clearly track the exact propagation direction of routing information and loop problems.

[0041] In order to overcome the limitation that traditional graph convolutional neural networks (GCN) can only be applied to undirected graphs, the embodiment of the present invention proposes a GCN based on directed graphs, and combines the topological structure of the BGP network to propose a new BGP routing anomaly detection method. This method effectively utilizes directed graph information, proposes a dual input method of forward adjacency matrix and reverse adjacency matrix, and realizes efficient aggregation of node features through a multi-branch GCN network combined with a graph attention mechanism (GAT).

[0042] S3: The forward adjacency matrix A forward With the forward initial feature matrix X forward Input the forward branch network of GCN and transform the reverse adjacency matrix A backward With the inverse of the initial feature matrix X backward Input the reverse branch network of GCN and concatenate and aggregate the output results of the forward and reverse branch networks of GCN.

[0043] Based on the standard graph convolution formula, we can get the propagation mode between the neural network layers. The nonlinear function is as follows:

[0044]

[0045] Among them, A new Represents the adjacency matrix of the directed graph G, here it represents the forward adjacency matrix A forward Or the reverse adjacency matrix A backward ,also I n is the identity matrix. (0) =X, which represents the forward or reverse initial feature matrix, L is the number of neural network layers, D is the degree matrix (representing the number of in-degree and out-degree of each node). σ(·) is a nonlinear activation function (such as ReLU, etc.), W(l) is the parameterized weight matrix of the Lth neural network layer.

[0046] Specifically, the forward adjacency matrix A forward With the forward initial feature matrix X forward Input the forward branch network of GCN and transform the reverse adjacency matrix A backward With the inverse of the initial feature matrix X backward Input the reverse branch network of GCN. The two GCN networks use formula (2) and formula (3) to complete their respective graph convolution operations.

[0047] The output of the forward branch network of GCN is specifically expressed as:

[0048]

[0049] in, represents the output feature matrix of the l+1th layer in the forward branch network, l represents the index of the current neural network layer, f(.) represents the graph convolution function, and represents the feature transfer method from the lth layer to the l+1th layer, H (l) Represents the input feature matrix, A forward represents the forward adjacency matrix, σ(.) represents the nonlinear activation function, represents the degree matrix corresponding to the forward adjacency matrix, represents the forward adjacency matrix plus the identity matrix, represents the feature matrix of the lth layer input in the forward branch network, Represents the parameter weight matrix of the lth layer of the forward branch network.

[0050] The output of the reverse branch network of GCN is specifically expressed as:

[0051]

[0052] in, represents the output feature matrix of the l+1th layer in the reverse branch network, l represents the index of the current neural network layer, f(.) represents the graph convolution function, and represents the feature transfer method from the lth layer to the l+1th layer, H (l) Represents the input feature matrix, A backward represents the reverse adjacency matrix, σ(.) represents the nonlinear activation function, represents the degree matrix corresponding to the inverse adjacency matrix, represents the reverse adjacency matrix plus the identity matrix, represents the feature matrix of the lth layer input in the reverse branch network, Represents the parameter weight matrix of the lth layer of the reverse branch network.

[0053] When the number of graph convolutional neural network layers is too large, the features learned by the graph convolutional model are likely to be over-smoothed, that is, the output features of each vertex are very similar. The over-smoothing problem will also interact with other problems, such as gradient vanishing, overfitting, and difficulty in label propagation. Increasing the number of layers does not significantly improve performance, and the features learned by a single-layer graph convolution are too shallow. Generally speaking, selecting 2 to 3 layers of graph convolution layers can achieve good classification results.

[0054] After being processed by the forward and reverse branch networks of GCN, that is, after completing the forward GCN and reverse GCN branch calculations, two deep node feature matrices H are obtained respectively. forward and H backward If the two output embedded feature matrices are simply aggregated in dimension, all the data of the forward and reverse features will be directly retained, including similar and repeated parts, which may introduce a lot of redundant information, which will reduce the expressiveness of the features and increase the risk of overfitting. Therefore, a sparse coding aggregation algorithm is proposed to implement the splicing aggregation step to address this problem. This algorithm has shown excellent performance in data compression, denoising, classification and other scenarios in modern image processing and machine learning.

[0055] Preferably, the output results of the forward and reverse branch networks of GCN are spliced ​​and aggregated, and the specific process includes: initializing a sparse dictionary D according to the node feature dimension; sparsely processing the output results of the forward and reverse branch networks to obtain corresponding forward and reverse sparse matrices; calculating the similarity matrix S according to the forward and reverse sparse matrices, and screening the forward and reverse sparse matrices according to the similarity matrix S to obtain a forward screened sparse matrix and a reverse screened sparse matrix; after the forward screened sparse matrix and the reverse screened sparse matrix are combined, they are reconstructed according to the sparse dictionary D to obtain the final sparse spliced ​​aggregation matrix.

[0056] Specific:

[0057] S301: Based on the above steps, the forward feature matrix H output by the forward branch network of GCN can be obtained forward , the reverse feature matrix H output by the reverse branch network of GCN backward , the total number of nodes N and the feature dimension d of each node.

[0058] S302: Initialize a sparse dictionary D, the size of which is generated based on 2 or 1.5 times the node feature dimension d, and its value is randomly selected from the standard normal distribution N(0,1).

[0059] S303: Obtain the sparse forward and reverse sparse matrices according to the following formula:

[0060] H≈D·Z(6)

[0061] Among them, H represents the input feature matrix, specifically refers to the forward or reverse feature matrix, D is the sparse dictionary, Z represents the forward or reverse sparse feature matrix, and the solution of Z must meet the optimization goal:

[0062]

[0063] in represents the reconstruction error (ensuring that the dictionary and sparse representation can effectively reconstruct the original features), represents the Euclidean norm, that is, all elements of the matrix are squared and summed. H represents the input feature matrix, which here refers to the forward or reverse feature matrix. D is the sparse dictionary. Z represents the forward or reverse sparse feature matrix. λ represents the sparse constraint weight, which usually takes a value between (0.01 and 0.1). ||Z|| 1 represents the coefficient regularization term, ||·|| 1 Take the absolute values ​​of all elements of the matrix and sum them up.

[0064] S304: According to the forward sparse matrix Z forward and the inverse sparse matrix Z backward , and obtain the similarity matrix According to formula (8), the sparse matrix after forward and reverse screening is obtained:

[0065] Z filtered =Z Mask (8)

[0066] Here, Z filtered Represents a forward screening sparse matrix and reverse filter sparse matrix Z represents the forward sparse matrix Z forward and the inverse sparse matrix Z backward , Mask takes the value of 0 or 1, when S < threshold, it is 1, when S > threshold, it is 0, and the threshold is generally 0.8. The specific purpose of this step is to remove the parts with high similarity in the forward and reverse representations and retain the differentiated information.

[0067] S305: Forward screening of sparse matrix and reverse filter sparse matrix Add together to get the matrix Z fusion , and then reconstruct it according to the sparse dictionary D to obtain the final sparse concatenated aggregation matrix H fusion .

[0068] Based on this, the two branch networks of GCN each use a graph convolution layer as part of the middle hidden layer because after splicing and aggregating the outputs of the GCN branch networks, they need to pass through a graph attention mechanism layer GAT.

[0069] S4: Input the concatenated and aggregated feature matrix into the graph attention mechanism layer GAT, perform pooling and activation processing on the output results of the graph attention mechanism layer, and output the probability distribution corresponding to the positive and negative labels.

[0070] The concatenated feature matrix Z fusion Input to the next GAT layer, the basic calculation formula of GAT is as follows:

[0071]

[0072] Among them, h′ i represents the new embedded features after the graph attention mechanism is calculated, σ(.) represents the nonlinear activation function, N(i) is the set of neighbor nodes of node i, W represents the learnable linear transformation matrix, and h i Represents the input feature of each node, that is, the feature of this node after concatenation, α ij represents the attention weight between node i and its neighbor node j, which is calculated by the following formula:

[0073]

[0074] Among them, exp(.) represents the exponential function, which is used to ensure that the attention weight is non-negative and grows exponentially with the node relationship. LeakyReLU(.) represents the LeakyReLU activation function, which is used to ensure nonlinearity. a represents a learnable attention weight vector, a T represents the transposed matrix of the attention weight vector a, || represents the concatenation operation, k represents a neighbor node of node i, and h i represents the input feature of each node, that is, the feature of this node after concatenation, W represents the learnable linear transformation matrix, h k Represents the input features of neighbor node k.

[0075] After the GAT layer outputs the embedded features of the nodes, a pooling operation is performed to obtain the graph-level representation of this graph. The commonly used pooling operation is average pooling:

[0076]

[0077] Where N is the number of nodes in the graph, H pool It is a graph-level pooling feature, which represents the feature vector of the entire graph. The feature vector of the graph is then input into the softmax function:

[0078] P = softmax(H pool ) (12)

[0079] Among them, P represents the probability distribution of the label to which this image belongs, softmax(.) represents the softmax activation function, and H pool Represents graph-level pooling features.

[0080] Obtain the probability distribution P of the labels belonging to the graph G, and select the maximum value as the label y of the graph. y=1 indicates that there is a routing anomaly, and y=0 indicates that the network is in a normal state.

[0081] S5: Calculate the classification loss according to the probability distribution corresponding to the positive and negative labels and the marked positive and negative labels, and optimize the BGP routing anomaly detection network through the loss.

[0082] In common deep learning, the cross entropy loss function is generally used as the loss function of the model. However, in the large-scale BGP network anomaly detection scenario, normal traffic is generally much more than abnormal traffic. This category imbalance may cause the model to pay more attention to a large number of normal samples during training, while ignoring a small number of abnormal samples. In order to overcome the above shortcomings, it is proposed to use the focus loss function as the loss function of the model. The focus loss function can reduce the loss weight of easy-to-classify samples and increase the loss weight of difficult-to-classify samples by adjusting factors, thereby improving the model's sensitivity to abnormal samples. Consistent with the commonly used loss function, the smaller the value of the focus loss function, the better the model prediction effect. The classification effect of the model is optimized by continuously reducing the output value of the loss function.

[0083] Preferably, the classification loss used in the embodiment of the present invention is specifically:

[0084] Focal Loss = -α t (1-p t ) γ log(p t ) (13)

[0085] Among them, α t is a category balance factor, which is used to balance the weights of normal and abnormal samples. Its value is selected between 0 and 1. Since the number of normal samples and abnormal samples selected in the embodiment of the present invention is the same, α is t The value is 1. t is the predicted probability of the model (BGP routing anomaly detection network) for the correct category. First, the label y obtained in the above step is obtained. Secondly, the true label of each sample is obtained in the sample acquisition step. Finally, p is obtained according to the following formula t The value of .

[0086]

[0087] γ is used to control the attenuation of focal loss on easy-to-classify samples. It is usually used to reduce the loss contribution of one-class samples and increase the focus on difficult-to-classify samples. Its value is generally selected between 1 and 3. Because the difficulty of normal samples and abnormal samples selected in this article is similar, the value of γ here is 1. In the optimization process, the Adam optimizer is also used to optimize the model parameters. Adam is an adaptive learning rate optimization algorithm that can automatically adjust the learning rate in each round of iteration to help the model converge faster. Its core lies in dynamically adjusting the learning step size of each parameter to ensure a more stable gradient update. In each iteration, the model calculates the embedded features of each node through forward propagation, then uses the loss function to calculate the prediction error, and adjusts the parameters of the model through backward propagation until the loss function of the model is minimized and converged.

[0088] Simulation verification:

[0089] The present invention also provides a simulation verification method to verify the effectiveness of the BGP anomaly detection network of the embodiment of the present invention, which includes:

[0090] Build a network environment based on virtualized containers;

[0091] Simulation topology and load balancing based on real BGP network;

[0092] BGP protocol simulation and abnormal behavior simulation and prediction based on GoBGP.

[0093] Reference Figure 3 As shown in the figure, virtualized container technology is used to create a virtualized environment. First, the network port isolation is achieved through the Linux network namespace technology. The network namespace provides a completely isolated network environment, allowing multiple virtualized network stacks to run on the same physical host. Each namespace has an independent network interface, IP address, routing table, etc., and there will be no conflict between network resources in different namespaces. Secondly, install the Quagga routing suite. Quagga is an open source routing suite that supports multiple routing protocols (such as BGP, OSPF, etc.). It contains multiple daemons (such as bgpd, ospfd), and each daemon is responsible for the corresponding routing protocol. Its main function is to provide support for various protocols, pass routing information to the core process Zebra, and Zebra writes it into the routing table inside the container. In addition, routing table information can be obtained from Zebra for use by routing protocols. Then, the Linux bridge command is used to create a bridge. Finally, a virtual Ethernet pair (vethpair) is used to connect the namespace and the bridge. One end of the veth pair is connected to the network namespace and the other end is connected to the bridge. Each network interface is configured in the namespace. Through the above steps, a virtualized node similar to a router can be generated to simulate a real network environment.

[0094] Reference Figure 3 As shown, the simulation topology uses the real network topology of the current three major domestic operators and their foreign BGP nodes (the AS numbers of the three major domestic operators mainly used to access the global Internet are: Telecom: 4134, Connectivity: 4837, Mobile: 9808) There are about 4000 nodes and 7000 links, and each node is equivalent to a BGP domain with its own AS number. First, it is necessary to successfully start the topology based on the virtual containerization technology of step S5, and use the Metis graph partitioning tool to divide the entire network into multiple areas to achieve load balancing and ensure that the resources of each AS node are used reasonably. Metis is an efficient graph partitioning tool, which is mainly used to divide a large-scale graph into multiple subgraphs, and can meet the uniform number of nodes in each subgraph, and the cross-subgraph edges between subgraphs are the least. Its idea is to abstract the entire large topology into a picture, with nodes as points and links as edges. After being processed by Metis, multiple files are generated, each file represents a node owned by a subgraph, and each file is subsequently placed in a server, and then a python script is written to start each node in each server, and finally the overall topology is successfully started.

[0095] Reference Figure 3 As shown in the figure, GoBGP is a tool that supports the standard BGP protocol and multiple extended functions. Due to its efficient and lightweight design, GoBGP is very suitable for BGP simulation in a virtualized environment. First, GoBGP is an open source tool that can be downloaded directly. Then, a separate GoBGP configuration file (gobgpd.conf) is created for each namespace, specifying the AS number, neighbor relationship, and routing policy. Here, gobgpd.conf can obtain the network port and neighbor information of each node in the topology through a script and automatically generate and write it to the directory of each node. Finally, the BGP protocol of all nodes can be started with one click through the gobgpd command. After the scene is successfully started, the BGP protocol can be automatically run in the simulation scene successfully.

[0096] Typical BGP abnormal behaviors are simulated in a simulation environment to simulate BGP route hijacking. By publishing incorrect route prefixes on specific nodes (for example, declaring itself as a legitimate path to a target network), other nodes are induced to forward traffic to the hijacking node; path tampering can also be simulated by modifying BGP path information (such as changing the AS_PATH field) to simulate path tampering and other behaviors. The GoBGP tool is used to automatically publish and update BGP route information, and real-time BGP route data can be collected. After an abnormality occurs, the real-time data collected by GoBGP is input into the abnormality detection model of the first part of the present invention to obtain a label indicating whether an abnormality has occurred.

[0097] A person skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the relevant hardware through a program, and the program can be stored in a computer-readable storage medium, which can include: ROM, RAM, disk or CD, etc.

[0098] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A BGP routing anomaly detection method, characterized in that: include: Acquire BGP routing data from the network and preprocess it, extract features from the preprocessed BGP routing data, input the extracted features into the trained BGP routing anomaly detection network, and obtain BGP routing anomaly detection results; The training process of the BGP routing anomaly detection network specifically includes: The BGP routing data before and after the BGP routing anomaly is obtained as training samples, and positive and negative labels are obtained after labeling. The training samples are preprocessed and converted into a seven-tuple file of the update message; Based on the seven-tuple file of the update message, a directed AS-level network topology graph is constructed, and a forward and reverse adjacency matrix is ​​generated according to the AS-level network topology graph, and a forward and reverse initial feature matrix is ​​generated according to the seven-tuple file of the update message; Input the forward adjacency matrix and the forward initial feature matrix into the forward branch network of GCN, input the reverse adjacency matrix and the reverse initial feature matrix into the reverse branch network of GCN, and concatenate and aggregate the output results of the forward and reverse branch networks of GCN; The concatenated feature matrix is ​​input into the graph attention mechanism layer GAT, and the output results of the graph attention mechanism layer are pooled and activated respectively, and the probability distribution corresponding to the positive and negative labels is output; The classification loss is calculated according to the probability distribution corresponding to the positive and negative labels and the marked positive and negative labels, and the BGP routing anomaly detection network is optimized through the loss.

2. The BGP routing anomaly detection method according to claim 1, characterized in that: The seven-tuple file of the update message is specifically expressed as: (collector, dump_time, type, time, peer_address, peer_asn, fields), wherein "collector" represents the collection point information; "dump_time" represents the data storage time of the collection point; "type" represents the message type; "peer_address" represents the IP address of the peer receiving this message; "peer_asn" represents the autonomous system number of the peer receiving this message; and "fields" represents different information contained according to different message types.

3. The BGP routing anomaly detection method according to claim 1, characterized in that: The positive label indicates the BGP routing data corresponding to normal BGP routing, and the negative label indicates the BGP routing data corresponding to abnormal BGP routing.

4. The BGP routing anomaly detection method according to claim 1, characterized in that: In the AS-level network topology diagram, the forward and reverse initial feature matrices are generated according to the seven-tuple of the update message. The forward and reverse initial feature matrices include the node's in-degree, the node's out-degree, the node's AS number, the number of prefixes accessible by the node, the update frequency, the withdrawal announcement ratio, and the routing propagation delay. The in-degree of the node in the forward initial feature matrix is ​​0, and the out-degree of the node in the reverse initial feature matrix is ​​0.

5. The BGP routing anomaly detection method according to claim 1, characterized in that: The output results of the forward and reverse branch networks of GCN are spliced ​​and aggregated. The specific splicing and aggregation process includes: Initialize a sparse dictionary D according to the node feature dimension; perform sparse processing on the output results of the forward and reverse branch networks to obtain corresponding forward and reverse sparse matrices; calculate a similarity matrix S based on the forward and reverse sparse matrices, and screen the forward and reverse sparse matrices based on the similarity matrix S to obtain a forward screened sparse matrix and a reverse screened sparse matrix; add the forward screened sparse matrix and the reverse screened sparse matrix, and reconstruct them according to the sparse dictionary D to obtain a final sparse concatenated aggregation matrix.

6. The BGP routing anomaly detection method according to claim 1, characterized in that: The classification loss is specifically: Focal Loss=-α t (1-p t ) γ log(p t ) Among them, Focal Loss represents classification loss, α t represents the category balance factor, p t It represents the prediction probability of the correct category by the BGP routing anomaly detection network, and γ represents the attenuation strength of the control focus loss on easy-to-classify samples.

Images