RPKI-based routing data anomaly detection method and related equipment

Abstract

The embodiment of the invention provides an RPKI-based routing data anomaly detection method and related equipment, and the method comprises the steps: firstly, obtaining routing origin data from real-time gateway data; then, performing resource public key infrastructure technology analysis on the routing origin data to obtain a resource public key infrastructure technology analysis result; then, gateway prefix hijacking detection is carried out on the routing origin data to obtain a gateway prefix anomaly detection result, or routing origin authorization anomaly detection is carried out on the routing origin data to obtain a routing anomaly detection result, and routing origin authorization anomaly detection is carried out on the routing origin data again after a preset detection period; and finally, obtaining assertion replacement data corresponding to the routing origin data, and repairing the routing origin data based on the assertion replacement data, thereby improving the accuracy of performing routing origin authorization anomaly detection on the gateway data, and further improving the accuracy and reliability of repairing the abnormal gateway data.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a routing data anomaly detection method and related equipment based on RPKI. Background Art

[0002] Routing origin authorization anomaly detection is an important way to ensure data security in a network framework that supports resource public key infrastructure technology, and it is usually combined with gateway data anomalies. During network communication, the data flow through the gateway is monitored and analyzed to identify and mark data points or events that support resource public key infrastructure technology and do not conform to normal behavior patterns. This process is critical to maintaining network security and stability because it can help detect potential security threats, system failures or other abnormal behaviors in a timely manner.

[0003] In the related art, the route origin authorization anomaly detection for gateway data is generally to perform a prior anomaly allocation detection on the data related to the resource public key infrastructure resources, and obtain the route origin authorization anomaly detection situation based on the analysis results. However, since the actual route origin authorization anomaly detection situation includes many, only the prior allocation anomaly detection cannot quickly determine the actual route origin authorization situation of the gateway data in real time during the use of RPKI, and thus cannot perform corresponding repairs. Summary of the invention

[0004] The embodiments of the present application provide a method and related equipment for detecting anomalies in routing data based on RPKI, which can improve the accuracy of routing origin authorization detection of gateway data and improve the reliability of repairing abnormal gateway data.

[0005] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application proposes a method for detecting anomalies in routing data based on RPKI, the method comprising:

[0006] Obtain route origin data from real-time gateway data;

[0007] Performing resource public key infrastructure technical analysis on the routing origin data to obtain a resource public key infrastructure technical analysis result;

[0008] When the resource public key infrastructure technology analysis result indicates that the real-time gateway data does not support the resource public key infrastructure technology, performing a gateway prefix hijacking detection on the routing origin data to obtain a gateway prefix anomaly detection result;

[0009] When the resource public key infrastructure technology analysis result indicates that the real-time gateway data supports the resource public key infrastructure technology, performing a routing origin authorization anomaly detection on the routing origin data to obtain a routing anomaly detection result, and performing the routing origin authorization anomaly detection on the routing origin data again after a preset detection period;

[0010] Based on the gateway prefix anomaly detection result or the route anomaly detection result, assertion replacement data corresponding to the route origin data is acquired, and the route origin data is repaired based on the assertion replacement data.

[0011] In some embodiments, performing resource public key infrastructure technical analysis on the routing origin data to obtain a resource public key infrastructure technical analysis result includes:

[0012] Obtaining a target code number identifier corresponding to the routing origin data;

[0013] Based on matching the target code number identifier with multiple code number identifiers in a resource public key infrastructure database, and obtaining the resource public key infrastructure technical analysis result based on the matching result, the code number identifier is associated with routing origin authorization data.

[0014] In some embodiments, performing gateway prefix hijacking detection on the routing origin data to obtain a gateway prefix anomaly detection result includes:

[0015] Obtaining routing origin data from the real-time gateway data;

[0016] The routing origin data is matched with the authoritative data in the Internet resource database to obtain the gateway prefix anomaly detection result.

[0017] In some embodiments, performing routing origin authorization anomaly detection on the routing origin data to obtain a routing anomaly detection result includes:

[0018] Obtaining the routing origin authorization data of the real-time gateway data and the number of routing origin authorization data corresponding to the routing origin authorization data;

[0019] When there are multiple routing origin authorization data, performing attribution association detection on the multiple routing origin authorization data to obtain the routing anomaly detection result;

[0020] When the number of the routing origin authorization data is one, a routing origin authorization change detection is performed on the routing origin authorization data to obtain the routing anomaly detection result.

[0021] In some embodiments, performing attribution association detection on the plurality of routing origin authorization data to obtain the routing anomaly detection result includes:

[0022] Obtaining the authorization agency of each of the routing origin authorization data, and obtaining the agency association chain of each of the authorization agencies;

[0023] When all the authorization agencies belong to the same agency association chain, performing routing origin authorization change detection on a plurality of routing origin authorization data to obtain the routing anomaly detection result;

[0024] When there are at least two authorized institutions that do not belong to the same institution association chain, a routing anomaly detection result is generated to indicate that an anomaly exists in the routing origin data.

[0025] In some embodiments, after the routing origin data is subjected to the routing origin authorization anomaly detection again after a preset detection period, the method further includes:

[0026] When the routing origin authorization data corresponding to the routing origin data cannot be detected, matching multiple code number identifiers from the routing certificate revocation list based on the target code number identifier to obtain a revocation matching result;

[0027] Based on the revocation matching result, a routing anomaly detection result for characterizing the anomaly of the routing origin authorization data is generated.

[0028] In some embodiments, the acquiring, based on the gateway prefix anomaly detection result or the routing anomaly detection result, assertion replacement data corresponding to the routing origin data, and repairing the routing origin data based on the assertion replacement data, includes:

[0029] When the gateway prefix anomaly detection result or the route anomaly detection result indicates that the route origin data is abnormal, prefix data filtering is performed on the real-time gateway data to obtain filtering code number data;

[0030] Acquire the assertion replacement data corresponding to the filter code number data from an authoritative database;

[0031] The resource public key data information corresponding to the real-time gateway data in the resource public key infrastructure database is replaced based on the assertion replacement data.

[0032] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application proposes a routing data anomaly detection device based on RPKI, the device comprising:

[0033] A code number data acquisition module is used to obtain routing origin data from real-time gateway data;

[0034] A resource technology analysis module, used for performing resource public key infrastructure technology analysis on the routing origin data to obtain a resource public key infrastructure technology analysis result;

[0035] A gateway anomaly detection module, configured to perform a gateway prefix hijacking detection on the routing origin data to obtain a gateway prefix anomaly detection result when the resource public key infrastructure technology analysis result indicates that the real-time gateway data does not support the resource public key infrastructure technology;

[0036] A routing detection module, for performing routing origin authorization anomaly detection on the routing origin data to obtain a routing anomaly detection result when the resource public key infrastructure technology analysis result indicates that the real-time gateway data supports the resource public key infrastructure technology, and performing the routing origin authorization anomaly detection on the routing origin data again after a preset detection period;

[0037] A repair module is used to obtain assertion replacement data corresponding to the routing origin data based on the gateway prefix anomaly detection result or the routing anomaly detection result, and repair the routing origin data based on the assertion replacement data.

[0038] To achieve the above-mentioned purpose, a third aspect of an embodiment of the present application proposes an electronic device, wherein the electronic device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the RPKI-based routing data anomaly detection method as described in the first aspect is implemented.

[0039] To achieve the above-mentioned purpose, the fourth aspect of an embodiment of the present application proposes a storage medium, which is a computer-readable storage medium, and the storage medium stores a computer program. When the computer program is executed by a processor, the routing data anomaly detection method based on RPKI described in the above-mentioned first aspect is implemented.

[0040] The RPKI-based routing data anomaly detection method and related devices proposed in the embodiment of the present application include: first, obtaining routing origin data from real-time gateway data; then, performing resource public key infrastructure technology analysis on the routing origin data to obtain a resource public key infrastructure technology analysis result; then, when the resource public key infrastructure technology analysis result indicates that the real-time gateway data does not support the resource public key infrastructure technology, performing gateway prefix hijacking detection on the routing origin data to obtain a gateway prefix anomaly detection result; thereafter, when the resource public key infrastructure technology analysis result indicates that the real-time gateway data supports the resource public key infrastructure technology, performing routing origin authorization anomaly detection on the routing origin data to obtain a routing anomaly detection result, and performing routing origin authorization anomaly detection on the routing origin data again after a preset detection period; finally, based on the gateway prefix anomaly detection result or the routing anomaly detection result, obtaining assertion replacement data corresponding to the routing origin data, and repairing the routing origin data based on the assertion replacement data. In an embodiment of the present application, resource public key infrastructure technology analysis is performed on the routing origin data in the real-time gateway data to determine whether the real-time gateway data can support the resource public key infrastructure technology, so as to facilitate further corresponding anomaly detection, and periodic detection is performed on the routing origin data that can support the resource public key infrastructure technology, thereby improving the accuracy of routing origin authorization anomaly detection for gateway data, and using reliable assertion replacement data corresponding to the routing origin data to replace the abnormal routing origin data, thereby improving the accuracy and reliability of abnormal gateway data repair.

[0041] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a schematic diagram of a resource public key infrastructure provided by an embodiment of the present application.

[0043] Figure 2 It is a structural diagram of a gateway data anomaly detection system provided by another embodiment of the present application.

[0044] Figure 3 This is a flowchart of a method for detecting anomalies in routing data based on RPKI provided in another embodiment of the present application.

[0045] Figure 4 yes Figure 3 Flow chart of step 302 in FIG.

[0046] Figure 5 yes Figure 3 Flow chart of step 303 in FIG.

[0047] Figure 6 yes Figure 3 Flow chart of step 304 in FIG.

[0048] Figure 7 yes Figure 6 Flowchart of step 602 in FIG.

[0049] Figure 8 This is a flowchart of performing routing origin authorization anomaly detection again provided by another embodiment of the present application.

[0050] Fig. 9 yes Figure 3 Flow chart of step 305 in FIG.

[0051] Fig.10 This is a flowchart of repairing abnormal gateway data provided by another embodiment of the present application.

[0052] Fig.11 This is a flowchart of a method for detecting anomalies in routing data based on RPKI provided in another embodiment of the present application.

[0053] Fig.12 It is a structural diagram of a routing data anomaly detection device based on RPKI provided in another embodiment of the present application.

[0054] Fig.13 This is a schematic diagram of the hardware structure of an electronic device provided in yet another embodiment of the present application. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0056] It should be noted that although the functional modules are divided in the device schematic and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart.

[0057] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0058] First, some nouns involved in this application are analyzed:

[0059] AS: Autonomous System. In the Internet, an autonomous system (AS) is a small unit that has the right to independently decide which routing protocols should be used in the system. This network unit can be a simple network or a network group controlled by one or more ordinary network administrators. It is a separate manageable network unit (such as a university, an enterprise or an individual company). An autonomous system is sometimes also called a routing domain. An autonomous system will be assigned a globally unique 16-bit number, which is sometimes called an autonomous system number (ASN).

[0060] RPKI: Resource Public Key Infrastructure. ISP network service providers can use RPKI to verify the source of BGP routes and the path of BGP routes. In order to resist the increasingly frequent and serious Internet route hijacking incidents, RPKI came into being. It helps routers verify the authenticity of BGP messages by issuing and authenticating a specific format of x.509 digital certificates and digital signatures, thereby enhancing the security of the BGP protocol and helping to avoid Internet route hijacking. The basic idea of ​​RPKI is to build a PKI (public key infrastructure) to complete the authentication of the ownership and use rights of IP address prefixes and AS numbers.

[0061] SLURM: Simplified Local internet number resource management, SLURM allows operators to create a global RPKI assertion set for origin authentication in json format. In this way, the origin authentication data of RPKI is divided into two parts, one part of the authentication data comes from the RPKI database, and the other part comes from the data in the SLURM file.

[0062] BGP (Border Gateway Protocol) is a network protocol running on TCP, which is mainly used to exchange routing information between network autonomous systems in order to determine efficient routing and realize information packet transmission in the Internet.

[0063] Route Origin Authorization (ROA) is a network security mechanism used to improve the security of Internet routing. As part of the RPKI system, ROA completes the authentication and binding of IP addresses and prefix resources. It is essentially a digital signature object. Anyone can verify whether the IP address block holder has authorized the AS relationship.

[0064] RP (RPKI Rely), called RPKI relying party, is essentially the RPKI verifier. It synchronizes the certificate data in the RPKI database and verifies the signature, and sends a batch of ROA data that has passed the verification to the BGP router. After BGP synchronizes this data, it can be used as a trusted data for routing filtering to prevent the risk of prefix hijacking.

[0065] Reference Figure 1 , is a schematic diagram of a resource public key infrastructure provided by an embodiment of the present application. Figure 1 As shown in , a resource public key infrastructure generally includes a plurality of certificate management units (such as Figure 1 The RPKI relies on the APNIC, CNNIC, ISP, etc. in the RPKI and the certificate issuance system composed of the APNIC, CNNIC, ISP, etc. in the RPKI, and the certificate storage system for storing the certificate resources of each certificate management unit (including the storage database corresponding to each certificate management unit, such as the APNIC database corresponding to APNIC, etc.). In addition, during the issuance of certificate resources, the RPKI relying party will also synchronize these certificate resource data to facilitate the transmission of authentication data to the autonomous system composed of multiple ASs for authentication during the use of resources, and use the corresponding network resources after the authentication is passed.

[0066] By using the Resource Public Key Infrastructure (RPKI), network operators can verify the legitimacy of routing information received from other network operators and reject untrusted routes. This helps reduce the risk of route hijacking and spoofing attacks and improves the security and stability of the Internet routing system. It should be noted that RPKI is a complex system that requires the cooperation of network operators, Internet service providers, and other relevant parties to achieve effective deployment and operation. It plays an important role in protecting the Internet routing system from malicious attacks.

[0067] When RPKI relying parties or network devices use network resources, a series of gateway data will be generated. In order to improve network security, gateway data anomaly detection is usually required.

[0068] Routing origin authorization anomaly detection is an important way to ensure data security in a network framework that supports resource public key infrastructure technology, and it is usually combined with gateway data anomalies. During network communication, the data flow through the gateway is monitored and analyzed to identify and mark data points or events that support resource public key infrastructure technology and do not conform to normal behavior patterns. This process is critical to maintaining network security and stability because it can help detect potential security threats, system failures or other abnormal behaviors in a timely manner.

[0069] In the related art, the route origin authorization anomaly detection for gateway data is generally to perform a prior anomaly allocation detection on the data related to the resource public key infrastructure resources, and obtain the route origin authorization anomaly detection situation based on the analysis results. However, since the actual route origin authorization anomaly detection situation includes many, only the prior allocation anomaly detection cannot quickly determine the actual route origin authorization situation of the gateway data in real time during the use of RPKI, and thus cannot perform corresponding repairs.

[0070] In order to improve the accuracy of routing origin authorization detection of gateway data and improve the reliability of repairing abnormal gateway data, in an embodiment of the present application, resource public key infrastructure technology analysis is performed on routing origin data in real-time gateway data to determine whether the real-time gateway data can support resource public key infrastructure technology, so as to facilitate further corresponding anomaly detection, and periodic detection is performed on routing origin data that can support resource public key infrastructure technology, thereby improving the accuracy of routing origin authorization anomaly detection of gateway data, and using reliable assertion replacement data corresponding to the routing origin data to replace the abnormal routing origin data, thereby improving the accuracy and reliability of repairing the abnormal gateway data.

[0071] The following will further describe the RPKI-based routing data anomaly detection method and related devices provided in the embodiments of the present application. In order to better explain the RPKI-based routing data anomaly detection method provided in the embodiments of the present application, this embodiment first describes a gateway data anomaly detection system of the present application. Figure 2 As shown in FIG. 1 , it is a schematic diagram of the structure of a gateway data anomaly detection system provided by an embodiment of the present application. Figure 2 As shown in , the gateway data anomaly detection system includes an RPKI subscription module, an RPKI detection module, and an RPKI assurance module. The RPKI subscription module is used to obtain BGP flow data (i.e., gateway data) and related data in the RPKI database in real time, and then uses the trusted BGP data to perform anomaly monitoring on the BGP flow data through the RPKI monitoring module. When abnormal BGP flow data is found, the abnormal BGP flow data is repaired through the RPKI assurance module using the trusted RPKI data to realize the automatic anomaly detection and repair process of the gateway data.

[0072] Among them, BGP flow data: provides BGP real-time data flow service and BGP data monitoring data source. RPKI database: provides real-time RPKI monitoring data source. RPKI subscription module: provides number resource subscription service, which can focus on monitoring the specified number resources and pay attention to the changes of number resources in the subscription list. RPKI monitoring module provides BGP and RPKI data change monitoring, and analyzes abnormal events and other information. Trusted BGP data: a trusted BGP authoritative data, including prefix and AS number information. The RPKI monitoring module uses trusted BGP data as the basis for determining BGP prefix hijacking events, providing authoritative support for determining prefix hijacking. The RPKI assurance module is essentially the RP relying party configuring local policies based on SLURM files to repair changed data. Trusted RPKI data defines another authoritative data in addition to the RPKI database, providing trusted data support for the RPKI assurance module to formulate SLURM repair files.

[0073] based on Figure 2 The gateway data anomaly detection system shown, the routing data anomaly detection method based on RPKI in the embodiment of the present application will be described in detail below. The routing data anomaly detection method based on RPKI provided in the embodiment of the present application is applied to the gateway data anomaly detection system, and the gateway data anomaly detection system can be set in any server or network processor, etc.

[0074] Reference Figure 3 , which is an optional flowchart of the RPKI-based routing data anomaly detection method provided in an embodiment of the present application, Figure 3 The method in the embodiment may include but is not limited to steps 301 to 305. Figure 3 The order of step 301 to step 305 is not specifically limited, and the order of steps can be adjusted or some steps can be reduced or added according to actual needs.

[0075] Step 301: Obtain routing origin data from real-time gateway data.

[0076] Step 301 is described in detail below.

[0077] In some embodiments, after responding to the abnormal detection of the gateway data, the real-time gateway data (i.e., BGP flow information) generated by executing the Border Gateway Protocol (BGP) is obtained from the network system in real time, and then the required route origin data is obtained from these real-time gateway data. It can be understood that the route origin data usually includes the IP address prefix information, autonomous system number (AS number), etc. of the BGP flow information, so as to facilitate the subsequent use of these route origin data to perform abnormal detection on the real-time gateway data to improve the security of the network system.

[0078] Step 302: Perform resource public key infrastructure technical analysis on the routing origin data to obtain a resource public key infrastructure technical analysis result.

[0079] Step 302 is described in detail below.

[0080] In some embodiments, after obtaining the routing origin data, in order to accurately detect anomalies on it, it is necessary to first perform resource public key infrastructure technology analysis, i.e., RPKI analysis, on it to determine whether the real-time gateway data supports resource public key technology infrastructure (RPKI) technology, so as to facilitate the subsequent anomaly detection analysis based on the obtained resource public key infrastructure technology analysis results. The following will further describe how to perform resource public key infrastructure technology analysis.

[0081] Reference Figure 4 , performing resource public key infrastructure technical analysis on the routing origin data to obtain a resource public key infrastructure technical analysis result, including the following steps 401 to 402.

[0082] Step 401: Obtain the target code number identifier corresponding to the routing origin data.

[0083] Step 402: Match the target code number identifier with multiple code number identifiers in the resource public key infrastructure database, and obtain a resource public key infrastructure technical analysis result based on the matching result.

[0084] Steps 401 to 402 are described in detail below.

[0085] In some embodiments, after obtaining the routing origin data, first obtain the corresponding target code number identifier (i.e., the corresponding IP prefix information and AS number) from the routing origin data. Then, obtain the corresponding target code number identifier (i.e., the corresponding IP prefix information and AS number) from the resource public key infrastructure database (i.e., Figure 2 The multiple RPKI data information (including the code number identifier and the associated routing origin authorization ROA data corresponding to the RPKI data information) stored in the RPKI database shown in the figure are matched, that is, the target code number identifier is matched with the code number identifier corresponding to the multiple RPKI data information; if a match is obtained, it means that the routing origin data corresponding to the real-time gateway data has corresponding ROA data, and the resource public key infrastructure technology can be supported; if no match is found, it means that the routing origin data corresponding to the real-time gateway data does not have corresponding ROA data, and the resource public key infrastructure technology cannot be supported, and then the corresponding resource public key infrastructure technology parsing result is generated according to the actual matching result.

[0086] Through the above steps 401 to 402, by matching the code number identifiers corresponding to multiple RPKI data information in the resource public key infrastructure database with the target code number identifiers corresponding to the implementation code number data, it is possible to quickly and accurately determine whether the routing origin data supports the resource public key infrastructure technology analysis results of the resource public key technology facility technology, thereby facilitating subsequent corresponding anomaly detection based on different resource public key infrastructure technology analysis results to improve the accuracy of gateway data anomaly detection.

[0087] Step 303: When the resource public key infrastructure technology analysis result indicates that the real-time gateway data does not support the resource public key infrastructure technology, a gateway prefix hijacking detection is performed on the routing origin data to obtain a gateway prefix anomaly detection result.

[0088] Step 303 is described in detail below.

[0089] In some embodiments, when the resource public key infrastructure technical analysis result obtained indicates that there is no code number identifier corresponding to the target code number identifier in the route origin data in the resource public key infrastructure database, it means that the route origin data does not support the resource public key infrastructure technology. At this time, the route origin data will be subjected to a Border Gateway Protocol (BGP) anomaly detection to obtain a gateway prefix anomaly detection result corresponding to this situation, as described below.

[0090] Reference Figure 5 , performing gateway prefix hijacking detection on the routing origin data to obtain a gateway prefix anomaly detection result, including the following steps 501 to 502.

[0091] Step 501: Obtain routing origin data from real-time gateway data.

[0092] Step 502: Match the route origin data with the authoritative data in the Internet resource database to obtain a gateway prefix anomaly detection result.

[0093] Steps 501 to 502 are described in detail below.

[0094] In some embodiments, when the resource public key infrastructure technology analysis result indicates that the route origin data does not support the resource public key infrastructure technology, the route origin data (i.e., IP address prefix data) is obtained from the real-time gateway data. Then, a trusted Internet resource database (such as whois, etc.) is used to monitor and analyze the BGP routing information of the real-time gateway data, that is, the route origin data is matched with all the authoritative data in the Internet resource database to determine whether the route origin data can be completely matched with a certain authoritative data. Then, based on the matching result, a gateway prefix anomaly detection result is obtained to determine whether a suspected BGP hijacking event has occurred, that is, by comparing the AS autonomous system to which the prefix belongs with a copy of the authoritative data, if the AS number to which the prefix belongs in the BGP data is different from the AS number of the authoritative data (non-path matching), it is considered as prefix hijacking.

[0095] Through the above steps 501 to 502, in the case where the routing origin data does not support the resource public key infrastructure technology, the code prefix data corresponding to the routing origin data is matched and detected using a trusted Internet resource database, so that the gateway prefix anomaly detection result in this case can be accurately obtained, thereby improving the accuracy of gateway data anomaly detection.

[0096] Step 304: When the resource public key infrastructure technology analysis result indicates that the real-time gateway data supports the resource public key infrastructure technology, a routing origin authorization anomaly detection is performed on the routing origin data to obtain a routing anomaly detection result, and a routing origin authorization anomaly detection is performed again on the routing origin data after a preset detection period.

[0097] Step 304 is described in detail below.

[0098] In some embodiments, when the resource public key infrastructure technical analysis result obtained indicates that there is a code number identifier corresponding to the target code number identifier in the routing origin data in the resource public key infrastructure database, it means that the routing origin data supports the resource public key infrastructure technology. At this time, the routing origin data will be subjected to routing origin authorization ROA anomaly detection to obtain the corresponding routing anomaly detection result, as described below.

[0099] Reference Figure 6 , performing routing origin authorization anomaly detection on routing origin data to obtain routing anomaly detection results, including the following steps 601 to 603.

[0100] Step 601: Obtain routing origin authorization data of real-time gateway data and the number of routing origin authorization data corresponding to the routing origin authorization data.

[0101] Step 602: When there are multiple routing origin authorization data, perform attribution association detection on the multiple routing origin authorization data to obtain a routing anomaly detection result.

[0102] Steps 601 to 602 are described in detail below.

[0103] In some embodiments, when the resource public key infrastructure technology analysis result indicates that the routing origin data supports the resource public key infrastructure technology, all the routing origin authorization data (i.e., ROA data) of the real-time gateway data and the corresponding number of ROA data (i.e., the number of routing origin authorization data) are first obtained.

[0104] When it is determined that there are multiple routing origin authorization data, attribution association detection is performed on the multiple routing origin authorization data to obtain corresponding routing anomaly detection results, as described in detail below.

[0105] Reference Figure 7 , performing attribution association detection on multiple routing origin authorization data to obtain routing anomaly detection results, including the following steps 701 to 703.

[0106] Step 701: Obtain the authorization agency of each routing origin authorization data, and obtain the agency association chain of each authorization agency.

[0107] Step 702: When all authorized institutions belong to the same institution association chain, a routing origin authorization change detection is performed on multiple routing origin authorization data to obtain a routing anomaly detection result.

[0108] Step 703: When there are at least two authorized institutions that do not belong to the same institution association chain, a routing anomaly detection result is generated to indicate that there is an anomaly in the routing origin data.

[0109] Steps 701 to 703 are described in detail below.

[0110] In some embodiments, when it is determined that the number of route origin authorization data corresponding to the real-time gateway data is multiple, a conflict detection is performed on the multiple route origin authorization data to obtain the corresponding route anomaly detection result. Specifically, the authorization agency corresponding to each route origin authorization data is obtained, and the agency association chain corresponding to each authorization agency is obtained (such as Figure 1As shown in APNIC-CNNIC-SIP-AS2), when all authorized institutions belong to the same institutional association chain, it means that these multiple routing origin authorization data are associated in the same institutional relationship chain, that is, they are compliant. At this time, the multiple routing origin authorization data will be further subjected to routing origin authorization change detection to detect whether the routing origin authorization data (ROA data) has changed, that is, whether the AS value of the prefix data corresponding to the routing origin authorization data has changed. If it has changed, it is judged that the real-time gateway data has a suspected ROA tampering event; correspondingly, if it has not changed, it is judged that the real-time gateway data is normal, thereby generating the corresponding routing anomaly detection result according to the corresponding change situation.

[0111] When there are at least two authorized agencies that do not belong to the same agency association chain, it means that an authorized agency in a different agency relationship chain has processed the real-time gateway data in conflict. This is non-compliant and will be identified as a suspected ROA injection event. A routing anomaly detection result is generated to characterize the existence of an anomaly in the routing origin data.

[0112] Step 603: When the number of the routing origin authorization data is one, perform routing origin authorization change detection on the routing origin authorization data to obtain a routing anomaly detection result.

[0113] Step 603 is described in detail below.

[0114] In some embodiments, when the number of routing origin authorization data is one, a routing origin authorization change detection is directly performed on the routing origin authorization data, that is, whether the routing origin authorization data (ROA data) has changed, that is, whether the AS value of the prefix data corresponding to the routing origin authorization data has changed. If a change has occurred, it is determined that a suspected ROA tampering event has occurred in the real-time gateway data; correspondingly, if no change has occurred, it is determined that the real-time gateway data is normal, thereby generating a corresponding routing anomaly detection result based on the corresponding change situation.

[0115] Through the above steps 601 to 603 and 701 to 703, for the case where the routing origin data supports the resource public key infrastructure technology, and when the number of routing origin authorization data corresponding to the real-time gateway data is multiple, conflict detection is performed to determine whether an abnormal situation of ROA injection has occurred, and then the routing origin authorization data is further subjected to routing origin authorization change detection to determine whether a suspected ROA tampering event has occurred, thereby performing corresponding detection and judgment according to different situations, thereby obtaining accurate routing anomaly detection results.

[0116] In some embodiments, in the case where routing origin data supports resource public key infrastructure technology, in order to further improve the accuracy of gateway data anomaly detection, after performing routing origin authorization anomaly detection on real-time gateway data, routing origin authorization anomaly detection is performed again on the routing origin data after a preset period, as described below.

[0117] Reference Figure 8 After the routing origin authorization anomaly detection is performed again on the routing origin data after a preset detection period, the routing data anomaly detection method based on RPKI also includes the following steps 801 to 802.

[0118] Step 801: when the routing origin authorization data corresponding to the routing origin data cannot be detected, a revocation matching result is obtained by matching multiple code number identifiers in the routing certificate revocation list based on the target code number identifier.

[0119] Step 802: Based on the revocation matching result, a routing anomaly detection result for characterizing anomalies in routing origin authorization data is generated.

[0120] Steps 801 to 802 are described in detail below.

[0121] In some embodiments, after the routing origin data is again detected for routing origin authorization anomalies after a preset detection period, if the routing origin authorization data (ROA data) corresponding to the original routing origin data cannot be detected, a plurality of recent ROA revocation data information from the routing certificate revocation list in the resource public key facility database will be matched, that is, the target code number identifier corresponding to the real-time gateway data will be matched with the code number identifiers corresponding to the plurality of ROA revocation data information to obtain a revocation matching result.

[0122] When the revocation matching result indicates that there is a code number identifier that matches the target code number identifier in the certificate revocation list, it means that the route origin authorization data (ROA data) has been revoked. At this time, it is determined that a suspected ROA revocation event has occurred, and a route anomaly detection result for characterizing the abnormality of the route origin authorization data is generated. When the revocation matching result indicates that there is no code number identifier that matches the target code number identifier in the certificate revocation list, it means that an abnormality has occurred in the route origin authorization data (ROA data). At this time, it is determined that a suspected ROA deletion / destruction / suppression event has occurred, and a route anomaly detection result for characterizing the abnormality of the route origin authorization data is generated.

[0123] Through the above steps 801 to 802, the routing origin data supports resource public key infrastructure technology and performs repeated detection. If the routing origin authorization data disappears, the certificate revocation list is used for detection and matching to accurately obtain the routing anomaly detection result corresponding to the situation, thereby improving the accuracy of gateway data anomaly detection.

[0124] Step 305: Based on the gateway prefix anomaly detection result or the route anomaly detection result, obtain assertion replacement data corresponding to the route origin data, and repair the route origin data based on the assertion replacement data.

[0125] Step 305 is described in detail below.

[0126] In some embodiments, after performing corresponding gateway prefix hijacking detection or routing origin authorization anomaly detection on the real-time gateway data based on the resource public key infrastructure technology analysis results to obtain the corresponding gateway prefix anomaly detection result or routing anomaly detection result, when the gateway prefix anomaly detection result or the routing anomaly detection result indicates that an abnormal situation has occurred in the real-time gateway data, in order to improve the security and reliability of the network system, it is necessary to obtain assertion replacement data corresponding to the routing origin data, and repair the routing origin data based on the assertion replacement data, as described below.

[0127] Reference Fig. 9 , based on the gateway prefix anomaly detection result or the routing anomaly detection result, obtaining the assertion replacement data corresponding to the routing origin data, and repairing the routing origin data based on the assertion replacement data, including the following steps 901 to 903.

[0128] Step 901: When the gateway prefix anomaly detection result or the route anomaly detection result indicates that the route origin data is abnormal, prefix data filtering is performed on the real-time gateway data to obtain filtering code number data.

[0129] Step 902: Obtain assertion replacement data corresponding to the filter code number data from the authoritative database.

[0130] Step 903: Replace the resource public key data information corresponding to the real-time gateway data in the resource public key infrastructure database based on the assertion replacement data.

[0131] Steps 901 to 903 are described in detail below.

[0132] In some embodiments, when the gateway prefix anomaly detection result or the route anomaly detection result indicates that the route origin data is abnormal, the SLURM strategy can be used to repair it. The repair data of the SLURM strategy comes from a third-party trusted authoritative database (e.g. Figure 2The trusted RPKI data shown in ), based on this authoritative database, generates a SLURM file and deploys it to the RP-side relying party, then these abnormal data events can be repaired. Specifically, the routing origin data corresponding to the real-time gateway data is prefix filtered to filter out the prefix data of the real-time gateway data, and obtain the filtering code number data of the fixed data in the remaining real-time gateway data. Then, the assertion replacement data corresponding to the filtering code number data is obtained from the authoritative database of a third party, and then the corresponding SLURM file is generated according to the assertion replacement data, and the resource public key data information corresponding to the original real-time gateway data in the resource public key infrastructure database is replaced based on the SLURM file to realize the repair process.

[0133] Reference Fig.10 , is a flow chart of repairing abnormal gateway data provided by an embodiment of the present application. Fig.10 As shown in , the specific guarantee process for abnormal real-time gateway data is as follows: SLURM data consists of two parts: filtering data and assertion data. A filtering data is generated according to the number resources that need to be repaired (i.e., abnormal real-time gateway data), and a corresponding assertion data is generated according to the local authoritative data. Then, a SLURM policy file in JSON format is generated according to the SLURM policy generation module, and the file is uploaded to the RPKI relying party. In addition to synchronizing the database data, the RPKI relying party filters the data according to the SLURM file and replaces the number resources in the database with the assertion data in SLURM. Then it is organized into a trusted data and provided to the BGP autonomous system to complete the repair process here.

[0134] Through the above steps 901 to 903, local authoritative data is used to generate assertion replacement data corresponding to the real-time gateway data with an exception, and direct replacement repair is performed without the need for a complex process of targeted repair for different abnormal situations, thereby improving the efficiency of gateway data exception repair and improving the security and reliability of the gateway data transmission process.

[0135] Reference Fig.11 , is a schematic flow chart of a method for detecting anomalies in routing data based on RPKI provided in an embodiment of the present application. Fig.11As shown in , the gateway data anomaly detection system obtains BGP flow information (i.e., real-time gateway data) in real time through resource subscription, and then performs RPKI parsing to determine whether there is ROA data. When there is no ROA data, it proves that the BGP flow information does not support the resource public key infrastructure technology. At this time, its prefix hijacking detection is performed and the corresponding anomaly detection result is obtained; when there is ROA data, it proves that the BGP flow information supports the resource public key infrastructure technology. At this time, it will be further determined whether there are multiple ROA data. If there are multiple ROA data, conflict detection will be performed first to obtain the corresponding conflict detection result; if there is only one ROA data or the conflict detection result is correct, ROA changes will be further detected. If ROA changes, the corresponding anomaly detection result is generated. If ROA disappears, the CRL list is used to query to obtain the corresponding anomaly detection result. Finally, the local authoritative data is used to generate the assertion replacement data corresponding to the abnormal BGP flow information for ALURM repair to ensure the security and reliability of the network system.

[0136] The RPKI-based routing data anomaly detection method and related equipment proposed in the embodiment of the present application include: first, obtaining routing origin data from real-time gateway data; then, obtaining a target code number identifier corresponding to the routing origin data, matching the target code number identifier with multiple code number identifiers in a resource public key infrastructure database, and obtaining a resource public key infrastructure technical analysis result based on the matching result, wherein the code number identifier is associated with routing origin authorization data; then, when the resource public key infrastructure technical analysis result indicates that the real-time gateway data does not support the resource public key infrastructure technology, obtaining the routing origin data from the real-time gateway data, matching the routing origin data with the authoritative data in the Internet resource database, and obtaining a gateway prefix anomaly detection result; thereafter, when the resource public key infrastructure technical analysis result indicates that the real-time gateway data supports the resource public key infrastructure technology, obtaining the routing origin authorization data of the real-time gateway data and the number of routing origin authorization data corresponding to the routing origin authorization data, and when the number of routing origin authorization data is multiple, obtaining the authorization agency of each routing origin authorization data, and obtaining the agency association chain of each authorization agency, when all authorization agencies belong to the same agency association chain In the chain, a plurality of routing origin authorization data are subjected to routing origin authorization change detection to obtain routing anomaly detection results. When there are at least two authorization agencies that do not belong to the same agency association chain, a routing anomaly detection result is generated to characterize that the routing origin data has an anomaly. When the number of routing origin authorization data is one, a routing origin authorization change detection is performed on the routing origin authorization data to obtain a routing anomaly detection result. After a preset detection period, a routing origin authorization anomaly detection is performed again on the routing origin data. When the routing origin authorization data corresponding to the routing origin data cannot be detected, a plurality of code number identifiers are matched from a routing certificate revocation list based on a target code number identifier to obtain a revocation matching result. Based on the revocation matching result, a routing anomaly detection result is generated to characterize that the routing origin authorization data is anomaly. Finally, when the gateway prefix anomaly detection result or the routing anomaly detection result characterizes that the routing origin data is anomaly, prefix data filtering is performed on the real-time gateway data to obtain filtered code number data, and assertion replacement data corresponding to the filtered code number data is obtained from the authoritative database. The resource public key data information corresponding to the real-time gateway data in the resource public key infrastructure database is replaced based on the assertion replacement data.

[0137] In the embodiment of the present application, by matching the code number identifiers corresponding to multiple RPKI data information in the resource public key infrastructure database with the target code number identifiers corresponding to the implementation code number data, it is possible to quickly and accurately determine whether the route origin data supports the resource public key infrastructure technology facility technology resource public key infrastructure technology analysis results, thereby facilitating subsequent corresponding anomaly detection according to different resource public key infrastructure technology analysis results to improve the accuracy of gateway data anomaly detection; and, for the case where the route origin data does not support the resource public key infrastructure technology, the code number prefix data corresponding to the route origin data and the autonomous system path are matched and detected using a trusted Internet resource database, so that the gateway prefix anomaly detection result in this case can be accurately obtained, thereby improving the accuracy of gateway data anomaly detection; and, for the case where the route origin data supports the resource public key infrastructure technology, when the number of route origin authorization data corresponding to the real-time gateway data is multiple, conflict detection is performed to determine whether an abnormal situation of ROA injection has occurred, and then the route origin authorization data is further subjected to route origin authorization change detection to determine whether a suspected ROA tampering event has occurred, thereby performing corresponding detection and judgment according to different situations, Thus, accurate routing anomaly detection results can be obtained; in addition, for the routing origin data that supports resource public key infrastructure technology and performs repeated detection, and the routing origin authorization data disappears, the certificate revocation list is used for detection and matching to accurately obtain the routing anomaly detection results corresponding to the situation, thereby improving the accuracy of gateway data anomaly detection; in addition, the local authoritative data is used to generate assertion replacement data corresponding to the real-time gateway data with anomalies, and directly replace and repair, without the need for a complex process of targeted repair for different anomalies, thereby improving the efficiency of gateway data anomaly repair and improving the security and reliability of gateway data transmission; in short, the routing origin data in the real-time gateway data is parsed by the resource public key infrastructure technology to determine whether the real-time gateway data can support the resource public key infrastructure technology, so as to further perform corresponding anomaly detection, and the routing origin data that can support the resource public key infrastructure technology is periodically detected, thereby improving the accuracy of gateway data anomaly detection, and the reliable assertion replacement data corresponding to the routing origin data is used to replace the routing origin data with anomalies, thereby improving the accuracy and reliability of abnormal gateway data repair.

[0138] The embodiment of the present application also provides a routing data anomaly detection device based on RPKI, which can implement the above-mentioned routing data anomaly detection method based on RPKI, referring to Fig.12 , the device 1200 comprises:

[0139] The code number data acquisition module 1210 is used to obtain the routing origin data from the real-time gateway data;

[0140] The resource technology analysis module 1220 is used to perform resource public key infrastructure technology analysis on the routing origin data to obtain a resource public key infrastructure technology analysis result;

[0141] The gateway anomaly detection module 1230 is used to perform gateway prefix hijacking detection on the routing origin data to obtain a gateway prefix anomaly detection result when the resource public key infrastructure technology analysis result indicates that the real-time gateway data does not support the resource public key infrastructure technology;

[0142] The routing detection module 1240 is used to perform routing origin authorization anomaly detection on the routing origin data when the resource public key infrastructure technology analysis result indicates that the real-time gateway data supports the resource public key infrastructure technology, obtain the routing anomaly detection result, and perform routing origin authorization anomaly detection on the routing origin data again after a preset detection period;

[0143] The repair module 1250 is used to obtain assertion replacement data corresponding to the route origin data based on the gateway prefix anomaly detection result or the route anomaly detection result, and repair the route origin data based on the assertion replacement data.

[0144] In some embodiments, the resource technology parsing module 1220 is further used to:

[0145] Obtain the target code number identifier corresponding to the routing origin data;

[0146] Based on matching the target code number identifier with multiple code number identifiers in the resource public key infrastructure database, and obtaining the resource public key infrastructure technical analysis result based on the matching result, the code number identifier is associated with the routing origin authorization data.

[0147] In some embodiments, the gateway anomaly detection module 1230 is further configured to:

[0148] Obtain route origin data from real-time gateway data;

[0149] The routing origin data is matched with the authoritative data in the Internet resource database to obtain the gateway prefix anomaly detection results.

[0150] In some embodiments, the route detection module 1240 is further configured to:

[0151] Obtain routing origin authorization data of routing origin data and the number of routing origin authorization data corresponding to the routing origin authorization data;

[0152] When there are multiple routing origin authorization data, the multiple routing origin authorization data are subjected to attribution association detection to obtain a routing anomaly detection result;

[0153] When the number of route origin authorization data is one, a route origin authorization change detection is performed on the route origin authorization data to obtain a route anomaly detection result.

[0154] In some embodiments, the route detection module 1240 is further configured to:

[0155] Obtain the authorization agency of each routing origin authorization data, and obtain the agency association chain of each authorization agency;

[0156] When all authorized institutions belong to the same institution association chain, a routing origin authorization change detection is performed on multiple routing origin authorization data to obtain routing anomaly detection results;

[0157] When there are at least two authorized institutions that do not belong to the same institution association chain, a routing anomaly detection result is generated to characterize that there is an anomaly in the routing origin data.

[0158] In some embodiments, the route detection module 1240 is further configured to:

[0159] When the routing origin authorization data corresponding to the routing origin data cannot be detected, a revocation matching result is obtained by matching multiple code number identifiers from the routing certificate revocation list based on the target code number identifier;

[0160] Based on the revocation matching result, a routing anomaly detection result for characterizing anomalies in routing origin authorization data is generated.

[0161] In some embodiments, the repair module 1250 is further configured to:

[0162] When the gateway prefix anomaly detection result or the route anomaly detection result indicates that the route origin data is abnormal, the real-time gateway data is prefix filtered to obtain the filtered code number data;

[0163] Obtain assertion replacement data corresponding to the filter code number data from the authoritative database;

[0164] The resource public key data information corresponding to the real-time gateway data in the resource public key infrastructure database is replaced based on the assertion replacement data.

[0165] In the above embodiments, the description of each embodiment has its own emphasis. For the part that is not described in detail in a certain embodiment, the specific implementation of the routing data anomaly detection device based on RPKI is basically the same as the specific implementation of the routing data anomaly detection method based on RPKI, and will not be repeated here.

[0166] In the embodiment of the present application, by matching the code number identifiers corresponding to multiple RPKI data information in the resource public key infrastructure database with the target code number identifiers corresponding to the implementation code number data, it is possible to quickly and accurately determine whether the route origin data supports the resource public key infrastructure technology facility technology resource public key infrastructure technology analysis results, thereby facilitating subsequent corresponding anomaly detection according to different resource public key infrastructure technology analysis results to improve the accuracy of gateway data anomaly detection; and, for the case where the route origin data does not support the resource public key infrastructure technology, the code number prefix data corresponding to the route origin data and the autonomous system path are matched and detected using a trusted Internet resource database, so that the gateway prefix anomaly detection result in this case can be accurately obtained, thereby improving the accuracy of gateway data anomaly detection; and, for the case where the route origin data supports the resource public key infrastructure technology, when the number of route origin authorization data corresponding to the real-time gateway data is multiple, conflict detection is performed to determine whether an abnormal situation of ROA injection has occurred, and then the route origin authorization data is further subjected to route origin authorization change detection to determine whether a suspected ROA tampering event has occurred, thereby performing corresponding detection and judgment according to different situations, Thus, accurate routing anomaly detection results can be obtained; in addition, for the routing origin data that supports resource public key infrastructure technology and performs repeated detection, and the routing origin authorization data disappears, the certificate revocation list is used for detection and matching to accurately obtain the routing anomaly detection results corresponding to the situation, thereby improving the accuracy of gateway data anomaly detection; in addition, the local authoritative data is used to generate assertion replacement data corresponding to the real-time gateway data with anomalies, and directly replace and repair, without the need for a complex process of targeted repair for different anomalies, thereby improving the efficiency of gateway data anomaly repair and improving the security and reliability of gateway data transmission; in short, the routing origin data in the real-time gateway data is parsed by the resource public key infrastructure technology to determine whether the real-time gateway data can support the resource public key infrastructure technology, so as to further perform corresponding anomaly detection, and the routing origin data that can support the resource public key infrastructure technology is periodically detected, thereby improving the accuracy of gateway data anomaly detection, and the reliable assertion replacement data corresponding to the routing origin data is used to replace the routing origin data with anomalies, thereby improving the accuracy and reliability of abnormal gateway data repair.

[0167] The present application also provides an electronic device, including:

[0168] at least one memory;

[0169] at least one processor;

[0170] at least one program;

[0171] The program is stored in the memory, and the processor executes the at least one program to implement the above-mentioned RPKI-based routing data anomaly detection method implemented in this application. The electronic device can be any intelligent terminal including a mobile phone, a tablet computer, a personal digital assistant (PDA), a car computer, etc.

[0172] See also Fig.13 , Fig.13 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0173] The processor 1301 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0174] The memory 1302 can be implemented in the form of ROM (Read Only Memory), static storage device, dynamic storage device or RAM (Random Access Memory). The memory 1302 can store operating systems and other applications. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1302, and the processor 1301 calls and executes the RPKI-based routing data anomaly detection method in the embodiments of this application;

[0175] Input / output interface 1303, used to implement information input and output;

[0176] The communication interface 1304 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0177] A bus 1305 that transmits information between the various components of the device (e.g., the processor 1301, the memory 1302, the input / output interface 1303, and the communication interface 1304);

[0178] The processor 1301 , the memory 1302 , the input / output interface 1303 and the communication interface 1304 are connected to each other in communication within the device via a bus 1305 .

[0179] An embodiment of the present application further provides a storage medium, which is a computer-readable storage medium. The storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned RPKI-based routing data anomaly detection method is implemented.

[0180] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0181] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0182] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0183] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0184] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0185] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0186] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0187] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. The mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0188] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0189] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0190] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0191] The preferred embodiments of the present application are described above with reference to the accompanying drawings, but the scope of the rights of the present application is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present application should be within the scope of the rights of the present application.

Claims

1. A method for detecting anomalies in routing data based on RPKI, characterized in that: The method comprises: Obtain route origin data from real-time gateway data; Performing resource public key infrastructure technical analysis on the routing origin data to obtain a resource public key infrastructure technical analysis result; When the resource public key infrastructure technology analysis result indicates that the real-time gateway data does not support the resource public key infrastructure technology, performing a gateway prefix hijacking detection on the routing origin data to obtain a gateway prefix anomaly detection result; When the resource public key infrastructure technology analysis result indicates that the real-time gateway data supports the resource public key infrastructure technology, performing a routing origin authorization anomaly detection on the routing origin data to obtain a routing anomaly detection result, and performing the routing origin authorization anomaly detection on the routing origin data again after a preset detection period; Based on the gateway prefix anomaly detection result or the route anomaly detection result, assertion replacement data corresponding to the route origin data is acquired, and the route origin data is repaired based on the assertion replacement data.

2. The RPKI-based routing data anomaly detection method according to claim 1, characterized in that: The performing resource public key infrastructure technology analysis on the routing origin data to obtain a resource public key infrastructure technology analysis result includes: Obtaining a target code number identifier corresponding to the routing origin data; Based on matching the target code number identifier with multiple code number identifiers in a resource public key infrastructure database, and obtaining the resource public key infrastructure technical analysis result based on the matching result, the code number identifier is associated with routing origin authorization data.

3. The RPKI-based routing data anomaly detection method according to claim 1, characterized in that: The performing gateway prefix hijacking detection on the routing origin data to obtain a gateway prefix anomaly detection result includes: Obtaining routing origin data from the real-time gateway data; The routing origin data is matched with the authoritative data in the Internet resource database to obtain the aforementioned gateway prefix anomaly detection result.

4. The method for detecting anomalies in routing data based on RPKI according to claim 1, characterized in that: The performing routing origin authorization anomaly detection on the routing origin data to obtain a routing anomaly detection result includes: Obtaining the routing origin authorization data of the real-time gateway data and the number of routing origin authorization data corresponding to the routing origin authorization data; When there are multiple routing origin authorization data, performing attribution association detection on the multiple routing origin authorization data to obtain the routing anomaly detection result; When the number of the routing origin authorization data is one, a routing origin authorization change detection is performed on the routing origin authorization data to obtain the routing anomaly detection result.

5. The RPKI-based routing data anomaly detection method according to claim 4, characterized in that: The performing attribution association detection on the plurality of routing origin authorization data to obtain the routing anomaly detection result includes: Obtaining the authorization agency of each of the routing origin authorization data, and obtaining the agency association chain of each of the authorization agencies; When all the authorization agencies belong to the same agency association chain, performing routing origin authorization change detection on a plurality of routing origin authorization data to obtain the routing anomaly detection result; When there are at least two authorized institutions that do not belong to the same institution association chain, a routing anomaly detection result is generated to indicate that an anomaly exists in the routing origin data.

6. The method for detecting anomalies in routing data based on RPKI according to claim 2, characterized in that: After the routing origin authorization anomaly detection is performed again on the routing origin data after a preset detection period, the method further includes: When the routing origin authorization data corresponding to the routing origin data cannot be detected, matching multiple code number identifiers from the routing certificate revocation list based on the target code number identifier to obtain a revocation matching result; Based on the revocation matching result, a routing anomaly detection result for characterizing the anomaly of the routing origin authorization data is generated.

7. The method for detecting anomalies in routing data based on RPKI according to claim 1, characterized in that: The acquiring, based on the gateway prefix anomaly detection result or the routing anomaly detection result, assertion replacement data corresponding to the routing origin data, and repairing the routing origin data based on the assertion replacement data, comprises: When the gateway prefix anomaly detection result or the route anomaly detection result indicates that the route origin data is abnormal, prefix data filtering is performed on the real-time gateway data to obtain filtering code number data; Acquire the assertion replacement data corresponding to the filter code number data from an authoritative database; The resource public key data information corresponding to the real-time gateway data in the resource public key infrastructure database is replaced based on the assertion replacement data.

8. A routing data anomaly detection device based on RPKI, characterized in that: The device comprises: A code number data acquisition module is used to obtain routing origin data from real-time gateway data; A resource technology analysis module, used for performing resource public key infrastructure technology analysis on the routing origin data to obtain a resource public key infrastructure technology analysis result; A gateway anomaly detection module, configured to perform a gateway prefix hijacking detection on the routing origin data to obtain a gateway prefix anomaly detection result when the resource public key infrastructure technology analysis result indicates that the real-time gateway data does not support the resource public key infrastructure technology; A routing detection module, for performing routing origin authorization anomaly detection on the routing origin data to obtain a routing anomaly detection result when the resource public key infrastructure technology analysis result indicates that the real-time gateway data supports the resource public key infrastructure technology, and performing the routing origin authorization anomaly detection on the routing origin data again after a preset detection period; A repair module is used to obtain assertion replacement data corresponding to the routing origin data based on the gateway prefix anomaly detection result or the routing anomaly detection result, and repair the routing origin data based on the assertion replacement data.

9. An electronic device, characterized in that: The invention comprises a memory and a processor, wherein the memory stores a computer program, and the processor implements the RPKI-based routing data anomaly detection method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the RPKI-based routing data anomaly detection method according to any one of claims 1 to 7 is implemented.

Images