Routing protocol security detection method and device, equipment and storage medium

Abstract

The embodiment of the invention provides a routing protocol security detection method and device, equipment and a storage medium, and relates to the technical field of network security. The method comprises the following steps: acquiring a plurality of routing protocol data from a data source, generating routing detection information according to the routing protocol data, writing the routing detection information into a Kafka server, acquiring event stream data in real time in the Kafka server, performing routing network registration information detection on the event stream data by using a preset detection instruction to obtain a routing registration detection result, and sending the routing registration detection result to the Kafka server. And performing field validity verification on the event stream data by using an RPKI verifier to obtain a validity verification result. And if the routing registration detection result and the validity verification result both indicate that the detection field is abnormal, obtaining abnormal routing information according to the routing protocol data corresponding to the detection field. A stream processing mechanism is utilized, a large amount of routing protocol data in a data source is aggregated into a plurality of events, the data volume of actual detection is reduced based on event stream service, the purpose of rapid detection is achieved, and meanwhile the detection accuracy is improved through dual detection.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a routing protocol security detection method, device, equipment and storage medium. Background Art

[0002] Border Gateway Protocol (BGP) is the core routing protocol of the Internet, responsible for exchanging routing information between different autonomous systems (AS). However, given the complexity of the network environment and potential security threats, BGP data may have abnormalities, such as routing hijacking. These abnormal events may cause network traffic to be redirected incorrectly, and in severe cases may even cause large-scale network failures. Therefore, real-time monitoring of BGP data for abnormalities is very important for maintaining network stability and security.

[0003] Related technologies mainly use judgment rules or neural network models to detect anomalies. However, the judgment rule detection method is prone to misjudgment and poor detection effectiveness; while the neural network model detection method has the problems of high complexity, high requirements for computing equipment, and long detection time, which does not meet the needs of real-time monitoring. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to propose a routing protocol security detection method, device, equipment and storage medium to improve the detection efficiency while ensuring the effectiveness of the detection.

[0005] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application proposes a routing protocol security detection method, comprising:

[0006] Acquire multiple routing protocol data from a data source, and generate routing detection information according to at least one detection field in the routing protocol data and write it into a Kafka server;

[0007] Acquire event stream data in real time in the Kafka server, wherein the event stream data is obtained based on at least one of the routing detection information contained in a preset event period;

[0008] Using a preset detection instruction to detect the detection field in the event stream data, the routing network registration information is detected to obtain a routing registration detection result;

[0009] Using the RPKI validator to perform field validity verification on the detection field in the event stream data to obtain a validity verification result;

[0010] If both the routing registration detection result and the validity verification result indicate that the detection field is abnormal, abnormal routing information is obtained according to routing protocol data corresponding to the detection field.

[0011] In some embodiments, generating routing detection information according to at least one detection field in the routing protocol data and writing it into a Kafka server includes:

[0012] Obtaining the IP prefix field and the autonomous domain number field in the routing protocol data as the detection field, and obtaining a JSON string according to the detection field;

[0013] Obtaining a message timestamp according to the time information of the routing protocol data;

[0014] The route detection information is obtained based on the message timestamp and the JSON string, and the route detection information is written into the Kafka server as a Kafka message.

[0015] In some embodiments, acquiring at least one of the routing detection information based on a preset event period to obtain event stream data includes:

[0016] Obtain key information aggregation data according to the detection field corresponding to each of the routing detection information;

[0017] When the time interval is greater than or equal to the event period, obtaining at least one key information aggregate data within the event period as the event stream data;

[0018] When the time interval is less than the event period, the intermediate event table is updated based on the update time interval, the start time and at least one of the key information aggregation data until the time interval is greater than or equal to the event period, and the event stream data is obtained from the intermediate event table.

[0019] In some embodiments, the preset detection instruction is a whois detection instruction, and the use of the preset detection instruction to detect the detection field in the event stream data for routing network registration information to obtain a routing registration detection result includes:

[0020] Pre-acquire the IP address information of the routing protocol data in the data source, and use the whois detection instruction to detect the routing network registration information of the IP address information to obtain detection and resolution data, wherein the detection and resolution data at least includes the first IP prefix information and the first autonomous domain number information;

[0021] The IP prefix field and the autonomous domain number field in the event stream data are searched in the detection and parsing data. If the IP prefix field and the autonomous domain number field are found in the same detection and parsing data, the routing registration detection result indicating that the detection field is normal is generated; otherwise, the routing registration detection result indicating that the detection field is abnormal is generated.

[0022] In some embodiments, the using the RPKI validator to perform field validity verification on the detection field in the event stream data to obtain a validity verification result includes:

[0023] Pre-accessing the verification information interface of the RPKI verifier, obtaining routing origin authorization record information, and parsing the routing origin authorization record information to obtain validity parsing data, wherein the validity parsing data at least includes the second IP prefix information, the second autonomous domain number information, and the validity status;

[0024] The IP prefix field and the autonomous domain number field in the event stream data are searched in the validity parsing data. If the IP prefix field and the autonomous domain number field are found in the same validity parsing data and the corresponding validity status indication is valid, the validity verification result indicating that the detection field is normal is generated; otherwise, the validity verification result indicating that the detection field is abnormal is generated.

[0025] In some embodiments, the acquiring a plurality of routing protocol data from a data source includes:

[0026] Generate synchronization threads corresponding to the data synchronization points one by one according to the number of data synchronization points of the data source;

[0027] The routing protocol data is acquired from the corresponding data synchronization point in a multi-threaded parallel manner.

[0028] In some embodiments, the method further comprises:

[0029] When the routing protocol data is abnormal routing information, obtaining a routing path sequence field in the routing protocol data;

[0030] When it is determined that at least one of the routing length of the routing path sequence field is less than a preset length, the routing path sequence field contains forged data, or the routing path sequence field is different from the expected path sequence, the routing protocol data is confirmed hijacking routing information.

[0031] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application proposes a routing protocol security detection device, comprising:

[0032] Data acquisition module: used to acquire multiple routing protocol data from a data source, and generate routing detection information according to at least one detection field in the routing protocol data and write it into the Kafka server;

[0033] An event generation module: used for acquiring event stream data in real time in the Kafka server, wherein the event stream data is obtained based on at least one of the routing detection information contained in a preset event period;

[0034] The first detection module is used to detect the routing network registration information of the detection field in the event stream data using a preset detection instruction to obtain a routing registration detection result;

[0035] The second detection module is used to use the RPKI verifier to perform field validity verification on the detection field in the event stream data to obtain a validity verification result;

[0036] Abnormal judgment module: used for obtaining abnormal routing information according to routing protocol data corresponding to the detection field if the routing registration detection result and the validity verification result both indicate that the detection field is abnormal.

[0037] To achieve the above objectives, a third aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in the first aspect is implemented.

[0038] To achieve the above-mentioned purpose, the fourth aspect of an embodiment of the present application proposes a storage medium, which is a storage medium. The storage medium stores a computer program, and when the computer program is executed by a processor, the method described in the first aspect is implemented.

[0039] The routing protocol security detection method, device, equipment and storage medium proposed in the embodiments of the present application obtain multiple routing protocol data from a data source, and generate routing detection information based on at least one detection field in the routing protocol data and write it into the Kafka server, then obtain the event stream data generated based on the detection field information in real time in the Kafka server, use the preset detection instruction to detect the routing network registration information of the detection field in the event stream data, and obtain the routing registration detection result, and then use the RPKI validator to verify the field validity of the detection field in the event stream data to obtain the validity verification result. If the routing registration detection result and the validity verification result both indicate that the detection field is abnormal, the abnormal routing information is obtained according to the routing protocol data corresponding to the detection field. In the embodiments of the present application, a stream processing mechanism is used to aggregate the routing protocol data corresponding to a large amount of Border Gateway Protocol (BGP) in the data source into multiple events, and then generate an event stream service with the help of the Kafka server, so as to reduce the amount of data actually detected and achieve the purpose of rapid detection. At the same time, double detection is performed through the routing network registration information detection and the resource public key infrastructure (RPKI) validity verification process to improve the detection accuracy. This method mainly performs data matching. Compared with model prediction and other methods, it has lower requirements for computing equipment and can reduce the complexity of detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a flow chart of the routing protocol security detection method provided in the embodiment of the present application.

[0041] Figure 2 This is a flowchart of obtaining multiple routing protocol data from a data source provided by an embodiment of the present application.

[0042] Figure 3 This is a flowchart provided by an embodiment of the present application for generating routing detection information based on at least one detection field in the routing protocol data and writing it into a Kafka server.

[0043] Figure 4 It is a flowchart of obtaining at least one routing detection information as event stream data based on a preset event period provided by an embodiment of the present application.

[0044] Figure 5 This is a flowchart of an embodiment of the present application for detecting routing network registration information on a detection field in event stream data using a preset detection instruction to obtain a routing registration detection result.

[0045] Figure 6 This is a flowchart of using an RPKI validator to perform field validity verification on a detection field in event stream data to obtain a validity verification result, as provided in an embodiment of the present application.

[0046] Figure 7It is a schematic diagram of a routing protocol security detection system provided in an embodiment of the present application.

[0047] Figure 8 It is a framework diagram of the BGP flow collection submodule provided in an embodiment of the present application.

[0048] Fig. 9 It is a framework diagram of the BGP prefix hijacking anomaly monitoring submodule provided in an embodiment of the present application.

[0049] Fig.10 This is a structural block diagram of a routing protocol security detection device provided in another embodiment of the present application.

[0050] Fig.11 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0052] It should be noted that although the functional modules are divided in the device schematic and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart.

[0053] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0054] Border Gateway Protocol (BGP) is the core routing protocol of the Internet, responsible for exchanging routing information between different autonomous systems (AS). However, given the complexity of the network environment and potential security threats, BGP data may have abnormalities, such as routing hijacking. These abnormal events may cause network traffic to be redirected incorrectly, and in severe cases may even cause large-scale network failures. Therefore, real-time monitoring of BGP data for abnormalities is very important for maintaining network stability and security.

[0055] The real-time anomaly monitoring methods of BGP data in the related art include monitoring based on BGP messages, monitoring based on network topology, monitoring based on machine learning algorithms, monitoring based on anomaly features, and monitoring based on performance indicators. These monitoring methods can be roughly divided into three categories: the first category is real-time anomaly monitoring based on BGP messages, which mainly collects and analyzes BGP messages, monitors prefix changes, neighbor node changes, paths, and traffic changes, and then locates BGP anomalies. The second category is monitoring based on BGP prefix changes, that is, by monitoring BGP prefix features to build a neural network model algorithm, and the detection module uses the model algorithm to achieve rapid detection of BGP security events. The third category is based on BGP prefix information to detect whether a multi-source autonomous system (MOAS) conflict event occurs, using MOAS events as the data source for analyzing BGP hijacking events, classifying MOAS events according to different features, and then determining hijacking events according to certain preset rules. Among them, the first and third types of detection methods are prone to misjudgment, and the detection effectiveness is poor, and further correlation analysis by later technical personnel is required to handle abnormal events. Although the second type of detection method based on the neural network model has improved accuracy, it has problems such as high complexity, high requirements for computing equipment, high cost, and long detection time, which does not meet the needs of real-time monitoring.

[0056] Based on this, the embodiments of the present application provide a routing protocol security detection method, device, equipment and storage medium, which utilizes a stream processing mechanism to aggregate a large amount of routing protocol data corresponding to the Border Gateway Protocol (BGP) in the data source into multiple events, and then generates an event stream service with the help of the Kafka server, thereby reducing the amount of data actually detected and achieving the purpose of rapid detection. At the same time, dual detection is performed through the detection of routing network registration information and the validity verification process of the resource public key infrastructure (RPKI) to improve the detection accuracy, and this method mainly performs data matching, which has lower requirements on computing equipment than model prediction and other methods, and can reduce the complexity of detection.

[0057] The embodiments of the present application provide a routing protocol security detection method, apparatus, device and storage medium, which are specifically described through the following embodiments. First, the routing protocol security detection method in the embodiments of the present application is described.

[0058] The routing protocol security detection method provided in the embodiment of the present application relates to the field of network security technology. The routing protocol security detection method provided in the embodiment of the present application can be applied to a terminal, can also be applied to a server side, and can also be a computer program running in a terminal or a server side. For example, the computer program can be a native program or software module in an operating system; it can be a local (Native) application (Application, APP), that is, a program that needs to be installed in the operating system to run, such as a client that supports routing protocol security detection, that is, a program that can be run only by downloading it to a browser environment; it can also be a small program that can be embedded in any APP. In short, the above-mentioned computer program can be any form of application, module or plug-in. Among them, the terminal communicates with the server via a network. The routing protocol security detection method can be executed by a terminal or a server, or by a terminal and a server in collaboration.

[0059] In some embodiments, the terminal may be a smart phone, a tablet computer, a laptop computer, a desktop computer or a smart watch, etc. In addition, the terminal may also be an intelligent vehicle-mounted device. The intelligent vehicle-mounted device applies the routing protocol security detection method of this embodiment to provide related services to enhance the driving experience. The server may be an independent server, or it may be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), and big data and artificial intelligence platforms; it may also be a service node in a blockchain system, and each service node in the blockchain system forms a peer-to-peer (Peer To Peer, P2P) network, and the P2P protocol is an application layer protocol running on the Transmission Control Protocol (Transmission Control Protocol, TCP) protocol. The terminal and the server may be connected via Bluetooth, Universal Serial Bus (Universal Serial Bus, USB) or network communication connection methods, and this embodiment is not limited here.

[0060] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0061] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0062] The following describes a routing protocol security detection method in an embodiment of the present application.

[0063] Figure 1 is an optional flow chart of the routing protocol security detection method provided in the embodiment of the present application. Figure 1 The method may include but is not limited to steps 110 to 150. It can also be understood that this embodiment Figure 1 The order of step 110 to step 150 is not specifically limited, and the order of steps can be adjusted or some steps can be reduced or added according to actual needs.

[0064] Step 110: Acquire multiple routing protocol data from a data source, and generate routing detection information according to at least one detection field in the routing protocol data and write it into a Kafka server.

[0065] In one embodiment, referring to Figure 2 , Figure 2 This is a flowchart of obtaining multiple routing protocol data from a data source provided by an embodiment of the present application, which specifically includes the following steps:

[0066] Step 210: Generate synchronization threads corresponding to the data synchronization points one by one according to the number of data synchronization points of the data source.

[0067] In one embodiment, the data source is a RIS-Live (Routing Information Service Live) data stream, which can provide real-time BGP data and is obtained from an open WebSocket data stream interface provided by one of the five Internet registration management agencies of the European Network Resource Coordination Center (RIPE Network Coordination Centre, RIPE NCC). In this embodiment of the present application, each data stream interface is used as a data synchronization point, and a synchronization thread corresponding to each of the data synchronization points is generated according to the number of data synchronization points, and the synchronization thread is used to call the WebSocket interface to obtain the corresponding BGP data. For example, if the number of data synchronization points is 27, 27 corresponding synchronization threads are generated.

[0068] Step 220: Acquire routing protocol data from corresponding data synchronization points in a multi-threaded parallel manner.

[0069] In one embodiment, multiple synchronization threads are run in parallel to obtain corresponding routing protocol data in real time from corresponding data synchronization points. The routing protocol data here refers to BGP related data.

[0070] Among them, after obtaining a large amount of routing protocol data, it needs to be encapsulated and converted into Kafka messages, and then the event stream service is generated with the help of the Kafka server to reduce the amount of data actually detected and achieve the purpose of rapid detection.

[0071] In one embodiment, referring to Figure 3 , Figure 3 The flowchart of generating routing detection information and writing it into a Kafka server according to at least one detection field in the routing protocol data provided by an embodiment of the present application specifically includes the following steps:

[0072] Step 310: Acquire the IP prefix field and the autonomous domain number field in the routing protocol data as detection fields, and obtain a JSON string based on the detection fields.

[0073] In one embodiment, the routing protocol data includes at least time information, an IP prefix field, an autonomous domain field, a routing path sequence field, etc. Among them, the time message can be the acquisition time of the routing protocol data. The IP prefix field is the core part of the routing protocol data, which contains the destination address and subnet mask of the route, and is used to indicate where the router should send the data packet and how to get there. The autonomous domain number field is used to identify the autonomous system AS to which the route belongs. The routing path sequence field is used to indicate the sequence of all autonomous system ASs that the data packet needs to pass through before reaching the destination. In the embodiment of the present application, the IP prefix field and the autonomous domain number field can be first obtained as detection fields, and then these two detection fields can be encapsulated into JSON to obtain the corresponding JSON string.

[0074] Step 320: Obtain a message timestamp according to the time information of the routing protocol data.

[0075] In one embodiment, since Kafka is a stream processing mechanism, each Kafka message needs to have a corresponding timestamp so that data can be processed in chronological order. In the embodiment of the present application, the time information is used as the message timestamp of the Kafka message.

[0076] Step 330: Obtain route detection information based on the message timestamp and the JSON string, and write the route detection information into the Kafka server as a Kafka message.

[0077] In one embodiment, the message timestamp and the JSON string are used as the route detection information, and the route detection information is then sent as a Kafka message to the Kafka server for subsequent streaming processing.

[0078] Step 120: Get event stream data in real time in the Kafka server.

[0079] In one embodiment, data is continuously pulled from the Kafka server, and the route detection information is obtained in real time to obtain event stream data, and the event stream data is obtained based on at least one route detection information included in a preset event period. Figure 4 , Figure 4 The flowchart of obtaining at least one routing detection information as event stream data based on a preset event period provided by an embodiment of the present application specifically includes the following steps:

[0080] Step 410: Obtain key information aggregation data according to the detection field corresponding to each routing detection information.

[0081] In one embodiment, the data is aggregated in the Kafka server to achieve data grouping, and data analysis and processing is performed within a specific time window. In the embodiment of the present application, for each routing detection information, the detection field (such as the IP prefix field and the autonomous domain number field) is obtained and then data aggregation is performed to obtain key information aggregation data, also known as Key aggregation data.

[0082] Step 420: When the time interval is greater than or equal to the event period, at least one key information aggregation data within the event period is obtained as event stream data.

[0083] In one embodiment, assuming that the event period is 5 minutes, it means that the time interval is 5 minutes. If the time interval counted according to the start time is greater than or equal to 5 minutes, at least one key information aggregation data within this period is taken as an event and directly updated to obtain event stream data.

[0084] Step 430: When the time interval is less than the event period, update the intermediate event table based on the update time interval, the start time and at least one key information aggregation data until the time interval is greater than or equal to the event period, and obtain event flow data from the intermediate event table.

[0085] In one embodiment, if the time interval is less than 5 minutes, it means that the current key information aggregate data is still being read. At this time, assuming that the update time interval is 2 minutes, the intermediate event table is continuously updated at a frequency of every 2 minutes according to the start time and at least one key information aggregate data. Until the time interval is greater than or equal to 5 minutes, at least one key information aggregate data corresponding to these five minutes is obtained from the intermediate event table to obtain event stream data. In other words, the time interval between two adjacent events is 5 minutes.

[0086] The embodiment of the present application aggregates routing detection information into events based on event periods, thereby reducing the amount of data that actually needs to be processed while retaining key information. The Kafka distributed stream processing mechanism is then used as the data transmission middleware to receive the aggregated event stream data and subsequently transmit the event stream data in the form of a stream. The downstream only needs to process a small number of events to instantly realize real-time and large-scale data processing, thereby reducing the complexity and resource consumption of data processing, and improving the detection speed and response time.

[0087] Step 130: Use a preset detection instruction to detect the detection field in the event stream data for routing network registration information to obtain a routing registration detection result.

[0088] In one embodiment, after acquiring the event stream data from the Kafka server, the event stream data is stored in a database, and then the event stream data is acquired from the database for a corresponding analysis process, wherein the analysis process includes routing registration detection and validity verification, which are described in detail below.

[0089] In one embodiment, referring to Figure 5 , Figure 5 The present invention provides a flowchart of using a preset detection instruction to detect the detection field in the event stream data to detect the routing network registration information and obtain the routing registration detection result, which specifically includes the following steps:

[0090] Step 510: pre-acquire the IP address information of the routing protocol data in the data source, and use the whois detection instruction to detect the routing network registration information of the IP address information to obtain the detection and analysis data.

[0091] In one embodiment, all routing protocol data in the data source are pre-detected for routing network registration information. At this time, it is necessary to obtain the IP address information of each routing protocol data in the data source. The IP address information here can be the address information of a router, a switch or other network device. Then, the whois detection instruction is used as a preset detection instruction to detect the routing network registration information for each IP address information, obtain the detection resolution data, and save the detection resolution data in the database in advance. Among them, the detection resolution data at least includes the first IP prefix information and the first autonomous domain number information.

[0092] The above-mentioned whois is a network protocol for querying domain name or IP address registration information. The embodiment of the present application performs whois query through the whois detection instruction to obtain the network registration information of each IP address information. This information may include the prefix information of the IP address, the assigned organization and the autonomous domain number (ASN), etc. The prefix information can be the network range or subnet to which the IP address belongs. Then the IP prefix information in this information is used as the first IP prefix information, and the autonomous domain number is used as the first autonomous domain number to obtain structured detection and resolution data. It can be understood that after the embodiment of the present application obtains the detection and resolution data corresponding to each routing protocol data, it will be pre-stored in the database. In addition, the detection and resolution data needs to be checked and updated regularly to achieve timely risk response.

[0093] Step 520: Search for the IP prefix field and the autonomous domain number field in the event stream data in the detection and parsing data. If the IP prefix field and the autonomous domain number field are found in the same detection and parsing data, generate a routing registration detection result indicating that the detection field is normal; otherwise, generate a routing registration detection result indicating that the detection field is abnormal.

[0094] In one embodiment, the event stream data includes at least one set of data, each data corresponds to a routing detection information, and each data includes an IP prefix field and an autonomous domain number field. For each data, data matching is performed in the pre-stored detection and parsing data, the IP prefix field is searched in multiple first IP prefix information, and the autonomous domain number field is searched in multiple first autonomous domain numbers. If these two detection fields are found in the same detection and parsing data, a routing registration detection result indicating that the detection field is normal is generated. If at least one is not found, it means that there is a risk of hijacking, and a routing registration detection result indicating that the detection field is abnormal is generated.

[0095] In the embodiment of the present application, the detection and resolution data obtained by whois is regarded as legal data, and the legitimacy of these routing information can be verified by comparing the first IP prefix information and the first autonomous domain number of the detection and resolution data with the IP prefix field and the autonomous domain number field in the real-time event stream data actually received. If it is found that the IP prefix field or the autonomous domain number field in the actual routing update is inconsistent with the detection and resolution data, it means that the routing information of an autonomous system may be mistakenly propagated to other autonomous systems, indicating that there may be a risk of BGP hijacking and routing leakage, because the hijacked route may contain incorrect or should not be disclosed IP prefix and ASN information.

[0096] Step 140: Use the RPKI validator to perform field validity verification on the detection field in the event stream data to obtain a validity verification result.

[0097] In one embodiment, the RPKI verifier used is the OctoRPKI verifier. The OctoRPKI verifier is a core component of Cloudflare RPKI (Resource Public Key Infrastructure), which is a third-party credible RPKI verification tool and RPKI database. It is mainly used to perform RPKI relying party software related operations to ensure the security of network routing. The OctoRPKI verifier not only provides corresponding data for Cloudflare's RPKI service, but is also used in production environments by multiple networks. By regularly refreshing the data provided by the Regional Internet Registries (RIRs), the OctoRPKI verifier can ensure the integrity and accuracy of routing information.

[0098] In one embodiment, referring to Figure 6 , Figure 6 This is a flowchart of using an RPKI validator to perform field validity verification on a detection field in event stream data to obtain a validity verification result, provided in an embodiment of the present application, and specifically includes the following steps:

[0099] Step 610: Pre-access the verification information interface of the RPKI verifier, obtain the routing origin authorization record information, and parse the routing origin authorization record information to obtain validity resolution data, which at least includes the second IP prefix information, the second autonomous domain number information and the validity status.

[0100] In one embodiment, similar to the acquisition process of the detection and resolution data, the validity verification process still requires the pre-acquisition of the validity resolution data. The RPKI verifier can verify the routing origin of the BGP data, and ensure the authenticity and integrity of the routing information through encryption and signature mechanisms. Among them, the RPKI verifier provides a verification information interface that allows users to query and retrieve authorization records related to the routing origin. In the embodiment of the present application, this verification information interface is accessed in advance to obtain the routing origin authorization record information from it. The routing origin authorization record information here is the ROAS record information. By parsing the ROAS record information, the IP prefix information, the autonomous domain number information and the validity status can be obtained to prove whether a certain routing information is legal and authorized. Among them, the validity status represents the current status of the routing origin authorization record, for example, including: valid, revoked or pending, which can be used to determine whether the routing information can be trusted. Next, the IP prefix information is used as the second IP prefix information, and the autonomous domain number information is used as the second autonomous domain number information. Combined with the validity status, the validity resolution data is stored in the database.

[0101] Step 620: Search for the IP prefix field and the autonomous domain number field in the event stream data in the validity resolution data. If the IP prefix field and the autonomous domain number field are found in the same validity resolution data and the corresponding validity status indicates valid, generate a validity verification result indicating that the detection field is normal; otherwise, generate a validity verification result indicating that the detection field is abnormal.

[0102] In one embodiment, for each data in the event stream data, data matching is performed in the pre-stored validity resolution data, the IP prefix field is searched in the multiple second IP prefix information, and the autonomous domain number field is searched in the multiple second autonomous domain numbers. If these two detection fields are found in the same validity resolution data, and the corresponding validity status indicates that the current status of the routing origin authorization record is valid, it is considered that there is no abnormality, and a validity verification result indicating that the detection field is normal is generated, otherwise a validity verification result indicating that the detection field is abnormal is generated.

[0103] In an embodiment of the present application, the origin of the BGP route is verified by means of ROAS record information, and the ROAS record information relies on encryption and signature mechanisms to ensure the authenticity and integrity of the route information. Generally speaking, there are two situations of BGP hijacking: one is that BGP hijacking often involves unauthorized route announcements, that is, an autonomous system mistakenly or maliciously announces routes that do not belong to it; the other is that BGP hijacking is sometimes caused by incorrect route configuration. For example, an organization may have incorrectly configured its router, which causes it to announce routes that do not belong to it. Based on this, the ROAS record information can be regarded as legal information. By comparing the second IP prefix information and the second autonomous domain number in the ROAS record information with the IP prefix field and the autonomous domain number field corresponding to the actual received BGP route update, this type of unauthorized or erroneous route announcement can be detected. The validity resolution data provides authorization information about the IP prefix and ASN, which can be used to verify whether the received BGP route update is legal.

[0104] Step 150: If both the route registration detection result and the validity verification result indicate that the detection field is abnormal, abnormal route information is obtained according to the routing protocol data corresponding to the detection field.

[0105] In one embodiment, in order to reduce the risk of misjudgment, only when the route registration detection result and the validity verification result both indicate that the detection field is abnormal, is it determined that a suspected hijacking risk has occurred, and at this time, the abnormal routing information is obtained according to the routing protocol data corresponding to the detection field. In addition, the obtained abnormal routing information can be stored in a database for subsequent analysis. It is understandable that the detection analysis data and the validity analysis data will be updated in real time to improve the accuracy of abnormal monitoring and solve the problems of low detection accuracy and low effectiveness.

[0106] In one embodiment, a further judgment process is required for abnormal routing information. When the routing protocol data is abnormal routing information, the routing path sequence field in the routing protocol data is obtained, and when at least one of the following is true: the routing length of the routing path sequence field is less than the preset length, the routing path sequence field contains forged data, or the routing path sequence field is different from the expected path sequence, the routing protocol data is confirmed hijacking routing information.

[0107] That is, if there is abnormal routing information, it can be considered that there is a situation that is inconsistent with normal or expected routing behavior. Such situations may include unexpected routing updates, unusual routing paths, or non-standard routing attributes. The routing path sequence field, also known as AS_PATH, records the sequence of autonomous systems that the route passes through from the source to the destination. Based on the analysis of the routing path sequence field, under normal circumstances, the route should pass through a certain number of autonomous systems from the source to the destination. If the route length is less than the preset length, that is, the route length is abnormally short, this may mean that the route has been hijacked or forged. Alternatively, if the routing path sequence field contains an autonomous domain number that does not exist or should not exist, that is, there is forged data in the routing path sequence field, then this can also serve as a prompt information for BGP hijacking. Furthermore, if the routing path sequence field in the received routing update is inconsistent with the expected path sequence, this may indicate that the routing information has been tampered with or hijacked.

[0108] Therefore, when at least one of the above three situations occurs, it can be determined that the routing protocol data corresponding to the abnormal routing information belongs to the routing information that is confirmed to be hijacked. That is, by further judging the routing path sequence, the risk of misjudgment is minimized. It should be noted that the above process can be either an automated process or a manual inspection process, and the embodiments of the present application do not limit this.

[0109] It can be seen from the above that in the existing BGP real-time monitoring process, there are problems such as low accuracy in judging the results of hijacking events, high requirements for monitoring equipment, high cost, long detection time and complex use. In response to these problems, the embodiment of the present application provides a routing protocol security detection method, which aims to achieve fast and real-time monitoring of BGP abnormal events. Specifically, through a fast BGP abnormal event stream processing service, the updated routing protocol data is aggregated into multiple independent events, and then a stream service is constructed for these events to obtain event stream data. Subsequently, real-time detection of the event stream data is carried out to form an abnormal event stream service. When performing detection, the two methods of routing network registration information detection and field validity verification are used to ensure the accuracy of data detection.

[0110] In one embodiment, corresponding functional modules are set for different steps of the routing protocol security detection method, and these functional modules are used to build a routing protocol security detection system. By decoupling the traffic flow, data processing, monitoring, storage and other services can be independently encapsulated into docker images. Each service uses independent multi-threaded batch processing to achieve decoupling between services. In this way, it does not rely on complex basic environment preparation work, supports quick deployment and operation, and thus solves problems such as high equipment requirements, high cost, long detection time and complex use.

[0111] In one embodiment, referring to Figure 7 , Figure 7 It is a schematic diagram of the routing protocol security detection system provided by an embodiment of the present application. First, the data source RIS-Live is used to provide real-time BGP data. Subsequently, the data stream acquisition submodule obtains multiple routing protocol data from the data source, and generates routing detection information based on at least one detection field in the routing protocol data, and writes it into the Kafka server. Next, the data stream acquisition submodule obtains the event stream data generated based on the detection field information in real time through the Kafka server, and stores these data in the database. Finally, the BGP prefix hijacking anomaly detection submodule reads the event stream data from the database into the memory, uses the preset detection instruction to detect the routing network registration information of the detection field in the event stream data, and obtains the routing registration detection result; then uses the RPKI validator to verify the field validity of the detection field in the event stream data to obtain the validity verification result. If both the routing registration detection result and the validity verification result indicate that there is an abnormality in the detection field, the abnormal routing information is obtained based on the routing protocol data corresponding to the detection field.

[0112] Among them, refer to Figure 8 , Figure 8 It is a framework diagram of the BGP flow collection submodule provided in the embodiment of the present application. The BGP flow collection submodule includes a BGP data flow access module and a BGP data flow processing module. Specifically, the BGP data flow access module uses a synchronous thread to call the WebSocket interface to obtain the corresponding BGP data, sets the IP prefix field and the autonomous domain number field in the routing protocol data as detection fields, generates a JSON string based on these detection fields, and then obtains the message timestamp in combination with the time information of the routing protocol data, generates routing detection information based on the message timestamp and the JSON string, and finally writes the routing detection information as a Kafka message to the Kafka server. Subsequently, the BGP data flow processing module will obtain the flow data in real time in the Kafka server, and store the event flow data obtained according to the flow data in the database.

[0113] Next, refer to Fig. 9 , Fig. 9 The framework diagram of the BGP prefix hijacking anomaly monitoring submodule provided in the embodiment of the present application is shown in FIG. The BGP prefix hijacking anomaly monitoring submodule includes a routing registration information real-time storage module, a real-time BGP hijacking detection module, and a routing origin verification real-time storage module.

[0114] Specifically, the real-time storage module for routing registration information pre-acquires the IP address information of the routing protocol data in the data source, and then uses the whois detection instruction to detect the routing network registration information of the IP address information, thereby obtaining the detection and parsing data. Next, by continuously scanning the event stream data in the database, it is read into the memory, and then the IP prefix field and the autonomous domain number field in the event stream data are searched in the detection and parsing data. If the IP prefix field and the autonomous domain number field can be found in the same detection and parsing data, a routing registration detection result indicating that the detection field is normal is generated; otherwise, a routing registration detection result indicating that the detection field is abnormal is generated.

[0115] The real-time storage module for route origin verification accesses the verification information interface of the RPKI verifier in advance, obtains the route origin authorization record information, and parses the route origin authorization record information to obtain the validity analysis data. Next, the IP prefix field and the autonomous domain number field in the event stream data are searched in the validity analysis data. If the IP prefix field and the autonomous domain number field can be found in the same validity analysis data, and the corresponding validity status indicates valid, then a validity verification result indicating that the detection field is normal is generated; otherwise, a validity verification result indicating that the detection field is abnormal is generated.

[0116] Finally, the real-time BGP hijack detection module obtains the route registration detection results and validity verification results in real time, and quickly filters out possible abnormal information to achieve real-time processing capabilities. The specific abnormality judgment process is as follows: If the route registration detection results and validity verification results both indicate that the detection field is abnormal, the abnormal routing information is obtained based on the routing protocol data corresponding to the detection field.

[0117] The technical solution provided in the embodiment of the present application is to obtain multiple routing protocol data from a data source, and generate routing detection information based on at least one detection field in the routing protocol data and write it into the Kafka server, then obtain the event stream data generated based on the detection field information in real time in the Kafka server, use the preset detection instruction to detect the routing network registration information of the detection field in the event stream data, obtain the routing registration detection result, and then use the RPKI verifier to verify the field validity of the detection field in the event stream data to obtain the validity verification result. If the routing registration detection result and the validity verification result both indicate that the detection field is abnormal, the abnormal routing information is obtained according to the routing protocol data corresponding to the detection field. In the embodiment of the present application, the flow processing mechanism is used to aggregate the routing protocol data corresponding to a large amount of border gateway protocol (BGP) in the data source into multiple events, and then generate an event stream service with the help of the Kafka server, so as to reduce the actual detection data volume and achieve the purpose of rapid detection. At the same time, the detection accuracy is improved by performing double detection through the detection of routing network registration information and the validity verification process of resource public key infrastructure (RPKI), and this method mainly performs data matching, which has lower requirements on computing equipment than model prediction and other methods, and can reduce the complexity of detection.

[0118] The present application also provides a routing protocol security detection device, which can implement the above-mentioned routing protocol security detection method, referring to Fig.10 , the device comprises:

[0119] Data acquisition module 1010: used to acquire multiple routing protocol data from a data source, and generate routing detection information according to at least one detection field in the routing protocol data and write it into the Kafka server.

[0120] Event generation module 1020: used to obtain event stream data in real time in the Kafka server, where the event stream data is obtained based on at least one routing detection information contained in a preset event period.

[0121] The first detection module 1030 is used to detect the routing network registration information of the detection field in the event stream data using a preset detection instruction to obtain a routing registration detection result.

[0122] The second detection module 1040 is used to use the RPKI validator to perform field validity verification on the detection field in the event stream data to obtain a validity verification result.

[0123] Abnormality judgment module 1050: used to obtain abnormal routing information according to routing protocol data corresponding to the detection field if both the routing registration detection result and the validity verification result indicate that the detection field is abnormal.

[0124] The specific implementation of the routing protocol security detection device of this embodiment is basically the same as the specific implementation of the routing protocol security detection method described above, and will not be repeated here.

[0125] The present application also provides an electronic device, including:

[0126] at least one memory;

[0127] at least one processor;

[0128] at least one program;

[0129] The program is stored in the memory, and the processor executes the at least one program to implement the above-mentioned routing protocol security detection method implemented in this application. The electronic device can be any intelligent terminal including a mobile phone, a tablet computer, a personal digital assistant (PDA), a car computer, etc.

[0130] See also Fig.11 , Fig.11 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0131] The processor 1101 may be implemented by a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0132] The memory 1102 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1102 can store an operating system and other applications. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 1102, and the processor 1101 calls and executes the routing protocol security detection method of the embodiment of the present application;

[0133] Input / output interface 1103, used to implement information input and output;

[0134] Communication interface 1104, used to realize communication interaction between the device and other devices, which can be realized by wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.); and

[0135] A bus 1105 that transmits information between various components of the device (e.g., the processor 1101, the memory 1102, the input / output interface 1103, and the communication interface 1104);

[0136] The processor 1101 , the memory 1102 , the input / output interface 1103 and the communication interface 1104 are connected to each other in communication within the device via the bus 1105 .

[0137] An embodiment of the present application also provides a storage medium, which is a storage medium that stores a computer program. When the computer program is executed by a processor, the above-mentioned routing protocol security detection method is implemented.

[0138] As a non-transitory storage medium, the memory can be used to store non-transitory software programs and non-transitory computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0139] The routing protocol security detection method, device, equipment and storage medium proposed in the embodiments of the present application obtain multiple routing protocol data from a data source, and generate routing detection information based on at least one detection field in the routing protocol data and write it into the Kafka server, then obtain the event stream data generated based on the detection field information in real time in the Kafka server, use the preset detection instruction to detect the routing network registration information of the detection field in the event stream data, and obtain the routing registration detection result, and then use the RPKI validator to verify the field validity of the detection field in the event stream data to obtain the validity verification result. If the routing registration detection result and the validity verification result both indicate that the detection field is abnormal, the abnormal routing information is obtained according to the routing protocol data corresponding to the detection field. In the embodiments of the present application, a stream processing mechanism is used to aggregate the routing protocol data corresponding to a large amount of Border Gateway Protocol (BGP) in the data source into multiple events, and then generate an event stream service with the help of the Kafka server, so as to reduce the amount of data actually detected and achieve the purpose of rapid detection. At the same time, double detection is performed through the routing network registration information detection and the resource public key infrastructure (RPKI) validity verification process to improve the detection accuracy. This method mainly performs data matching. Compared with model prediction and other methods, it has lower requirements for computing equipment and can reduce the complexity of detection.

[0140] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0141] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0142] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0143] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0144] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0145] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0146] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0147] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0148] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0149] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store programs.

[0150] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A routing protocol security detection method, characterized in that: include: Acquire multiple routing protocol data from a data source, and generate routing detection information according to at least one detection field in the routing protocol data and write it into a Kafka server; Acquire event stream data in real time in the Kafka server, wherein the event stream data is obtained based on at least one of the routing detection information contained in a preset event period; Using a preset detection instruction to detect the detection field in the event stream data, the routing network registration information is detected to obtain a routing registration detection result; Using the RPKI validator to perform field validity verification on the detection field in the event stream data to obtain a validity verification result; If both the routing registration detection result and the validity verification result indicate that the detection field is abnormal, abnormal routing information is obtained according to routing protocol data corresponding to the detection field.

2. The routing protocol security detection method according to claim 1, characterized in that: The step of generating routing detection information according to at least one detection field in the routing protocol data and writing it into the Kafka server comprises: Obtaining the IP prefix field and the autonomous domain number field in the routing protocol data as the detection field, and obtaining a JSON string according to the detection field; Obtaining a message timestamp according to the time information of the routing protocol data; The route detection information is obtained based on the message timestamp and the JSON string, and the route detection information is written into the Kafka server as a Kafka message.

3. The routing protocol security detection method according to claim 1, characterized in that: Acquiring at least one of the routing detection information based on a preset event period to obtain event stream data includes: Obtain key information aggregation data according to the detection field corresponding to each of the routing detection information; When the time interval is greater than or equal to the event period, obtaining at least one key information aggregate data within the event period as the event stream data; When the time interval is less than the event period, the intermediate event table is updated based on the update time interval, the start time and at least one of the key information aggregation data until the time interval is greater than or equal to the event period, and the event stream data is obtained from the intermediate event table.

4. The routing protocol security detection method according to claim 2, characterized in that: The preset detection instruction is a whois detection instruction, and the detection of the detection field in the event stream data by using the preset detection instruction to detect the routing network registration information to obtain the routing registration detection result includes: Pre-acquire the IP address information of the routing protocol data in the data source, and use the whois detection instruction to detect the routing network registration information of the IP address information to obtain detection and resolution data, wherein the detection and resolution data at least includes the first IP prefix information and the first autonomous domain number information; The IP prefix field and the autonomous domain number field in the event stream data are searched in the detection and parsing data. If the IP prefix field and the autonomous domain number field are found in the same detection and parsing data, the routing registration detection result indicating that the detection field is normal is generated; otherwise, the routing registration detection result indicating that the detection field is abnormal is generated.

5. The routing protocol security detection method according to claim 2, characterized in that: The using the RPKI validator to perform field validity verification on the detection field in the event stream data to obtain a validity verification result includes: Pre-accessing the verification information interface of the RPKI verifier, obtaining routing origin authorization record information, and parsing the routing origin authorization record information to obtain validity parsing data, wherein the validity parsing data at least includes the second IP prefix information, the second autonomous domain number information, and the validity status; The IP prefix field and the autonomous domain number field in the event stream data are searched in the validity parsing data. If the IP prefix field and the autonomous domain number field are found in the same validity parsing data and the corresponding validity status indication is valid, the validity verification result indicating that the detection field is normal is generated; otherwise, the validity verification result indicating that the detection field is abnormal is generated.

6. The routing protocol security detection method according to claim 1, characterized in that: The obtaining of multiple routing protocol data from a data source includes: Generate synchronization threads corresponding to the data synchronization points one by one according to the number of data synchronization points of the data source; The routing protocol data is acquired from the corresponding data synchronization point in a multi-threaded parallel manner.

7. The routing protocol security detection method according to claim 2, characterized in that: The method further comprises: When the routing protocol data is abnormal routing information, obtaining a routing path sequence field in the routing protocol data; When it is determined that at least one of the routing length of the routing path sequence field is less than a preset length, the routing path sequence field contains forged data, or the routing path sequence field is different from the expected path sequence, the routing protocol data is confirmed hijacking routing information.

8. A routing protocol security detection device, characterized in that: include: Data acquisition module: used to acquire multiple routing protocol data from a data source, and generate routing detection information according to at least one detection field in the routing protocol data and write it into the Kafka server; An event generation module: used for acquiring event stream data in real time in the Kafka server, wherein the event stream data is obtained based on at least one of the routing detection information contained in a preset event period; The first detection module is used to detect the routing network registration information of the detection field in the event stream data using a preset detection instruction to obtain a routing registration detection result; The second detection module is used to use the RPKI verifier to perform field validity verification on the detection field in the event stream data to obtain a validity verification result; Abnormal judgment module: used for obtaining abnormal routing information according to routing protocol data corresponding to the detection field if the routing registration detection result and the validity verification result both indicate that the detection field is abnormal.

9. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the routing protocol security detection method according to any one of claims 1 to 7 when executing the computer program.

10. A storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the routing protocol security detection method according to any one of claims 1 to 7 is implemented.

Images