Routing protocol security detection method, device, equipment and storage medium

Abstract

The embodiments of the present application provide a routing protocol security detection method, apparatus, device and storage medium, which relate to the field of network security technology. The method obtains multiple routing protocol data from a data source, generates routing detection information based on the routing protocol data and writes it into a Kafka server, obtains event stream data in real time in the Kafka server, uses preset detection instructions to detect routing network registration information on the event stream data to obtain routing registration detection results, and uses the RPKI validator to verify the field validity of the event stream data to obtain a validity verification result. If both the routing registration detection result and the validity verification result indicate that the detection field is abnormal, the abnormal routing information is obtained according to the routing protocol data corresponding to the detection field. Utilizing the stream processing mechanism, a large amount of routing protocol data in the data source is aggregated into multiple events, and the actual amount of data detected is reduced based on the event stream service to achieve the purpose of rapid detection, while improving the detection accuracy through double detection.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a routing protocol security detection method, apparatus, device, and storage medium. Background Art

[0002] The Border Gateway Protocol (BGP), the core routing protocol of the Internet, is responsible for exchanging routing information between autonomous systems (ASs). However, given the complexity of network environments and potential security threats, BGP data may exhibit anomalies, such as route hijacking. These anomalies can lead to incorrect redirection of network traffic and, in severe cases, even cause large-scale network failures. Therefore, real-time monitoring of BGP data for anomalies is crucial to maintaining network stability and security.

[0003] Related technologies primarily utilize decision rules or neural network models for anomaly detection. However, decision rules are prone to misjudgments and lack effective detection. Neural network models, on the other hand, are complex, require high computing power, and take a long time to detect, making them inadequate for real-time monitoring. Summary of the Invention

[0004] The main purpose of the embodiments of the present application is to propose a routing protocol security detection method, apparatus, device and storage medium to improve detection efficiency while ensuring detection effectiveness.

[0005] To achieve the above objectives, a first aspect of an embodiment of the present application provides a routing protocol security detection method, comprising:

[0006] Acquire multiple routing protocol data from a data source, and generate routing detection information based on at least one detection field in the routing protocol data and write it into a Kafka server;

[0007] Acquire event stream data in real time in the Kafka server, where the event stream data is obtained based on at least one piece of routing detection information included in a preset event period;

[0008] Using a preset detection instruction to detect routing network registration information on the detection field in the event stream data, to obtain a routing registration detection result;

[0009] Using an RPKI validator to perform field validity verification on the detection field in the event stream data to obtain a validity verification result;

[0010] If both the routing registration detection result and the validity verification result indicate that the detection field is abnormal, abnormal routing information is obtained according to routing protocol data corresponding to the detection field.

[0011] In some embodiments, generating routing detection information based on at least one detection field in the routing protocol data and writing it to a Kafka server includes:

[0012] Obtaining the IP prefix field and the autonomous domain number field in the routing protocol data as the detection field, and obtaining a JSON string according to the detection field;

[0013] Obtaining a message timestamp according to the time information of the routing protocol data;

[0014] The route detection information is obtained based on the message timestamp and the JSON string, and the route detection information is written into the Kafka server as a Kafka message.

[0015] In some embodiments, obtaining at least one piece of routing detection information based on a preset event period to obtain event stream data includes:

[0016] Obtaining key information aggregation data according to the detection field corresponding to each of the routing detection information;

[0017] When the time interval is greater than or equal to the event period, obtaining at least one key information aggregate data within the event period as the event stream data;

[0018] When the time interval is less than the event period, the intermediate event table is updated based on the update time interval, the start time and at least one of the key information aggregation data until the time interval is greater than or equal to the event period, and the event stream data is obtained from the intermediate event table.

[0019] In some embodiments, the preset detection instruction is a whois detection instruction, and using the preset detection instruction to detect routing network registration information of the detection field in the event stream data to obtain a routing registration detection result includes:

[0020] Pre-acquire the IP address information of the routing protocol data in the data source, and use the whois detection instruction to detect the routing network registration information of the IP address information to obtain detection resolution data, wherein the detection resolution data includes at least first IP prefix information and first autonomous domain number information;

[0021] The IP prefix field and the autonomous domain number field in the event stream data are searched in the detection and parsing data. If the IP prefix field and the autonomous domain number field are found in the same detection and parsing data, the routing registration detection result indicating that the detection field is normal is generated; otherwise, the routing registration detection result indicating that the detection field is abnormal is generated.

[0022] In some embodiments, performing field validity verification on the detection field in the event stream data using an RPKI validator to obtain a validity verification result includes:

[0023] Accessing the verification information interface of the RPKI validator in advance, obtaining routing origin authorization record information, and parsing the routing origin authorization record information to obtain validity parsing data, the validity parsing data including at least the second IP prefix information, the second autonomous domain number information, and the validity status;

[0024] The IP prefix field and the autonomous domain number field in the event stream data are searched in the validity parsing data. If the IP prefix field and the autonomous domain number field are found in the same validity parsing data and the corresponding validity status indication is valid, the validity verification result indicating that the detection field is normal is generated; otherwise, the validity verification result indicating that the detection field is abnormal is generated.

[0025] In some embodiments, obtaining a plurality of routing protocol data from a data source includes:

[0026] Generate synchronization threads corresponding to the data synchronization points one by one according to the number of the data synchronization points of the data source;

[0027] The routing protocol data is acquired from the corresponding data synchronization point in a multi-threaded parallel manner.

[0028] In some embodiments, the method further comprises:

[0029] When the routing protocol data is abnormal routing information, obtaining a routing path sequence field in the routing protocol data;

[0030] When it is determined that at least one of the routing length of the routing path sequence field is less than a preset length, the routing path sequence field contains forged data, or the routing path sequence field is different from the expected path sequence, the routing protocol data is confirmed hijacking routing information.

[0031] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application provides a routing protocol security detection device, comprising:

[0032] Data acquisition module: used to obtain multiple routing protocol data from the data source, and generate routing detection information based on at least one detection field in the routing protocol data and write it into the Kafka server;

[0033] An event generation module is configured to obtain event stream data in real time from the Kafka server, wherein the event stream data is obtained based on at least one piece of routing detection information contained in a preset event period;

[0034] A first detection module is configured to detect routing network registration information on the detection field in the event stream data using a preset detection instruction to obtain a routing registration detection result;

[0035] A second detection module is configured to perform field validity verification on the detection field in the event stream data using an RPKI validator to obtain a validity verification result;

[0036] Abnormality judgment module: used for obtaining abnormal routing information according to routing protocol data corresponding to the detection field if both the routing registration detection result and the validity verification result indicate that the detection field is abnormal.

[0037] To achieve the above-mentioned purpose, the third aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the method described in the first aspect when executing the computer program.

[0038] To achieve the above-mentioned purpose, the fourth aspect of the embodiment of the present application proposes a storage medium, which is a storage medium. The storage medium stores a computer program, and when the computer program is executed by a processor, the method described in the first aspect is implemented.

[0039] The routing protocol security detection method, apparatus, device and storage medium proposed in the embodiment of the present application obtain multiple routing protocol data from a data source, and generate routing detection information based on at least one detection field in the routing protocol data and write it into the Kafka server, then obtain the event stream data generated based on the detection field information in real time in the Kafka server, use the preset detection instruction to detect the routing network registration information of the detection field in the event stream data, obtain the routing registration detection result, and then use the RPKI validator to verify the field validity of the detection field in the event stream data to obtain the validity verification result. If the routing registration detection result and the validity verification result both indicate that the detection field is abnormal, the abnormal routing information is obtained according to the routing protocol data corresponding to the detection field. In the embodiment of the present application, a stream processing mechanism is used to aggregate the routing protocol data corresponding to a large amount of Border Gateway Protocol (BGP) in the data source into multiple events, and then generate an event stream service with the help of the Kafka server, so as to reduce the amount of data actually detected and achieve the purpose of rapid detection. At the same time, double detection is performed through the routing network registration information detection and resource public key infrastructure (RPKI) validity verification process to improve detection accuracy. This method mainly performs data matching. Compared with model prediction and other methods, it has lower requirements for computing equipment and can reduce the complexity of detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 This is a flowchart of a routing protocol security detection method provided in an embodiment of the present application.

[0041] Figure 2 This is a flowchart of obtaining multiple routing protocol data from a data source provided by an embodiment of the present application.

[0042] Figure 3 This is a flowchart provided by an embodiment of the present application for generating routing detection information based on at least one detection field in the routing protocol data and writing it into a Kafka server.

[0043] Figure 4 This is a flowchart of an embodiment of the present application for obtaining at least one routing detection information as event stream data based on a preset event period.

[0044] Figure 5 This is a flowchart of an embodiment of the present application for detecting routing network registration information in a detection field in event stream data using a preset detection instruction to obtain a routing registration detection result.

[0045] Figure 6 This is a flowchart of an embodiment of the present application for using an RPKI validator to perform field validity verification on a detection field in event stream data to obtain a validity verification result.

[0046] Figure 7This is a schematic diagram of a routing protocol security detection system provided in an embodiment of the present application.

[0047] Figure 8 This is a framework diagram of the BGP flow collection submodule provided in an embodiment of the present application.

[0048] Figure 9 This is a framework diagram of the BGP prefix hijacking anomaly monitoring submodule provided in an embodiment of the present application.

[0049] Figure 10 This is a structural block diagram of a routing protocol security detection device provided by another embodiment of the present application.

[0050] Figure 11 This is a schematic diagram of the hardware structure of the electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0052] It should be noted that although the functional modules are divided in the device schematic and the logical order is shown in the flowchart, in some cases, the steps shown or described can be performed in a different order than the module division in the device or the order in the flowchart.

[0053] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0054] The Border Gateway Protocol (BGP), the core routing protocol of the Internet, is responsible for exchanging routing information between autonomous systems (ASs). However, given the complexity of network environments and potential security threats, BGP data may exhibit anomalies, such as route hijacking. These anomalies can lead to incorrect redirection of network traffic and, in severe cases, even cause large-scale network failures. Therefore, real-time monitoring of BGP data for anomalies is crucial to maintaining network stability and security.

[0055] Related technologies for real-time anomaly monitoring of BGP data include methods based on BGP messages, network topology, machine learning algorithms, anomaly features, and performance metrics. These monitoring methods can be broadly categorized into three categories: The first category involves real-time anomaly monitoring based on BGP messages. This primarily involves collecting and analyzing BGP messages to monitor prefix changes, neighbor node changes, path changes, and traffic flow changes, thereby locating BGP anomalies. The second category involves monitoring BGP prefix changes. This involves monitoring BGP prefix features to construct a neural network model algorithm, which the detection module leverages to rapidly detect BGP security incidents. The third category involves detecting Multi-Source Autonomous System (MOAS) conflict events based on BGP prefix information. MOAS events serve as the data source for analyzing BGP hijacking incidents, classifying MOAS events according to different features, and then determining hijacking events based on pre-set rules. However, the first and third categories of detection methods are prone to misjudgments and lack effective detection, requiring further correlation analysis by technical personnel to address anomaly events. Although the second type of detection method based on the neural network model has improved accuracy, it has problems such as high complexity, high requirements for computing equipment, high cost, and long detection time, which does not meet the needs of real-time monitoring.

[0056] Based on this, the embodiments of the present application provide a routing protocol security detection method, apparatus, device and storage medium. By using a stream processing mechanism, a large amount of routing protocol data corresponding to the Border Gateway Protocol (BGP) in the data source is aggregated into multiple events, and then an event stream service is generated with the help of a Kafka server, thereby reducing the amount of data actually detected and achieving the purpose of rapid detection. At the same time, dual detection is performed through the detection of routing network registration information and the validity verification process of the resource public key infrastructure (RPKI) to improve the detection accuracy. This method mainly performs data matching, and compared with model prediction and other methods, it has lower requirements on computing equipment and can reduce the complexity of detection.

[0057] The embodiments of the present application provide a routing protocol security detection method, apparatus, device, and storage medium, which are specifically described through the following embodiments. First, the routing protocol security detection method in the embodiments of the present application is described.

[0058] The routing protocol security detection method provided in the embodiment of the present application relates to the field of network security technology. The routing protocol security detection method provided in the embodiment of the present application can be applied to a terminal, can be applied to a server side, or can be a computer program running in a terminal or a server side. For example, the computer program can be a native program or software module in an operating system; it can be a local (Native) application (Application, APP), that is, a program that needs to be installed in the operating system to run, such as a client that supports routing protocol security detection, that is, a program that can be run only by downloading it into a browser environment; it can also be a small program that can be embedded in any APP. In short, the above-mentioned computer program can be an application, module or plug-in in any form. Among them, the terminal communicates with the server via a network. The routing protocol security detection method can be executed by a terminal or a server, or by a terminal and a server in collaboration.

[0059] In some embodiments, the terminal can be a smart phone, tablet computer, laptop computer, desktop computer or smart watch, etc. In addition, the terminal can also be an intelligent vehicle-mounted device. The intelligent vehicle-mounted device applies the routing protocol security detection method of this embodiment to provide related services to enhance the driving experience. The server can be an independent server, or it can be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms; it can also be a service node in a blockchain system, in which each service node in the blockchain system forms a peer-to-peer (P2P) network. The P2P protocol is an application layer protocol running on top of the Transmission Control Protocol (TCP). The terminal and the server can be connected via Bluetooth, Universal Serial Bus (USB) or a network, etc., and this embodiment does not limit this.

[0060] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, and the like. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments in which tasks are performed by remote processing devices connected via a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0061] It should be noted that in each specific embodiment of the present application, when it comes to the need to perform relevant processing based on data related to the user's identity or characteristics, such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of such data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0062] The following describes a routing protocol security detection method in an embodiment of the present application.

[0063] Figure 1 This is an optional flowchart of the routing protocol security detection method provided in the embodiment of the present application. Figure 1 The method may include but is not limited to steps 110 to 150. It is also understood that this embodiment is Figure 1 The order of steps 110 to 150 is not specifically limited, and the order of steps can be adjusted or some steps can be reduced or added according to actual needs.

[0064] Step 110: Acquire multiple routing protocol data from a data source, and generate routing detection information based on at least one detection field in the routing protocol data and write it into a Kafka server.

[0065] In one embodiment, referring to Figure 2 , Figure 2 This is a flowchart of obtaining multiple routing protocol data from a data source provided by an embodiment of the present application, which specifically includes the following steps:

[0066] Step 210: Generate synchronization threads corresponding to the data synchronization points according to the number of data synchronization points of the data source.

[0067] In one embodiment, the data source is the Routing Information Service Live (RIS-Live) data stream, which provides real-time BGP data and is obtained from an open WebSocket data stream interface provided by one of the five Internet registries of the RIPE Network Coordination Centre (RIPE NCC). In this embodiment, each data stream interface is treated as a data synchronization point, and a corresponding synchronization thread is generated based on the number of data synchronization points. The synchronization thread then calls the WebSocket interface to obtain the corresponding BGP data. For example, if there are 27 data synchronization points, 27 corresponding synchronization threads are generated.

[0068] Step 220: Obtain routing protocol data from the corresponding data synchronization point in a multi-threaded parallel manner.

[0069] In one embodiment, multiple synchronization threads are run in parallel to obtain corresponding routing protocol data from corresponding data synchronization points in real time. The routing protocol data here refers to BGP related data.

[0070] Among them, after obtaining a large amount of routing protocol data, it needs to be encapsulated and converted into Kafka messages, and then the event stream service is generated with the help of the Kafka server to reduce the amount of data actually detected and achieve the purpose of rapid detection.

[0071] In one embodiment, referring to Figure 3 , Figure 3 This is a flowchart of generating routing detection information based on at least one detection field in the routing protocol data and writing it to the Kafka server, provided by an embodiment of the present application, specifically including the following steps:

[0072] Step 310: Acquire the IP prefix field and the autonomous domain number field in the routing protocol data as detection fields, and obtain a JSON string based on the detection fields.

[0073] In one embodiment, the routing protocol data includes at least time information, an IP prefix field, an autonomous domain field, a routing path sequence field, and the like. Among them, the time message may be the time when the routing protocol data is acquired, and the IP prefix field is the core part of the routing protocol data, which includes the destination address and subnet mask of the route, and is used to indicate where the router should send the data packet and how to get there. The autonomous domain number field is used to identify the autonomous system AS to which the route belongs. The routing path sequence field is used to indicate the sequence of all autonomous system ASs that the data packet needs to pass through before reaching the destination. In the embodiment of the present application, the IP prefix field and the autonomous domain number field can be first obtained as detection fields, and then these two detection fields can be encapsulated into JSON to obtain the corresponding JSON string.

[0074] Step 320: Obtain a message timestamp according to the time information of the routing protocol data.

[0075] In one embodiment, since Kafka is a stream processing mechanism, each Kafka message needs to have a corresponding timestamp so that data can be processed in chronological order. In the embodiment of the present application, the time information is used as the message timestamp of the Kafka message.

[0076] Step 330: Obtain routing detection information based on the message timestamp and the JSON string, and write the routing detection information as a Kafka message to the Kafka server.

[0077] In one embodiment, the message timestamp and the JSON string are used as routing detection information, and the routing detection information is then sent as a Kafka message to a Kafka server for subsequent streaming processing.

[0078] Step 120: Get event stream data in real time from the Kafka server.

[0079] In one embodiment, data is continuously pulled from the Kafka server, and the routing detection information is obtained in real time to obtain event stream data, and the event stream data is obtained based on at least one routing detection information included in a preset event period. Figure 4 , Figure 4 This is a flowchart of obtaining at least one routing detection information as event stream data based on a preset event period provided by an embodiment of the present application, specifically including the following steps:

[0080] Step 410: Obtain key information aggregation data according to the detection field corresponding to each routing detection information.

[0081] In one embodiment, the Kafka server aggregates data to achieve data grouping and performs data analysis and processing within a specific time window. In the embodiment of the present application, for each routing detection information, the detection fields (such as the IP prefix field and the autonomous domain number field) are obtained and then data aggregation is performed to obtain key information aggregation data, also known as key aggregation data.

[0082] Step 420: When the time interval is greater than or equal to the event period, at least one key information aggregation data within the event period is obtained as event stream data.

[0083] In one embodiment, assuming that the event period is 5 minutes, it means that the time interval is 5 minutes. If the time interval calculated according to the start time is greater than or equal to 5 minutes, then at least one key information aggregation data within this period is taken as an event and directly updated to obtain event stream data.

[0084] Step 430: When the time interval is less than the event period, update the intermediate event table based on the update time interval, the start time and at least one key information aggregation data until the time interval is greater than or equal to the event period, and obtain event stream data from the intermediate event table.

[0085] In one embodiment, if the time interval is less than 5 minutes, it indicates that the current key information aggregate data is still being read. Assuming the update interval is 2 minutes, the intermediate event table is continuously updated every 2 minutes based on the start time and at least one key information aggregate data. Until the time interval is greater than or equal to 5 minutes, the at least one key information aggregate data corresponding to these five minutes is retrieved from the intermediate event table to obtain event stream data. In other words, the time interval between two adjacent events is 5 minutes.

[0086] The embodiment of the present application aggregates routing detection information into events based on event periods, thereby reducing the actual amount of data that needs to be processed while retaining key information. The Kafka distributed stream processing mechanism is then used as the data transmission middleware to receive the aggregated event stream data and subsequently transmit the event stream data in the form of a stream. The downstream only needs to process a small number of events to immediately realize real-time large-scale data processing, thereby reducing the complexity and resource consumption of data processing, and improving the detection speed and response time.

[0087] Step 130: Use a preset detection instruction to detect the routing network registration information of the detection field in the event stream data to obtain a routing registration detection result.

[0088] In one embodiment, after acquiring event stream data from a Kafka server, the event stream data is stored in a database, and then the event stream data is retrieved from the database for analysis. The analysis process includes route registration detection and validity verification, each of which is described in detail below.

[0089] In one embodiment, referring to Figure 5 , Figure 5 This is a flowchart of an embodiment of the present application for detecting routing network registration information in a detection field in event stream data using a preset detection instruction to obtain a routing registration detection result, specifically including the following steps:

[0090] Step 510: pre-acquire the IP address information of the routing protocol data in the data source, and use the whois detection instruction to detect the routing network registration information of the IP address information to obtain detection and resolution data.

[0091] In one embodiment, all routing protocol data in a data source is pre-probed for routing network registration information. This requires obtaining the IP address information for each piece of routing protocol data in the data source. The IP address information may be the address information of a router, switch, or other network device. A whois probe instruction is then used as a pre-set probe instruction to perform a routing network registration information probe for each piece of IP address information, obtaining probe resolution data. This probe resolution data is pre-stored in a database. The probe resolution data includes at least first IP prefix information and first autonomous domain number information.

[0092] The above-mentioned whois is a network protocol for querying domain name or IP address registration information. The embodiment of the present application performs whois query through the whois detection instruction to obtain the network registration information of each IP address information. This information may include the prefix information of the IP address, the assigned organization and the autonomous domain number (ASN), etc. The prefix information can be the network range or subnet to which the IP address belongs. The IP prefix information in this information is then used as the first IP prefix information, and the autonomous domain number is used as the first autonomous domain number to obtain structured detection and resolution data. It can be understood that after the embodiment of the present application obtains the detection and resolution data corresponding to each routing protocol data, it will be pre-stored in the database. In addition, the detection and resolution data needs to be checked and updated regularly to achieve timely risk response.

[0093] Step 520: Search for the IP prefix field and the autonomous domain number field in the event stream data in the detection and parsing data. If the IP prefix field and the autonomous domain number field are found in the same detection and parsing data, generate a routing registration detection result indicating that the detection field is normal; otherwise, generate a routing registration detection result indicating that the detection field is abnormal.

[0094] In one embodiment, the event stream data includes at least one set of data, each corresponding to a piece of routing detection information, and each piece of data includes an IP prefix field and an autonomous domain number field. For each piece of data, a data match is performed against pre-stored probe and parsing data. The IP prefix field is searched for within multiple pieces of first IP prefix information, and the autonomous domain number field is searched for within multiple pieces of first autonomous domain numbers. If both detection fields are found within the same piece of probe and parsing data, a routing registration detection result is generated indicating that the detection field is normal. If at least one of the detection fields is not found, a hijacking risk exists, and a routing registration detection result is generated indicating that the detection field is abnormal.

[0095] In the embodiment of the present application, the detection and resolution data obtained by whois is regarded as legal data. By comparing the first IP prefix information and the first autonomous domain number of the detection and resolution data with the IP prefix field and autonomous domain number field in the real-time event stream data actually received, the legitimacy of these routing information can be verified. If it is found that the IP prefix field or autonomous domain number field in the actual routing update is inconsistent with the detection and resolution data, it means that the routing information of an autonomous system may be mistakenly propagated to other autonomous systems, indicating that there may be a risk of BGP hijacking and routing leakage, because the hijacked route may contain incorrect or should not be disclosed IP prefix and ASN information.

[0096] Step 140: Use the RPKI validator to perform field validity verification on the detection field in the event stream data to obtain a validity verification result.

[0097] In one embodiment, the RPKI validator used is the OctoRPKI validator. The OctoRPKI validator is a core component of Cloudflare RPKI (Resource Public Key Infrastructure), which is a third-party credible RPKI validation tool and RPKI database. It is mainly used to perform RPKI relying party software related operations to ensure the security of network routing. The OctoRPKI validator not only provides corresponding data for Cloudflare's RPKI service, but is also used in production environments by multiple networks. By regularly refreshing the data provided by the Regional Internet Registries (RIRs), the OctoRPKI validator can ensure the integrity and accuracy of routing information.

[0098] In one embodiment, referring to Figure 6 , Figure 6 This is a flowchart of an embodiment of the present application providing a method for performing field validity verification on a detection field in event stream data using an RPKI validator to obtain a validity verification result, specifically including the following steps:

[0099] Step 610: Pre-access the verification information interface of the RPKI validator, obtain the routing origin authorization record information, and parse the routing origin authorization record information to obtain validity resolution data, which at least includes the second IP prefix information, the second autonomous domain number information and the validity status.

[0100] In one embodiment, similar to the acquisition process of the detection and resolution data, the validity verification process still requires the pre-acquisition of the validity resolution data. The RPKI verifier can verify the routing origin of the BGP data and ensure the authenticity and integrity of the routing information through encryption and signature mechanisms. The RPKI verifier provides a verification information interface that allows users to query and retrieve authorization records related to the routing origin. In the embodiment of the present application, this verification information interface is accessed in advance to obtain the routing origin authorization record information. The routing origin authorization record information here is the ROAS record information. By parsing the ROAS record information, the IP prefix information, autonomous domain number information and validity status can be obtained to prove whether a certain routing information is legal and authorized. The validity status represents the current status of the routing origin authorization record, for example, including: valid, revoked or pending, which can be used to determine whether the routing information can be trusted. Next, the IP prefix information is used as the second IP prefix information, and the autonomous domain number information is used as the second autonomous domain number information. The validity resolution data is obtained and stored in the database in combination with the validity status.

[0101] Step 620: Search for the IP prefix field and the autonomous domain number field in the event stream data in the validity parsing data. If the IP prefix field and the autonomous domain number field are found in the same validity parsing data and the corresponding validity status indication is valid, generate a validity verification result indicating that the detection field is normal; otherwise, generate a validity verification result indicating that the detection field is abnormal.

[0102] In one embodiment, for each data in the event stream data, data matching is performed in the pre-stored validity resolution data, the IP prefix field is searched in the multiple second IP prefix information, and the autonomous domain number field is searched in the multiple second autonomous domain numbers. If these two detection fields are found in the same validity resolution data, and the corresponding validity status indicates that the current status of the routing origin authorization record is valid, it is considered that there is no abnormality, and a validity verification result indicating that the detection field is normal is generated. Otherwise, a validity verification result indicating that the detection field is abnormal is generated.

[0103] In an embodiment of the present application, ROAS record information is used to verify the origin of BGP routes. ROAS record information relies on encryption and signing mechanisms to ensure the authenticity and integrity of route information. Generally speaking, BGP hijacking occurs in two ways: one is that BGP hijacking often involves unauthorized route announcements, that is, an autonomous system mistakenly or maliciously announces routes that do not belong to it; the other is that BGP hijacking is sometimes caused by incorrect route configuration. For example, an organization may misconfigure its router, causing it to announce routes that do not belong to it. Based on this, ROAS record information can be considered legitimate information. By comparing the second IP prefix information and second autonomous domain number in the ROAS record information with the IP prefix field and autonomous domain number field corresponding to the actual received BGP route update, such unauthorized or erroneous route announcements can be detected. The validity resolution data provides authorization information about the IP prefix and ASN, which can be used to verify the legitimacy of the received BGP route update.

[0104] Step 150: If both the route registration detection result and the validity verification result indicate that the detection field is abnormal, abnormal route information is obtained according to the routing protocol data corresponding to the detection field.

[0105] In one embodiment, to reduce the risk of misjudgment, a suspected hijacking risk is only identified when both the route registration detection results and the validity verification results indicate an abnormality in the detection field. At this point, abnormal routing information is obtained based on the routing protocol data corresponding to the detection field. Furthermore, the obtained abnormal routing information can be stored in a database for subsequent analysis. It is understood that both the detection and validity analysis data are updated in real time to improve the accuracy of anomaly monitoring and address issues such as low detection accuracy and low validity.

[0106] In one embodiment, a further determination process is required for abnormal routing information. When the routing protocol data is abnormal routing information, the routing path sequence field in the routing protocol data is obtained. If at least one of the following conditions is true: the routing length of the routing path sequence field is less than a preset length, the routing path sequence field contains forged data, or the routing path sequence field differs from the expected path sequence, the routing protocol data is confirmed hijacked routing information.

[0107] In other words, the presence of abnormal routing information can be considered a deviation from normal or expected routing behavior. This can include unexpected routing updates, unusual routing paths, or non-standard routing attributes. The routing path sequence field, also known as AS_PATH, records the sequence of autonomous systems (ASs) that a route traverses from its source to its destination. Analysis of the routing path sequence field indicates that a route should normally traverse a certain number of ASs from its source to its destination. If the route length is shorter than the preset length, meaning it is abnormally short, this likely indicates that the route has been hijacked or forged. Alternatively, if the routing path sequence field contains an autonomous area number that does not exist or should not exist, indicating the presence of forged data in the routing path sequence field, this can also indicate BGP hijacking. Furthermore, if the routing path sequence field in a received routing update is inconsistent with the expected path sequence, this may indicate that the routing information has been tampered with or hijacked.

[0108] Therefore, when at least one of the three aforementioned situations occurs, the routing protocol data corresponding to the abnormal routing information can be determined to be confirmed hijacked routing information. This means that by further determining the routing path sequence, the risk of misjudgment can be minimized. It should be noted that the aforementioned process can be either automated or manually inspected, and this is not limited in the present embodiments.

[0109] It can be seen from the above that in the existing BGP real-time monitoring process, there are problems such as low accuracy in determining the results of hijacking events, high requirements for monitoring equipment, high cost, long detection time, and complex use. In response to these problems, an embodiment of the present application provides a routing protocol security detection method, which aims to achieve fast and real-time monitoring of BGP abnormal events. Specifically, through a fast BGP abnormal event flow processing service, the updated routing protocol data is aggregated into multiple independent events, and then a flow service is constructed for these events to obtain event flow data. Subsequently, real-time detection is carried out on the event flow data, thereby forming an abnormal event flow service. When performing detection, the two methods of routing network registration information detection and field validity verification are used to ensure the accuracy of data detection.

[0110] In one embodiment, corresponding functional modules are defined for the different steps of the routing protocol security detection method, and these functional modules are used to construct a routing protocol security detection system. By decoupling traffic flows, data processing, monitoring, storage, and other services can be independently encapsulated into Docker images. Decoupling services is achieved by using independent multi-threaded batch processing. This eliminates the need for complex infrastructure preparation, supports rapid deployment and operation, and addresses issues such as high equipment requirements, high costs, long detection times, and complex use.

[0111] In one embodiment, referring to Figure 7 , Figure 7 It is a schematic diagram of the routing protocol security detection system provided by an embodiment of the present application. First, the data source RIS-Live is used to provide real-time BGP data. Subsequently, the data stream acquisition submodule obtains multiple routing protocol data from the data source, and generates routing detection information based on at least one detection field in the routing protocol data, and writes it to the Kafka server. Next, the data stream acquisition submodule obtains the event stream data generated based on the detection field information in real time through the Kafka server, and stores these data in the database. Finally, the BGP prefix hijacking anomaly detection submodule reads the event stream data from the database into the memory, uses the preset detection instructions to detect the routing network registration information of the detection field in the event stream data, and obtains the routing registration detection result; then uses the RPKI validator to verify the field validity of the detection field in the event stream data to obtain the validity verification result. If both the routing registration detection result and the validity verification result indicate that there is an anomaly in the detection field, the abnormal routing information is obtained based on the routing protocol data corresponding to the detection field.

[0112] Among them, reference Figure 8 , Figure 8 It is a framework diagram of the BGP flow collection submodule provided in the embodiment of the present application. The BGP flow collection submodule includes a BGP data flow access module and a BGP data flow processing module. Specifically, the BGP data flow access module uses a synchronous thread to call the WebSocket interface to obtain the corresponding BGP data, sets the IP prefix field and the autonomous domain number field in the routing protocol data as detection fields, generates a JSON string based on these detection fields, and then obtains the message timestamp in combination with the time information of the routing protocol data, generates routing detection information based on the message timestamp and the JSON string, and finally writes the routing detection information as a Kafka message to the Kafka server. Subsequently, the BGP data flow processing module will obtain the flow data in real time from the Kafka server, and store the event flow data obtained based on the flow data in the database.

[0113] Next, refer to Figure 9 , Figure 9 This is a framework diagram of the BGP prefix hijacking anomaly monitoring submodule provided by the embodiment of the present application. The BGP prefix hijacking anomaly monitoring submodule includes a real-time storage module for routing registration information, a real-time BGP hijacking detection module, and a real-time storage module for routing origin verification.

[0114] Specifically, the real-time storage module for routing registration information pre-acquires the IP address information of the routing protocol data in the data source, then uses the whois probe command to perform a routing network registration information probe on the IP address information, thereby obtaining the probe resolution data. Next, the event stream data in the database is continuously scanned and read into memory, and the IP prefix field and autonomous domain number field in the event stream data are searched within the probe resolution data. If the IP prefix field and autonomous domain number field can be found in the same probe resolution data, a routing registration test result is generated indicating that the detection field is normal; otherwise, a routing registration test result is generated indicating that the detection field is abnormal.

[0115] The real-time storage module for route origin verification pre-accesses the verification information interface of the RPKI validator to obtain the route origin authorization record information and parses it to obtain validity resolution data. Next, the validity resolution data is searched for the IP prefix field and autonomous domain number field in the event stream data. If the IP prefix field and autonomous domain number field can be found in the same validity resolution data and the corresponding validity status indicates valid, a validity verification result is generated indicating that the detection field is normal; otherwise, a validity verification result is generated indicating that the detection field is abnormal.

[0116] Finally, the real-time BGP hijack detection module obtains route registration detection and validity verification results in real time, quickly filtering out possible anomalies to achieve real-time processing capabilities. The specific anomaly determination process is as follows: If both the route registration detection and validity verification results indicate an anomaly in the detection field, the anomalous route information is derived based on the routing protocol data corresponding to the detection field.

[0117] The technical solution provided by the embodiment of the present application is to obtain multiple routing protocol data from a data source, generate routing detection information based on at least one detection field in the routing protocol data and write it to the Kafka server, then obtain the event stream data generated based on the detection field information in real time in the Kafka server, use the preset detection instruction to detect the routing network registration information of the detection field in the event stream data, obtain the routing registration detection result, and then use the RPKI validator to verify the field validity of the detection field in the event stream data to obtain the validity verification result. If the routing registration detection result and the validity verification result both indicate that the detection field is abnormal, the abnormal routing information is obtained according to the routing protocol data corresponding to the detection field. In the embodiment of the present application, a stream processing mechanism is used to aggregate the routing protocol data corresponding to a large amount of Border Gateway Protocol (BGP) in the data source into multiple events, and then generate an event stream service with the help of the Kafka server, so as to reduce the actual detection data volume and achieve the purpose of rapid detection. At the same time, the detection accuracy is improved by performing double detection through the routing network registration information detection and the resource public key infrastructure (RPKI) validity verification process. This method mainly performs data matching, and has lower requirements on computing equipment than model prediction and other methods, which can reduce the complexity of detection.

[0118] The present application also provides a routing protocol security detection device, which can implement the above routing protocol security detection method. Figure 10 , the device comprises:

[0119] Data acquisition module 1010: used to obtain multiple routing protocol data from a data source, and generate routing detection information based on at least one detection field in the routing protocol data and write it into the Kafka server.

[0120] The event generation module 1020 is used to obtain event stream data in real time in the Kafka server. The event stream data is obtained based on at least one routing detection information included in a preset event period.

[0121] The first detection module 1030 is configured to detect routing network registration information on the detection field in the event stream data using a preset detection instruction to obtain a routing registration detection result.

[0122] The second detection module 1040 is configured to perform field validity verification on the detection field in the event stream data using the RPKI validator to obtain a validity verification result.

[0123] Abnormality judgment module 1050: used to obtain abnormal routing information based on routing protocol data corresponding to the detection field if both the routing registration detection result and the validity verification result indicate that the detection field is abnormal.

[0124] The specific implementation of the routing protocol security detection device of this embodiment is basically the same as the specific implementation of the routing protocol security detection method described above, and will not be repeated here.

[0125] An embodiment of the present application further provides an electronic device, including:

[0126] at least one memory;

[0127] at least one processor;

[0128] at least one program;

[0129] The program is stored in the memory, and the processor executes the at least one program to implement the routing protocol security detection method implemented in this application. The electronic device can be any smart terminal including a mobile phone, a tablet computer, a personal digital assistant (PDA), an in-vehicle computer, etc.

[0130] See also Figure 11 , Figure 11 The hardware structure of an electronic device according to another embodiment is shown. The electronic device includes:

[0131] The processor 1101 may be implemented as a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is configured to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0132] The memory 1102 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1102 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1102, and the processor 1101 calls and executes the routing protocol security detection method of the embodiment of the present application.

[0133] Input / output interface 1103, used to implement information input and output;

[0134] Communication interface 1104, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.); and

[0135] Bus 1105 , which transmits information between various components of the device (e.g., processor 1101 , memory 1102 , input / output interface 1103 , and communication interface 1104 );

[0136] The processor 1101 , the memory 1102 , the input / output interface 1103 and the communication interface 1104 are connected to each other in communication within the device via a bus 1105 .

[0137] An embodiment of the present application further provides a storage medium, which is a storage medium that stores a computer program. When the computer program is executed by a processor, the above-mentioned routing protocol security detection method is implemented.

[0138] The memory, as a non-transient storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0139] The routing protocol security detection method, apparatus, device and storage medium proposed in the embodiment of the present application obtain multiple routing protocol data from a data source, and generate routing detection information based on at least one detection field in the routing protocol data and write it into the Kafka server, then obtain the event stream data generated based on the detection field information in real time in the Kafka server, use the preset detection instruction to detect the routing network registration information of the detection field in the event stream data, obtain the routing registration detection result, and then use the RPKI validator to verify the field validity of the detection field in the event stream data to obtain the validity verification result. If the routing registration detection result and the validity verification result both indicate that the detection field is abnormal, the abnormal routing information is obtained according to the routing protocol data corresponding to the detection field. In the embodiment of the present application, a stream processing mechanism is used to aggregate the routing protocol data corresponding to a large amount of Border Gateway Protocol (BGP) in the data source into multiple events, and then generate an event stream service with the help of the Kafka server, so as to reduce the amount of data actually detected and achieve the purpose of rapid detection. At the same time, double detection is performed through the routing network registration information detection and resource public key infrastructure (RPKI) validity verification process to improve detection accuracy. This method mainly performs data matching. Compared with model prediction and other methods, it has lower requirements for computing equipment and can reduce the complexity of detection.

[0140] The embodiments described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0141] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0142] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0143] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0144] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0145] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0146] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the above-mentioned units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0147] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0148] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0149] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: various media that can store programs, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0150] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present invention should be within the scope of the present invention.

Claims

1. A routing protocol security detection method, characterized in that: include: Acquire multiple routing protocol data from a data source, and generate routing detection information based on at least one detection field in the routing protocol data and write it into a Kafka server; Acquire event stream data in real time in the Kafka server, where the event stream data is obtained based on at least one piece of routing detection information included in a preset event period; Using a preset detection instruction to detect routing network registration information on the detection field in the event stream data, to obtain a routing registration detection result; Using an RPKI validator to perform field validity verification on the detection field in the event stream data to obtain a validity verification result; If both the routing registration detection result and the validity verification result indicate that the detection field is abnormal, abnormal routing information is obtained according to routing protocol data corresponding to the detection field.

2. The routing protocol security detection method according to claim 1, characterized in that: Generating routing detection information according to at least one detection field in the routing protocol data and writing it into the Kafka server includes: Obtaining the IP prefix field and the autonomous domain number field in the routing protocol data as the detection field, and obtaining a JSON string according to the detection field; Obtaining a message timestamp according to the time information of the routing protocol data; The route detection information is obtained based on the message timestamp and the JSON string, and the route detection information is written into the Kafka server as a Kafka message.

3. The routing protocol security detection method according to claim 1, wherein: Acquiring at least one piece of routing detection information based on a preset event period to obtain event stream data includes: Obtaining key information aggregation data according to the detection field corresponding to each of the routing detection information; When the time interval is greater than or equal to the event period, obtaining at least one key information aggregate data within the event period as the event stream data; When the time interval is less than the event period, the intermediate event table is updated based on the update time interval, the start time and at least one of the key information aggregation data until the time interval is greater than or equal to the event period, and the event stream data is obtained from the intermediate event table.

4. The routing protocol security detection method according to claim 2, characterized in that: The preset detection instruction is a whois detection instruction, and the use of the preset detection instruction to detect the routing network registration information of the detection field in the event stream data to obtain the routing registration detection result includes: Pre-acquire the IP address information of the routing protocol data in the data source, and use the whois detection instruction to detect the routing network registration information of the IP address information to obtain detection resolution data, wherein the detection resolution data includes at least first IP prefix information and first autonomous domain number information; The IP prefix field and the autonomous domain number field in the event stream data are searched in the detection and parsing data. If the IP prefix field and the autonomous domain number field are found in the same detection and parsing data, the routing registration detection result indicating that the detection field is normal is generated; otherwise, the routing registration detection result indicating that the detection field is abnormal is generated.

5. The routing protocol security detection method according to claim 2, characterized in that: The using the RPKI validator to perform field validity verification on the detection field in the event stream data to obtain a validity verification result includes: Accessing the verification information interface of the RPKI validator in advance, obtaining routing origin authorization record information, and parsing the routing origin authorization record information to obtain validity parsing data, the validity parsing data including at least the second IP prefix information, the second autonomous domain number information, and the validity status; The IP prefix field and the autonomous domain number field in the event stream data are searched in the validity parsing data. If the IP prefix field and the autonomous domain number field are found in the same validity parsing data and the corresponding validity status indication is valid, the validity verification result indicating that the detection field is normal is generated; otherwise, the validity verification result indicating that the detection field is abnormal is generated.

6. The routing protocol security detection method according to claim 1, characterized in that: The obtaining of a plurality of routing protocol data from a data source includes: Generate synchronization threads corresponding to the data synchronization points one by one according to the number of the data synchronization points of the data source; The routing protocol data is acquired from the corresponding data synchronization point in a multi-threaded parallel manner.

7. The routing protocol security detection method according to claim 2, characterized in that: The method further comprises: When the routing protocol data is abnormal routing information, obtaining a routing path sequence field in the routing protocol data; When it is determined that at least one of the routing length of the routing path sequence field is less than a preset length, the routing path sequence field contains forged data, or the routing path sequence field is different from the expected path sequence, the routing protocol data is confirmed hijacking routing information.

8. A routing protocol security detection device, characterized in that: include: Data acquisition module: used to obtain multiple routing protocol data from the data source, and generate routing detection information based on at least one detection field in the routing protocol data and write it into the Kafka server; An event generation module is configured to obtain event stream data in real time from the Kafka server, wherein the event stream data is obtained based on at least one piece of routing detection information contained in a preset event period; A first detection module is configured to detect routing network registration information on the detection field in the event stream data using a preset detection instruction to obtain a routing registration detection result; A second detection module is configured to perform field validity verification on the detection field in the event stream data using an RPKI validator to obtain a validity verification result; Abnormality judgment module: used for obtaining abnormal routing information according to routing protocol data corresponding to the detection field if both the routing registration detection result and the validity verification result indicate that the detection field is abnormal.

9. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the routing protocol security detection method according to any one of claims 1 to 7 when executing the computer program.

10. A storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the routing protocol security detection method according to any one of claims 1 to 7 is implemented.

Images