BGP anomaly detection and traceability method based on BGP graph

Abstract

The invention discloses a BGP (Border Gateway Protocol) anomaly detection and tracing method based on a BGP graph, which comprises the following steps: data acquisition and initial topology construction: acquiring BGP routing data based on global acquisition points, including BGP routing table data and BGP routing update data; constructing an initial global BGP (Border Gateway Protocol) network topology according to the collected routing data; an incremental updating mechanism is put forward, and according to different conditions of BGP messages, including explicit declaration, explicit revocation and implicit revocation, three graph updating mechanisms are respectively adopted to dynamically update the BGP network topology; extracting topological features and constructing a BGP embedded graph; and finally, inputting the BGP embedded graph into a graph convolutional neural network model, and carrying out anomaly detection in combination with node attributes, edge attributes and adjacency relations in a multi-order neighborhood aggregation mode. And if the detection result is abnormal, performing abnormal traceability, and positioning an abnormal AS set through feature space compression and expansion. According to the method provided by the invention, BGP anomaly detection and traceability analysis can be more accurately carried out.

Description

Technical Field

[0001] The present invention relates to the technical field of inter-domain anomaly detection in inter-domain routing security, and in particular to a BGP anomaly detection and tracing method based on a BGP graph. Background Art

[0002] The Border Gateway Protocol (BGP) is the basic guarantee for the interconnection of global autonomous systems. However, it lacked a security authentication mechanism at the beginning of its design, resulting in frequent BGP anomalies. Among them, large-scale BGP anomalies are characterized by fast propagation speed and wide range, posing a huge threat to global inter-domain routing security. BGP anomaly detection detects anomalies through active and passive routing data, and further locates suspicious routing information, including prefixes and autonomous systems (AS), so that operation and maintenance personnel can quickly trace and mitigate anomalies. However, in the face of AS network topologies with huge scale and a large number of connections, accurate anomaly detection and location cannot be performed by existing methods alone. Therefore, it is necessary to conduct research on BGP anomaly detection and tracing mechanisms based on the topology constructed by connections between ASs, monitor the global BGP operation status in real time, and conduct tracing analysis to ensure national inter-domain network security.

[0003] This type of method usually uses massive amounts of BGP historical routing data, analyzes historical BGP routing behavior rules and patterns as prior knowledge, detects BGP routing messages sent by AS, effectively identifies BGP anomalies and traces them. However, existing anomaly detection methods still have much room for improvement in terms of real-time, accuracy, and intelligence. At its core, there are three main problems: 1) The collected data is biased and incomplete; 2) Dynamic changes in BGP routing behavior; 3) The BGP network is a distributed system and is large in scale. Summary of the invention

[0004] In view of the deficiencies of the prior art, the present invention discloses a BGP anomaly detection and tracing method based on a BGP graph to solve the problems raised in the above background technology.

[0005] To achieve the above object, the present invention provides the following technical solution: a BGP anomaly detection and tracing method based on a BGP graph, characterized in that it comprises the following steps: Step 1: Data collection and initial topology construction, including: S11. Collect BGP routing data based on global collection points, including BGP routing table (RIB table) data and BGP routing update data; S12, constructing an initial global BGP network topology based on the collected routing data; Step 2: An incremental update mechanism is proposed. According to different situations of BGP messages, including explicit announcement, explicit withdrawal and implicit withdrawal, three graph update mechanisms are adopted to dynamically update the BGP network topology to ensure the real-time and accuracy of the topology. Step 3: Extract topological features and construct BGP embedding graph, including: S31, calculate the node information of the topology, including the node's out-degree, in-degree and Pagerank value; S32, calculate the edge information of the topology, including the number of prefixes flowing through the AS; S33, extracting graph-related features based on node information and edge information, including edge features, local topology features, global topology features, and path-related features; S34, constructing a BGP embedding graph based on the extracted features; Step 4: Anomaly detection and tracing, including: The BGP embedding graph is input into the Graph Convolutional Network (GCN) model, and anomaly detection is performed by combining node attributes, edge attributes, and adjacency relationships through multi-order neighborhood aggregation. If the detection result is abnormal, the abnormality is traced and the abnormal AS set is located through feature space compression and expansion.

[0006] Preferably, in step 2, the specific steps include: S21. First, according to the BGP routing table R t-1 Build the initial global routing topology ; S22, then, according to the routing update message at that moment Update the global routing topology to get the routing topology at that moment ; Among them, when the topology is updated, it is divided into three categories, including: explicit declaration, explicit revocation and implicit revocation; for each given time t No. i Routing Update Messages : 1) Explicit revocation is when the operation attribute in the routing update message is revocation W Operation, while in the routing table R Prefix p Exists, which can be expressed in the form of:

[0007] in, Indicated int Routing table at time R t Prefix p The corresponding route, R t represents the routing table at time t; in this case, G ( t-1 ) The AS connection is deleted. G ( t - 1 ) represents the BGP network topology at time t-1; 2) Explicitly announce the existence of a routing update message The operational attributes are declared A ,in, A Represents the adjacency matrix of the BGP graph; and t Prefix of time p Routing table Is empty, the formula is expressed as:

[0008] Among them, in the case of display declaration, G ( t-1 ) Add the AS connection in; 3) Implicit revocation of routing update messages as announcement messages, and Not empty, and the route attributes in the route update message do not belong to t Time prefix p The route collection In the formula, it is expressed as:

[0009] Among them, in the case of implicit revocation, In Add the AS connection in the routing table and Delete the AS connection in the system.

[0010] Preferably, in step 4, anomaly detection and tracing specifically includes the following steps: S41. Input the node attributes, edge attributes and topological adjacency relationships into the graph convolutional neural network, which can be expressed as:

[0011]

[0012] in, F (l+1) Represents the graph convolutional neural network lThe output of the +1 layer is a R N×H The matrix of N represents the number of nodes in the graph, H Represents the dimension of the layer features, that is, the number of features each node has, D represents the degree matrix, A represents the adjacency matrix of the BGP graph, F (l) Represents the graph convolutional neural network l The output of the layer, σ represents the activation function, Indicates l The learnable parameter matrix of the layer, Represents a connection matrix with weighted self-loops; in, is defined as: When the side e ij =1, that is, node i and nodes j When there is a connection between ,here w ij Represents edge e ij The weight of When the side e ij =0, that is, node i and nodes j When there is no connection between ; S42. Pool the output result obtained by graph convolution and aggregate multi-order neighborhoods, which can be expressed as follows:

[0013]

[0014]

[0015] in, and Represent the average pooling and maximum pooling operations respectively, F ih In i Represents the node attribute matrix F No. i OK; The final result is Represents the BGP graph g of l The superposition of two pooling operations in the layer; S43. Graph convolutional neural networks have hierarchical local learning capabilities. In order to integrate multi-neighborhood knowledge, local and global information are integrated, and multi-level graph convolution learning knowledge is integrated to finally obtain the output representation: ; S44, will F g Input into the multi-layer perceptron for softmax operation to obtain predictable probability p :

[0016] During the iterative back-propagation process, the model parameters are optimized using cross-entropy loss.

[0017] Preferably, in step 4, if the detection result is abnormal, the abnormality is traced and located by using the auto-encoder model framework, the encoder is used to compress the data in the feature space, the decoder is used to expand the feature space, and the mean square error loss is used. l b Optimize the traceability model parameters and formulate them as follows:

[0018]

[0019] in, It means that the decoder in the autoencoder n The reconstructed feature output of samples is Indicates the representative n The original features of the samples, V Represents a set of nodes in a BGP graph; And in the process of tracing and locating, the normalized deviation is used get:

[0020] in, It is n The normalized deviation of samples, and Respectively represent estimated values b i The median and interquartile range; By abnormal AS collection V a The calculation results are:

[0021] in,{ v n} is a collectionV a , where v n Represents the first n abnormal AS; k It is a pre-set hyperparameter used to determine the number of abnormal ASs to be selected.

[0022] Compared with the prior art, the present invention has the following beneficial effects: 1. In the present invention, the BGP topology is abstracted into a graph model, and a mechanism for incrementally updating the BGP graph based on BGP routing information is proposed. This mechanism can overcome the shortcoming that the BGP graph cannot be updated in time, thereby accurately and in real time updating the BGP graph. This BGP graph incremental update mechanism, based on different situations of BGP messages, namely explicit announcement, explicit revocation and implicit revocation, respectively adopts three graph update mechanisms, namely adding and deleting AS connection relationships, so as to accurately update the BGP graph model, and construct a real-time BGP dynamic graph based on the graph update mechanism, and select the optimal node attributes and edge attributes to form a BGP graph embedding model.

[0023] 2. The present invention proposes a BGP anomaly detection method based on graph convolution. Node attributes and edge attributes are embedded into the graph model, in which the multi-order neighborhood aggregation method is used to perceive the occurrence of BGP abnormal behavior as much as possible in combination with the changes of multiple neighbors. The graph convolution model not only inputs node attributes and adjacency matrix, but also inputs edge attributes, so that the model can more accurately capture the abnormal behavior of AS.

[0024] 3. In the present invention, an auto-encoder architecture is used to construct an abnormality tracing model. The detection model is used as the pre-training model of the encoder to reduce the training time. In addition, the node-level deviation loss is designed to be combined with the structural loss, so that when an abnormality occurs, the abnormal AS can be traced. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0026] In the attached picture: Figure 1 It is a flow chart of a BGP anomaly detection and tracing method based on a BGP graph of the present invention; Figure 2 is a flow chart of calculating BGP anomaly detection of the present invention; Figure 3 It is an exception tracing flow chart based on auto-encoder of the present invention; Figure 4Schematic diagram of specific performance indicators of the method of the present invention and the comparative method under real data sets and balanced data sets, wherein the upper figure represents the real data set and the lower figure represents the balanced data set. DETAILED DESCRIPTION

[0027] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0028] Example: Figure 1 As shown, a BGP anomaly detection and tracing method based on a BGP graph is characterized by comprising the following steps: Step 1: Data collection and initial topology construction, including: S11. Collect BGP routing data based on global collection points, including BGP routing table (RIB table) data and BGP routing update data; S12. Construct an initial global BGP network topology based on the collected routing data.

[0029] Step 2: Propose an incremental update mechanism. According to different situations of BGP messages, including explicit announcement, explicit withdrawal and implicit withdrawal, three graph update mechanisms are adopted to dynamically update the BGP network topology to ensure the real-time and accuracy of the topology.

[0030] Step 3: Extract topological features and construct BGP embedding graph, including: S31, calculate the node information of the topology, including the node's out-degree, in-degree and Pagerank value; S32, calculate the edge information of the topology, including the number of prefixes flowing through the AS; S33, extracting graph-related features based on node information and edge information, including edge features, local topology features, global topology features, and path-related features; S34. Based on the extracted features, construct a BGP embedding graph.

[0031] Step 4: Anomaly detection and tracing, including: The BGP embedding graph is input into the Graph Convolutional Network (GCN) model, and anomaly detection is performed by combining node attributes, edge attributes, and adjacency relationships through multi-order neighborhood aggregation. If the detection result is abnormal, the abnormality is traced and the abnormal AS set is located through feature space compression and expansion.

[0032] Furthermore, in step 2, the specific steps include: S21. First, according to the BGP routing table Rt-1 Build the initial global routing topology ; S22, then, according to the routing update message at that moment Update the global routing topology to get the routing topology at that moment ; Among them, when the topology is updated, it is divided into three categories, including: explicit declaration, explicit revocation and implicit revocation; for each given time t No. i Routing Update Messages : 1) Explicit revocation is when the operation attribute in the routing update message is revocation W Operation, while in the routing table R Prefix p Exists, which can be expressed in the form of:

[0033] in, Indicated in t Routing table at time R t Prefix p The corresponding route, R t represents the routing table at time t; in this case, G ( t-1 ) The AS connection is deleted. G ( t - 1 ) indicates time t -1 BGP network topology diagram.

[0034] 2) Explicitly announce the existence of a routing update message The operational attributes are declared A ,in, A Represents the adjacency matrix of the BGP graph; and t Prefix of time p Routing table Is empty, the formula is expressed as:

[0035] Among them, in the case of display declaration, G ( t-1 ) Add the AS connection in.

[0036] 3) Implicit revocation of routing update messages as announcement messages, and Not empty, and the route attributes in the route update message do not belong to tTime prefix p The route collection In the formula, it is expressed as:

[0037] Among them, in the case of implicit revocation, In Add the AS connection in the routing table and Delete the AS connection in the system.

[0038] Furthermore, if Figure 2 As shown, in step 4, anomaly detection and tracing specifically include the following steps: S41, which means inputting node attributes, edge attributes and topological adjacency relationships into the graph convolutional neural network, is formulated as:

[0039]

[0040] in, F (l+1) Represents the graph convolutional neural network l The output of the +1 layer is a R N×H The matrix of N represents the number of nodes in the graph, H Represents the dimension of the layer features, that is, the number of features each node has, D represents the degree matrix, A represents the adjacency matrix of the BGP graph, F (l) Represents the graph convolutional neural network l The output of the layer, σ represents the activation function, Indicates l The learnable parameter matrix of the layer, Represents a connection matrix with weighted self-loops; in, is defined as: When the side e ij =1, that is, node i and nodes j When there is a connection between ,here w ij Represents edge e ij The weight of When the side e ij =0, that is, node i and nodes jWhen there is no connection between .

[0041] S42. Pool the output result obtained by graph convolution and aggregate multi-order neighborhoods, which can be expressed as follows:

[0042]

[0043]

[0044] in, and Represent the average pooling and maximum pooling operations respectively, F ih In i Represents the node attribute matrix F No. i OK; The final result is Represents the BGP graph g of l The superposition of two pooling operations in the layer; S43. Graph convolutional neural networks have hierarchical local learning capabilities. In order to integrate multi-neighborhood knowledge, local and global information are integrated, and multi-level graph convolution learning knowledge is integrated to finally obtain the output representation: ; S44, will F g Input into the multi-layer perceptron for softmax operation to obtain predictable probability p :

[0045] During the iterative back-propagation process, the model parameters are optimized using cross-entropy loss.

[0046] Furthermore, if Figure 3 As shown in step 4, if the detection result is abnormal, the auto-encoder model framework is used to trace and locate the abnormality, the encoder is used to compress the data in the feature space, and the decoder is used to expand the feature space. In the end, the input and output are expected to be as close as possible, and the mean square error loss is used. l b Optimize the traceability model parameters and formulate them as follows:

[0047]

[0048] in, It means that the decoder in the autoencoder n The reconstructed feature output of samples is Indicates the representative n The original features of the samples, V Represents a set of nodes in a BGP graph; And in the process of tracing and locating, the normalized deviation is used get:

[0049] in, It is n The normalized deviation of samples, and Respectively represent estimated values b i The median and interquartile range; The normalized deviation b n The calculation formula is as follows:

[0050] in, x n Indicates n The characteristic value of samples; median( x ) represents the median of all sample feature values; IQR( x ) represents the interquartile range of all sample feature values, that is, the difference between the upper quartile (Q3) and the lower quartile (Q1), and the calculation formula is:

[0051] And through the abnormal AS collection V a The calculation results are:

[0052] in,{ v n} is a collection V a , where v n Represents the first n abnormal AS; k It is a pre-set hyperparameter used to determine the number of abnormal ASs to be selected.

[0053] The simulation results are as follows: In order to detect the effect of anomaly detection of the proposed BGP graph-based anomaly detection and tracing method under global real data, the present invention uses RIPENCC and RouteView global public collection points to collect BGP routing data. In the constructed dataset, based on the grid search results, 1 minute is used as the time window to construct a data sample. Then the data is labeled according to the occurrence time of the actual abnormal event and the reported abnormal routing information. The simulation experiment platform is Python 3.10 software under the Linux system (the analysis results of the present invention are not affected by the operating system and Python software version). In addition, the geographic location and ranking information of AS are obtained from the official authoritative data of Caida.

[0054] from Figure 4 It can be seen from the table that the specific performance indicators of the proposed method and the comparison method are in real data sets and balanced data sets. Figure 4 In the figure above, compared with other methods, the proposed method has higher accuracy and F1 score, as well as lower false positive rate and false negative rate in real data sets; Figure 4 In the figure below, compared with other methods, the proposed method also has higher accuracy and F1 score, as well as lower false positive rate and false negative rate in the balanced data set, which shows that the proposed method has higher robustness in anomaly detection than other methods.

[0055] It can be seen from the above experimental results that the anomaly detection and tracing method based on BGP graph proposed in the present invention can detect BGP anomalies and trace the source more accurately.

[0056] Finally, it should be noted that the above description is only a preferred example of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A BGP anomaly detection and tracing method based on a BGP graph, characterized in that: The following steps are involved: Step 1: Data collection and initial topology construction, including: S11. Collect BGP routing data based on global collection points, including BGP routing table data and BGP routing update data; S12, constructing an initial global BGP network topology based on the collected routing data; Step 2: An incremental update mechanism is proposed. According to different situations of BGP messages, including explicit announcement, explicit withdrawal and implicit withdrawal, three graph update mechanisms are adopted to dynamically update the BGP network topology. Step 3: Extract topological features and construct BGP embedding graph, including: S31, calculate the node information of the topology, including the node's out-degree, in-degree and Pagerank value; S32, calculate the edge information of the topology, including the number of prefixes flowing through the AS; S33, extracting graph-related features based on node information and edge information, including edge features, local topology features, global topology features, and path-related features; S34, constructing a BGP embedding graph based on the extracted features; Step 4: Anomaly detection and tracing, including: The BGP embedding graph is input into the graph convolutional neural network model, and anomaly detection is performed by combining node attributes, edge attributes and adjacency relationships through multi-order neighborhood aggregation. If the detection result is abnormal, the abnormality is traced and the abnormal AS set is located through feature space compression and expansion.

2. The BGP anomaly detection and tracing method based on BGP graph according to claim 1, characterized in that: In step 2, the specific steps include: S21. First, build the initial global routing topology based on the BGP routing table ; S22, then, according to the routing update message at that moment Update the global routing topology to get the routing topology at that moment .

3. The BGP anomaly detection and tracing method based on BGP graph according to claim 2, characterized in that: When the topology is updated, there are three cases, including explicit declaration, explicit revocation, and implicit revocation. For each given time t No. i Routing Update Messages .

4. The BGP anomaly detection and tracing method based on BGP graph according to claim 3 is characterized in that: Explicit revocation is the operation attribute in the routing update message with the revocation attribute W Operation, while in the routing table R Prefix p Exists, which can be expressed in the form of: ； in, Indicated in t Routing table at time R t Prefix p The corresponding route, R t Indicates time t In this case, the routing table of G ( t-1 ) The AS connection is deleted. G ( t - 1 ) indicates time t -1 BGP network topology diagram.

5. The BGP anomaly detection and tracing method based on BGP graph according to claim 3 is characterized in that: Explicit announcement of the existence of routing update messages The operational attributes are declared A ,in, A Represents the adjacency matrix of the BGP graph; and t Prefix of time p Routing table Is empty, the formula is: ； Among them, in the case of display declaration, G ( t-1 ) Add the AS connection in.

6. The BGP anomaly detection and tracing method based on BGP graph according to claim 3, characterized in that: Implicit revocation is a routing update message for an announcement message, and Not empty, and the route attributes in the route update message do not belong to t Time prefix p The route collection In the formula, it is expressed as: ； Among them, in the case of implicit revocation, In Add the AS connection in the routing table and Delete the AS connection in the system.

7. The BGP anomaly detection and tracing method based on BGP graph according to claim 1, characterized in that: In step 4, anomaly detection and tracing includes the following steps: S41. Input the node attributes, edge attributes and topological adjacency relationships into the graph convolutional neural network, which can be expressed as: ； ； in, F (l+1) Represents the graph convolutional neural network l The output of the +1 layer is a R N×H The matrix of N represents the number of nodes in the graph, H Represents the dimension of the layer features, that is, the number of features each node has, D represents the degree matrix, A represents the adjacency matrix of the BGP graph, F (l) Represents the graph convolutional neural network l The output of the layer, σ represents the activation function, Indicates l The learnable parameter matrix of the layer, Represents a connection matrix with weighted self-loops; in, is defined as: When the side e ij =1, that is, node i and nodes j When there is a connection between ,here w ij Represents edge e ij The weight of When the side e ij =0, that is, node i and nodes j When there is no connection between ; S42. Pool the output result obtained by graph convolution and aggregate multi-order neighborhoods, which can be expressed as follows: ； ； ； in, and Represent the average pooling and maximum pooling operations respectively, F ih In i Represents the node attribute matrix F No. i OK; The final result is Represents the BGP graph g of l The superposition of two pooling operations in the layer; S43, integrate the multi-level graph convolution learning knowledge and finally get the output representation: ； S44, will F g Input into the multi-layer perceptron for softmax operation to obtain predictable probability p : ； During the iterative back-propagation process, the model parameters are optimized using cross-entropy loss.

8. The BGP anomaly detection and tracing method based on BGP graph according to claim 1, characterized in that: In step 4, if the detection result is abnormal, the auto-encoder model framework is used to trace and locate the abnormality, the encoder is used to compress the data in the feature space, the decoder is used to expand the feature space, and the mean square error loss is used. l b Optimize the traceability model parameters and formulate them as follows: ； ； in, It means that the decoder in the autoencoder n The reconstructed feature output of samples, Indicates the representative n The original features of the samples, V Represents a set of nodes in a BGP graph; And in the process of tracing and locating, the normalized deviation is used get: ； in, It is n The normalized deviation of samples, and Respectively represent estimated values b n The median and interquartile range; By abnormal AS collection V a The calculation results are: ； in,{ v n } is a collection V a , where v n Represents the first n abnormal AS; k It is a pre-set hyperparameter used to determine the number of abnormal ASs to be selected.

Images