Regional network boundary interruption detection method, device, electronic device and storage medium

Abstract

The present application provides a regional network boundary, device, electronic device and storage medium, including: determining a target area and autonomous systems within the target area, screening the autonomous systems within the target area, and determining a target autonomous system set; collecting data from a routing message collector based on the target autonomous system set to determine a regional network connection relationship data set and a regional network prefix path data set; collecting data from the routing message collector based on the target autonomous system set to determine a routing update dump file; determining a peer number time series based on the routing update dump file, the regional network connection relationship data set and the regional network prefix path data set; and inputting the peer number time series into a pre-trained anomaly detection model to determine an interruption detection result.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, electronic device and storage medium for detecting regional network boundary interruption. Background Art

[0002] The Internet is composed of thousands of independent and autonomous systems. An autonomous system is a small unit that has the authority to independently determine which routing protocols to use within its system. End-to-end host traffic may traverse multiple autonomous systems, which in turn are owned by different organizations and, in turn, by different regions or countries. The inter-domain routing protocol (BGP) is the infrastructure of current cyberspace, providing a communication mechanism between autonomous systems and controlling the forwarding of inter-domain traffic, playing a vital role in the operation of the Internet. However, inter-domain routing protocols can cause routing disruptions between regional networks and external networks in the event of emergencies such as network equipment failures, cyberattacks, or natural disasters. These incidents are known as regional network border routing disruptions. Major regional network border routing disruptions can seriously endanger the normal operation of inter-domain network infrastructure and may even disrupt a country's connection to the global Internet. Therefore, monitoring regional network border routing disruptions is a crucial prerequisite for ensuring the normal operation of regional networks.

[0003] However, the conventional detection method of sending a large number of detection messages to the network to be detected has a detection blind spot and increases the network burden and the consumption of equipment resources. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a method, device, electronic device and storage medium for detecting regional network boundary interruption.

[0005] Based on the above objectives, the present application provides a method for detecting regional network boundary interruption, comprising:

[0006] Determine the target area and the autonomous systems within the target area, screen the autonomous systems within the target area, and determine the target autonomous system set;

[0007] Collecting data from a routing message collector according to the target autonomous system set to determine a regional network connection relationship dataset and a regional network prefix path dataset;

[0008] Performing data collection on a routing message collector according to the target autonomous system set, determining a routing update dump file, and determining a time series of the number of peers according to the routing update dump file, the regional network connection relationship dataset, and the regional network prefix path dataset;

[0009] The peer quantity time series is input into a pre-trained anomaly detection model to determine an outage detection result.

[0010] Optionally, screening the autonomous systems in the target area to determine the target autonomous system includes:

[0011] Determining routing information of the autonomous system within a target area, and determining a plurality of target autonomous systems based on the routing information;

[0012] The target autonomous system set is determined according to the multiple target autonomous systems.

[0013] Optionally, the routing information includes current routing information and initial routing information;

[0014] Determining the target autonomous system according to the routing information includes:

[0015] In response to determining that the current routing information of the autonomous system is the same as the initial routing information, determining the autonomous system as the target autonomous system;

[0016] In response to determining that the current routing information and the initial routing information of the autonomous system are not the same, the autonomous system is ignored.

[0017] Optionally, collecting data from a routing message collector according to the target autonomous system set to determine a regional network connection relationship dataset and a regional network prefix path dataset includes:

[0018] Collecting data from a routing message collector according to the target autonomous system set to determine a current routing snapshot dump file of the target area;

[0019] According to the current routing snapshot dump file, a regional network connection relationship dataset and a regional network prefix path dataset are determined.

[0020] Optionally, the routing update dump file includes a routing withdrawal file and a routing announcement file;

[0021] Determining the time series of the number of peers according to the routing update dump file, the regional network connection relationship data set, and the regional network prefix path data set includes:

[0022] In response to determining that the routing update dump file is the routing fallback file, determining the peer quantity time series according to the routing fallback file, the regional network connection relationship dataset, and the regional network prefix path dataset;

[0023] In response to determining that the routing update dump file is the routing announcement file, the peer quantity time series is determined according to the routing announcement file, the regional network connection relationship dataset, and the regional network prefix path dataset.

[0024] Optionally, the anomaly detection model is a long short-term memory network;

[0025] Inputting the peer quantity time series into a pre-trained anomaly detection model to determine an interruption detection result includes:

[0026] The peer quantity time series is input into the long short-term memory network to determine the interruption detection result.

[0027] Optionally, the method further includes:

[0028] Determine when the disruption occurred;

[0029] Determine a connection relationship data set, and determine the network connection relationship before the interruption and the network connection relationship at the time of the interruption according to the occurrence time and the connection relationship data set;

[0030] The network connection relationship before the interruption is compared with the network connection relationship during the interruption to determine the autonomous system where the interruption occurs.

[0031] Based on the same inventive concept, an embodiment of the present application further provides a regional network boundary interruption detection device, comprising:

[0032] a screening module configured to determine a target area and autonomous systems within the target area, screen the autonomous systems within the target area, and determine a target autonomous system set;

[0033] A first data collection module is configured to collect data from a routing message collector according to the target autonomous system set, and determine a regional network connection relationship dataset and a regional network prefix path dataset;

[0034] a second data collection module configured to collect data from a routing message collector according to the target autonomous system set, determine a routing update dump file, and determine a time series of the number of peers based on the routing update dump file, the regional network connection relationship dataset, and the regional network prefix path dataset;

[0035] The detection module is configured to input the peer quantity time series into a pre-trained anomaly detection model to determine an interruption detection result.

[0036] Based on the same inventive concept, an embodiment of the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the processor executes the program, it implements the regional network boundary interruption detection method as described in any one of the above items.

[0037] Based on the same inventive concept, an embodiment of the present application further provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute any of the above-mentioned regional network boundary interruption detection methods.

[0038] Based on the same inventive concept, an embodiment of the present application further provides a computer program product, including computer program instructions. When the computer program instructions are executed on a computer, the computer executes any of the above-mentioned regional network boundary interruption detection methods.

[0039] As can be seen from the above, the present application provides a method, device, electronic device and storage medium for detecting regional network boundary interruptions, which accurately divides regional network boundaries and determines key target autonomous systems by combining network active topology measurement and routing message data analysis. By collecting data from these target autonomous systems, a regional network connection relationship and prefix path data set are constructed, and a routing update dump file is generated to further extract the time series of the number of peers. The time series is input into a pre-trained anomaly detection model to identify interruption events. It effectively solves the problem in the prior art that the method of sending a large number of probe messages to the network to be detected has a detection blind spot, increases the network burden and equipment resource consumption, and the gradient vanishing and gradient explosion problems faced by traditional recurrent neural networks when processing long time series. It significantly improves the accuracy of detecting regional network boundary routing interruption events, and provides a strong guarantee for network stability and reliability. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in this application or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are merely embodiments of this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0041] Figure 1 A flowchart of a method for detecting a regional network boundary interruption according to an embodiment of the present application is provided;

[0042] Figure 2 A schematic diagram of an application scenario of the method for detecting a regional network border routing interruption event according to an embodiment of the present application;

[0043] Figure 3 Schematic diagram of the execution sequence of the method for detecting regional network boundary routing interruption events according to an embodiment of the present application;

[0044] Figure 4 A schematic diagram of the process of constructing a time feature sequence of a regional network boundary routing interruption event according to an embodiment of the present application;

[0045] Figure 5 A schematic diagram of a regional network boundary interruption detection device according to an embodiment of the present application;

[0046] Figure 6 This is a schematic structural diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the objectives, technical solutions and advantages of this application more clear, this application is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0048] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should have the usual meanings understood by people with ordinary skills in the field to which this application belongs. The "first", "second" and similar words used in the embodiments of the present application do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0049] It is understandable that before using the technical solutions disclosed in the various embodiments of this disclosure, the type, scope of use, usage scenarios, etc. of the personal information involved in this disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0050] For example, in response to a user's active request, a prompt message is sent to the user to clearly inform the user that the operation requested will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the electronic device, application, server, storage medium, or other software or hardware that performs the operations of the disclosed technical solution based on the prompt message.

[0051] As an optional but non-limiting implementation, in response to receiving a user's active request, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. Furthermore, the pop-up window may also contain a selection control for the user to select "agree" or "disagree" to provide personal information to the electronic device.

[0052] It is understandable that the above notification and user authorization process are merely illustrative and do not limit the implementation of the present disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0053] In order to facilitate understanding of the technical solutions of the present disclosure, some technical terms involved in the present disclosure are introduced below.

[0054] AS: Autonomous System (AS). The Internet is composed of thousands of independent and autonomous systems. Each autonomous system is a collection of Internet Protocol routing prefixes connected under the control of one or more organizations representing a single management entity or domain. The management entity or domain provides a common, well-defined routing policy. Typically, each AS is operated by a single large organization, such as an Internet Service Provider (ISP), a Content Delivery Network (CDN), a large enterprise technology company, a university, or a government agency. Each organization can manage and operate multiple ASs. When end-to-end hosts transmit traffic, it may cross multiple autonomous systems. In terms of distribution, autonomous systems belong to different organizations and, in turn, to different countries.

[0055] BGP: Border Gateway Protocol (BGP) is the Internet's standard inter-domain routing protocol. BGP's primary function is to guide the flow of data packets across the Internet by exchanging routing and reachability information between edge routers. Routers running the BGP routing protocol are called BGP speakers. Peer connections are manually configured, and they establish sessions over TCP port 179 to exchange routing data. There are two types of BGP sessions: Interior Border Gateway Protocol (IBGP) and External Border Gateway Protocol (EBGP). An IBGP session occurs when two BGP routers belong to the same autonomous system (AS).

[0056] A routing outage event is a routing anomaly caused by the BGP protocol experiencing an unforeseen emergency, resulting in the termination of BGP sessions or the withdrawal of routing prefixes. Routing outages can occur due to a variety of reasons, including BGP router misconfiguration, network attacks, and device failures. When configuring routers or switches, network administrators may enter incorrect routing policies or misconfigure BGP. This can cause network prefixes to be withdrawn or unreachable, rendering them inaccessible externally and leading to routing outages. Attackers can disrupt the network's routing mechanisms through malicious network attacks, rendering specific network prefixes unreachable. Non-human factors can also cause device link failures, such as natural disasters that damage network links or hardware failures in network devices, leading to routing outages. Routing outages can render routing prefixes inaccessible, preventing internet users from using the network services carried by those prefixes. Disruptive routing outages can disrupt network services in key industries and infrastructure, severely impacting the economy and people's livelihoods. A regional network border routing outage occurs when a routing failure or outage occurs at the border AS (AS) that provides routing connectivity between a regional network and the outside world, resulting in a large-scale disruption of the regional network's connectivity to the internet. The regional network mentioned in the present invention refers to a geographical area with a certain organization and administrative management. The regional network is composed of a certain number of interconnected autonomous systems, such as a national network or a specific political alliance network.

[0057] Autonomous System Number Allocation and Routing: Autonomous Systems are assigned a globally unique number, called an Autonomous System Number (ASN). An ASN is a globally unique number used to identify autonomous systems. The Internet Assigned Numbers Authority (IANA) is a standards organization responsible for overseeing global IP address allocation and autonomous system number allocation. The Internet Corporation for Assigned Names and Numbers (ICANN) is a non-profit international organization that performs the functions of IANA. Regional Internet Registries (RIRs) manage the allocation and registration of Internet number resources within a specific region of the world. ICANN allocates a large amount of Internet number resources (IPv4, IPv6, and ASNs) to five regional Internet registries (RIRs) (on five continents): AFRINIC (Africa), APNIC (Asia-Pacific), ARIN (North America), LACNIC (Latin America), and RIPE NCC (Europe).

[0058] ASNs are allocated to RIRs by ICANN in blocks. The appropriate RIR then allocates ASNs from the allocated blocks to entities within its designated region. This region can be a country or a regional political union. Network entities that wish to obtain an ASN must complete the application process of their RIR, LIR (Regional Network Registry) or upstream service provider. Autonomous domain number resources reflect, to a certain extent, the network structure and interconnection capabilities of a region or even an organization. The major RIRs manage the detailed information of the autonomous system number resources within their respective service areas. IANA is responsible for ensuring the uniqueness of the entire set of Internet number resources. The five major RIRs jointly maintain the Internet number resource database.

[0059] Once a network entity (ISP, CDN, large enterprise technology company, university, or government agency) obtains ASN and IP address resources, it can establish a network through routing devices and use BGP to exchange routing and reachability information between edge routers to guide the flow of data packets on the Internet. When BGP announces the reachability information of a destination network, it includes the autonomous system propagation path (AS)—a list of ASes that must be traversed to reach the destination network—so that other networks can understand the path to the destination network. Each AS can advertise one or more IP routing prefixes.

[0060] Due to the existence of multinational corporations and some international businesses, there may be inconsistencies between the country where some network entities register their ASN number resources and the country where they actually operate their networks. This phenomenon is called inconsistency between the ASN number registration location and the operation location.

[0061] Route Announcement Data Collection: BGP messages contain rich path and state information. This information can be used to construct the global network topology and monitor routing status changes, forming the foundation for routing security analysis. The most direct way to obtain routing messages is to log in to a router through a command line and view the routing information table status. Many open routers exist globally, but this method only collects a limited amount of routing information and cannot continuously collect large amounts of routing message data over a long period of time. Currently, systematic methods for collecting routing messages mainly include passive routing message collection. Passive routing message collection primarily involves setting up a routing message collector, which simulates a router (for example, using routing simulation software Quagga) and establishes BGP peering sessions with one or more real routers (Vantage Points, or VPs). A collector establishes BGP sessions with multiple VPs, receiving and parsing route reachability information from each VP. The route update phase is essentially the BGP protocol operation, resulting in the route collector obtaining path information for all globally visible routing prefixes through the VP. For each VP, the collector maintains a session state and routing snapshot. The collector periodically dumps inter-domain routing information snapshots, including maintained routing snapshots, updates received from all VPs since the last dump, and state updates. Routing snapshot dumps provide a useful summary of BGP routing table changes, with a coarse time granularity of between two and eight hours. In contrast, update dumps contain a greater amount of information about routing changes, providing a complete view of routing dynamics, enabling other types of analysis and near-real-time monitoring applications. Their time granularity is typically five minutes. The human-readable format of the routing snapshot dump includes fields such as protocol type, timestamp, entry type, peer IP address, VP AS number, prefix, AS path, message origin, and next hop. The peer IP address is the IP port address of the BGP router that has established a peer relationship with the route collector, the peer AS number is the AS number of the BGP router that has established a peer relationship with the route collector, and the AS path is the list of AS numbers that must be traversed to reach the prefix. Possible values ​​for the origin field are IGP and EGP. IGP indicates that the message originated within the AS, while EGP indicates that the message originated from an external AS. Messages in a routing update dump are divided into withdrawal messages and announcement messages. A withdrawal message indicates that the route collector has received a withdrawal message from a peer for a prefix, while an announcement message indicates that the route collector has received an announcement message from a peer for a prefix.

[0062] In order to make the technical solution of the present disclosure clearer and easier to understand, the regional network boundary interruption detection method provided by the embodiment of the present disclosure is described in detail below with reference to the accompanying drawings.

[0063] As described in the background section, the Internet is composed of thousands of independent yet autonomous systems. An autonomous system is a small unit that has the authority to independently determine which routing protocol to use within its system. End-to-end host traffic transmission may span multiple autonomous systems, which in turn are owned by different organizations and, in turn, by different regions or countries. The inter-domain routing protocol (BGP) is the infrastructure of current cyberspace, providing a communication mechanism between autonomous systems and controlling the forwarding of inter-domain traffic, playing a vital role in the operation of the Internet. However, inter-domain routing protocols can cause routing interruptions between regional networks and external networks when faced with emergencies such as network equipment failures, cyberattacks, or natural disasters. These events are known as regional network boundary routing interruptions. Major regional network boundary routing interruptions can seriously endanger the normal operation of inter-domain network infrastructure and may even disrupt the connection between a country's Internet and the global Internet. Therefore, detecting interruptions in regional network boundary routing is a crucial prerequisite for ensuring the normal operation of regional networks.

[0064] However, the conventional detection method of sending a large number of detection messages to the network to be detected has a detection blind spot and increases the network burden and the consumption of equipment resources.

[0065] In view of this, the embodiments of the present application provide a method, device, electronic device and storage medium for detecting regional network boundary interruptions. By combining network active topology measurement with routing message data analysis, the regional network boundaries are accurately divided and the key target autonomous systems are determined. By collecting data from these target autonomous systems, a regional network connection relationship and prefix path data set are constructed, and a routing update dump file is generated to further extract the time series of the number of peers. The time series is input into a pre-trained anomaly detection model to identify interruption events. It effectively solves the problem that the method of detecting by sending a large number of probe messages to the network to be detected in the prior art has detection blind spots, increases the network burden and equipment resource consumption, and the gradient vanishing and gradient explosion problems faced by traditional recurrent neural networks when processing long time series. It significantly improves the accuracy of detecting regional network boundary routing interruption events and provides a strong guarantee for network stability and reliability.

[0066] like Figure 1 As shown, the regional network boundary interruption detection method includes:

[0067] Step S102: Determine the target area and the autonomous systems within the target area, screen the autonomous systems within the target area, and determine a target autonomous system set;

[0068] Step S104: collecting data from a routing message collector according to the target autonomous system set to determine a regional network connection relationship dataset and a regional network prefix path dataset;

[0069] Step S106: collecting data from a routing message collector according to the target autonomous system set, determining a routing update dump file, and determining a time series of the number of peers according to the routing update dump file, the regional network connection relationship dataset, and the regional network prefix path dataset;

[0070] Step S108: Input the peer quantity time series into a pre-trained anomaly detection model to determine an interruption detection result.

[0071] In step S102, the Autonomous System (AS), as the basic component of the network, is the key to achieving efficient and reliable data transmission. Each autonomous system has its own unique autonomous system number (ASN), which is managed and allocated by the Internet Assigned Numbers Authority (IANA) and regional Internet registries (RIRs) such as APNIC, ARIN, RIPENCC, LACNIC, AFRINIC, etc. Figure 2 As shown in Figure 1, autonomous systems exchange routing information through the Border Gateway Protocol (BGP), thereby building an interconnected global network. To better understand and manage the operation of the network in a specific geographical area, we need to perform a series of steps to determine the actual set of autonomous systems operating in the area.

[0072] In some implementations, the target autonomous system is determined by:

[0073] (1) Based on the defined target area, which is a geographical area with a certain organization and administration, such as a specific country or political union, we need to identify all autonomous system number resources allocated to the area. By querying the relevant "IP Address Assignment Authority", we can obtain all autonomous system numbers allocated to the geographical area. This includes not only local autonomous systems directly located in the area, but also autonomous systems that are not registered in the area but do have network resources in the area. Therefore, we must ensure that the data collected is comprehensive and accurate to reduce the amount of data required for calculation and further reduce the computing power required for calculation.

[0074] (2) Extract the routing prefix announced by each autonomous system in its network from the routing announcement data. A routing announcement is a message published by a router in the network, which contains the network segment to which the router is connected, the cost of the path, and other relevant information. Among them, a routing announcement refers to the routing information that a router announces in the network, including the network segment to which it is connected, the corresponding cost (i.e., the cost of the path), and other relevant parameters. In addition, all autonomous system numbers allocated for the geographical area can be obtained by querying the relevant "IP address allocation agency" (such as IANA, RIRs).

[0075] In some implementations, in order to obtain the most accurate data, routing announcement data is obtained through the Route Views Project, RIPE RIS (Routing Information Service), or other similar BGP routing data sources.

[0076] (3) For each routing prefix in each autonomous system, a random IP address is selected and various geolocation services are used to query the city and country to which the IP address belongs. Geolocation services can be based on commercial databases (such as MaxMind, DB-IP) or public APIs (such as GeoLite2, IP-API), which can provide mappings from IP addresses to geographic locations. It should be noted that since a single autonomous system may cover multiple cities or even cross national borders, such queries need to be performed separately for each routing prefix to ensure that the location information is as accurate as possible.

[0077] Furthermore, a route prefix refers to an IP address range, typically expressed in CIDR (Classless Inter-Domain Routing) notation. It consists of a base IP address and a mask length, such as 192.0.2.0 / 24. This notation illustrates the dividing line between the network portion (prefix) and the host portion. 192.0.2.0 is the network portion, while / 24 indicates that 24 bits are used as the network identifier, and the remaining 8 bits are used for the host identifier. Therefore, the prefix 192.0.2.0 / 24 covers all IP addresses from 192.0.2.0 to 192.0.2.255.

[0078] (4) Aggregation and screening: summarize and analyze the cities and countries to which the routing prefixes of each autonomous system in the target area belong. If it is found that the cities and countries to which all the routing prefixes of an autonomous system belong are within the area we defined, then the registration place and the actual operation place of this autonomous system are consistent. Therefore, the main services and infrastructure of the autonomous system are located in this area, thus meeting our standards. On the contrary, if there is any routing prefix belonging to outside the area, it means that the autonomous system is not fully operating in this area and therefore does not meet the conditions. Finally, the autonomous system that meets the conditions is used as the target autonomous system, and the target autonomous system is stored in the "set of autonomous systems actually operating in this area" to determine the target autonomous system set.

[0079] Some optional implementations include multiple types of routing, each with distinctly different methods for acquiring routing advertisement data. First, direct routing: For directly connected networks, the router automatically adds routing information to that network. This method requires no additional configuration or protocol support and is the most basic method for routers to acquire routing information. Second, static routing: Static routing is routing information manually added to the router by the administrator. Based on the network topology and requirements, the administrator manually configures routing table entries, including the destination network, mask, and next-hop address. Static routing does not change with changes in the network topology and therefore requires manual updates and maintenance by the administrator. Third, dynamic routing, also known as adaptive routing, involves the use of routing protocols to dynamically exchange routing information between interconnected networks, thereby automatically updating and maintaining the routing table. In dynamic routing protocols, routers periodically or on demand exchange routing information with other routers, including network segments, costs, and metrics. Using this information, the router can calculate the optimal path to any destination.

[0080] OSPF (Open Shortest Path First) is a common dynamic routing protocol. In OSPF, routers announce their connected network segments and their corresponding costs and share this information with other routers. Through OSPF, routers can build and maintain a complete link-state database, enabling them to calculate the optimal path.

[0081] In step S104, the regional network connection relationship data set is a dictionary of AS connection relationship data at the initial regional network boundary, a database or data structure used to store and describe the connection relationships between autonomous systems (ASs) in the network. The AS connection relationship data dictionary contains information such as the AS number (ASN), the AS name, and the connection relationships between ASs (such as neighboring ASs and connection types). The regional network prefix path data set is a prefix path dictionary, a database or data structure used to store and describe the relationship between IP prefixes and paths in the network. The prefix path dictionary includes information such as the IP prefix, the path to the prefix (including the ASs and routers passed through), and path attributes (such as the path length and next-hop address).

[0082] In some embodiments, a routing message collector is configured based on a previously determined set of target autonomous systems to ensure that all routing update information related to these autonomous systems can be captured. It should be noted that a routing message collector is a device or service specifically used to monitor and record BGP (Border Gateway Protocol) messages, and is typically located at key nodes in the network, such as major Internet Exchange Points (IXPs) and core routers of large ISPs. The routing message collector is used to continuously monitor BGP sessions and save the received routing update information as a routing snapshot dump file. The routing snapshot dump file contains rich routing information and is the basis for subsequent data analysis.

[0083] In some embodiments, the routing snapshot dump file consists of message records, and the format of each message record is <protocol type, timestamp, entry type, peer IP address, VP AS number, prefix, AS path, message origin and next hop fields>, where the VP AS number is the VP observation point AS number, the prefix is ​​the target routing prefix, and the AS path is the list of ASs passed from the VP observation point AS to the target prefix.

[0084] Furthermore, the protocol type identifies the routing protocol used, typically BGP. The timestamp records the specific time when the route update occurred. The entry type indicates whether the route information is newly added, deleted, or updated. The peer IP address is the IP address of the peer router that sent the route update. The VP AS number is the number of the autonomous system where the observation point is located, also known as the VP (View Point) AS number. A VP is a location or node in the network used for monitoring and data collection. It can be a router, server, or other device capable of capturing network traffic and BGP updates. It provides important insights into the network status. The prefix is ​​the destination route prefix, that is, the IP address range involved in the route update. The AS path is the list of ASs traversed from the VP observation point AS to the destination prefix. The message origin indicates the source of the route information, such as IGP (Interior Gateway Protocol), EGP (Exterior Gateway Protocol), or undetermined. The next hop indicates the IP address of the next-hop router, that is, the next router to which the packet should be sent. The destination routing prefix is ​​used to guide the transmission path selection of data packets from the source address to the destination address. For example, 192.0.2.0 / 24 represents the IP address range from 192.0.2.0 to 192.0.2.255.

[0085] Furthermore, the current message record is read and the prefix, VP AS number, and AS path are stored in a two-dimensional prefix-path dictionary. The prefix is ​​the key in the first dimension of the two-dimensional dictionary, the VP AS number is the key in the second dimension, and the value corresponding to the second dimension key is the AS path. This two-dimensional prefix-path dictionary allows for efficient storage and querying of routing paths for specific prefixes at different observation points.

[0086] In some embodiments, two adjacent AS numbers in the AS path of the current message record are taken from left to right to form a path pair.<ASleft,ASRight> This allows the identification of direct connections between ASes and connections across different regions. Each pair of adjacent AS numbers is examined one by one to construct a network topology diagram, thereby determining the interconnection between autonomous systems.

[0087] Further, such as Figure 3As shown, for each path pair<ASleft,ASRight> , respectively, calculating the regions to which the two ASes belong. If ASleft and ASRight belong to the same region, processing proceeds to the next pair of adjacent AS numbers. Otherwise, the algorithm further checks whether ASleft is in the set of operational autonomous systems in the region. If ASleft is indeed in that set, the algorithm stores ASleft, VP AS number, and ASRight in a two-dimensional dictionary called "Regional Network Boundary AS Connection Relationship." In this dictionary, ASleft is the key in the first dimension, the VP AS number is the key in the second dimension, and the value corresponding to the second-dimension key is ASRight. This dictionary records all cross-regional border connections, allowing us to clearly identify which autonomous systems have direct connections with other regions at the edge of a region. If ASleft is not in the set of operational autonomous systems in the region, the pair of ASes is skipped and processing proceeds to the next pair. A "region" refers to a geographical area with a specific organization and administration, such as a specific country or political alliance. Determining whether ASes belong to the same region helps identify cross-regional border connections, which is very useful for understanding the global distribution of networks and traffic patterns.

[0088] In addition, if the current path<ASleft,ASRight> If the last two AS numbers in the AS path have been reached, the next message record in the routing snapshot dump file is read and the prefix, VP AS number, and AS path of the next message record are stored in the prefix path two-dimensional dictionary. The next cycle continues until all message records have been processed. Once completed, the initial regional network boundary AS connection relationship data dictionary and prefix path dictionary are successfully constructed. The AS connection relationship data dictionary and prefix path dictionary contain rich routing information and provide tools for in-depth analysis of regional network structure and behavior. By further mining this data, network performance bottlenecks, potential security threats, and methods for optimizing routing policies can be further identified.

[0089] In step S106, the routing update dump file is a record file generated when the router performs operations such as firmware upgrade, configuration update or routing protocol update. It contains information such as configuration differences before and after the update, routing table changes, interface status updates, etc. The routing update dump file is composed of message records, and the message types are divided into two types: routing withdrawal messages and routing announcement messages. Among them, the routing withdrawal message is used to notify the peer that certain routes have become unreachable and should therefore be removed from the routing table. The routing announcement message is a message in which the router announces the routing information it owns in the network. It is used to inform the peer of new reachable routes or update existing routing information. It contains path information to a specific destination network (i.e., the target routing prefix).

[0090] In some implementations, the record format of a route withdrawal message is <protocol type, timestamp, entry type, peer IP address, VP AS number, prefix>; the record format of a route announcement message is <protocol type, timestamp, entry type, peer IP address, VP AS number, prefix, AS path, AS path, message origin, and next hop fields>. The VP AS number is the VP observation point AS number, the prefix is ​​the target route prefix, and the AS path is the list of ASs traversed from the VP observation point AS to the target prefix (i.e., the autonomous systems traversed to reach the target router).

[0091] The destination route prefix consists of two parts: the network address and the prefix length (or network mask). Both are indispensable. The network address specifies the destination network, while the prefix length (or network mask) defines the size or scope of the network.

[0092] In some implementations, data is collected from a routing message collector according to the target autonomous system set, a routing update dump file is determined, and a time series of the number of peers is determined according to the routing update dump file, the regional network connection relationship dataset, and the regional network prefix path dataset, including the following steps: Figure 4 As shown, step S1061, set a fixed loading interval T and start timing;

[0093] Step S1062: Determine whether the time interval T has been reached. If so, jump to step S1065. Otherwise, continue reading the message record in the file and determine the entry type of the current message. If it is a route withdrawal message, jump to step S1063; if it is a route announcement message, jump to step S1064. If the record is the last record in the file, after processing, load the latest route update dump file and go to step S1062.

[0094] Step S1063: Query the prefix path dictionary based on the prefix and VP AS number in the message. If it is not in the prefix path dictionary, read the next record of the routing update dump file and go to Step S1062. If it is in the prefix path dictionary, query the AS path corresponding to the prefix and VP AS number, and take two adjacent AS numbers of the AS path from left to right to form a path pair <ASleft, ASRight>. Check whether the first-level key <ASleft, VP AS number> two-dimensional key-value pair exists in the regional network boundary AS connection relationship data dictionary and the corresponding value is ASRight. If it exists, delete the key VP AS number and the key value ASRight. After traversing the AS path, update the prefix path dictionary, and delete the key of the VP AS number corresponding to the prefix in the dictionary and the corresponding AS path. If the two AS numbers of the path pair <ASleft, ASRight> are the last two AS numbers in the AS path, jump to Step S1062.

[0095] Step S1064: Query the prefix path dictionary according to the prefix and VP AS number in the message. If the corresponding data does not exist in the dictionary, store the prefix, VP AS number, and AS path into the prefix path dictionary, where the prefix is the key of the first dimension of the two-dimensional dictionary, the VP AS number is the key of the second dimension of the two-dimensional dictionary, and the value corresponding to the key of the second dimension is the AS path; then enter Step S1064-1;

[0096] Step S1064-1: Take two adjacent AS numbers of the AS path from left to right to form a path pair <ASleft, ASRight>;

[0097] Step S1064-2: Calculate the regions to which ASleft and ASRight belong respectively. If ASleft and ASRight belong to the same region, jump to Step S1064-1; otherwise, enter Step S1064-3;

[0098] Step S1064-3: If ASleft is in the set of autonomous systems actually operated in the region, store ASleft, VP AS number, and ASRight into the regional network boundary AS connection relationship dictionary, where ASleft is the key of the first dimension of the two-dimensional dictionary, the VP AS number is the key of the second dimension of the two-dimensional dictionary, and the value corresponding to the key of the second dimension is ASRight; if ASleft is not in the set of autonomous systems actually operated in the region, jump to Step S1064-1; if the two AS numbers of the path pair <ASleft, ASRight> are the last two AS numbers in the AS path, jump to Step S1064-2;

[0099] When the set time interval T is reached, the process proceeds to step S1065, which includes calculating the number of autonomous system peers at the regional border in the current time interval. The specific steps are as follows:

[0100] Traverse the regional network boundary AS connectivity dictionary and count all VP AS number keys. Each VP AS number key represents an observation point, which records the peers connected to the regional boundary AS. Therefore, the number of VP AS number keys reflects the number of peers in the regional boundary autonomous system. This number of peers is then used to determine the time series of the number of peers in the regional boundary autonomous system.

[0101] In some implementations, the peer number time series is input into the long short-term memory network to determine an interruption detection result, thereby determining whether a border routing interruption event occurs in the target area.

[0102] In some optional implementations, the long short-term memory network used for interruption detection is determined by training the time series of the number of peers in the border autonomous system.

[0103] In some embodiments, when it is determined that an interruption event is detected, the interruption time of the regional boundary routing interruption event is obtained, and the regional network boundary AS connection relationship data dictionary at a certain moment before the interruption of the detected area and a certain moment during the interruption is obtained respectively.

[0104] Furthermore, the boundary ASs in the regional network boundary AS connection relationship data dictionary before and after the interruption are compared one by one, and the difference in the number of peers corresponding to the boundary AS before and after the interruption is calculated. The regional boundary AS with a difference greater than zero is the root AS that caused the regional boundary routing interruption event.

[0105] As can be seen from the above, by combining active network topology measurement with routing message data analysis, the regional network boundaries are accurately divided and the key target autonomous systems are identified. By collecting data from these target autonomous systems, the regional network connection relationship and prefix path dataset are constructed, and a routing update dump file is generated to further extract the time series of the number of peers. The time series is input into the pre-trained anomaly detection model to identify interruption events. This effectively solves the problem of detection blind spots in the existing technology of sending a large number of probe messages to the network to be detected, which increases the network burden and equipment resource consumption, as well as the gradient vanishing and gradient explosion problems faced by traditional recurrent neural networks when processing long time series. It significantly improves the accuracy of detecting routing interruption events at the regional network boundary, provides a strong guarantee for network stability and reliability, and has important application value for the security protection of cyberspace routing infrastructure.

[0106] It should be noted that the method of the embodiment of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied in a distributed scenario and performed by multiple devices working together. In such a distributed scenario, one of the multiple devices may only perform one or more steps of the method of the embodiment of the present application, and the multiple devices will interact with each other to complete the method.

[0107] It should be noted that the above description is limited to some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in an order different from that described in the above embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0108] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides an interruption detection device.

[0109] refer to Figure 5 , the regional network boundary interruption detection device includes:

[0110] A screening module 502 is configured to determine a target area and autonomous systems within the target area, screen the autonomous systems within the target area, and determine a target autonomous system set;

[0111] A first data collection module 504 is configured to collect data from a routing message collector according to the target autonomous system set, and determine a regional network connection relationship dataset and a regional network prefix path dataset;

[0112] a second data collection module 506 configured to collect data from a routing message collector according to the target autonomous system set, determine a routing update dump file, and determine a time series of the number of peers based on the routing update dump file, the regional network connection relationship dataset, and the regional network prefix path dataset;

[0113] The detection module 508 is configured to input the peer quantity time series into a pre-trained anomaly detection model to determine an outage detection result.

[0114] For the convenience of description, the above devices are described as being divided into various modules according to their functions. Of course, when implementing this application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0115] The apparatus of the above embodiment is used to implement the corresponding regional network boundary interruption detection method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be described in detail here.

[0116] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and runnable on the processor, wherein when the processor executes the program, the method for detecting regional network boundary interruption described in any of the above embodiments is implemented.

[0117] Figure 6 10 is a schematic diagram showing a more specific hardware structure of an electronic device provided in this embodiment. The device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are communicatively connected to each other within the device via the bus 1050.

[0118] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0119] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage devices, dynamic storage devices, etc. The memory 1020 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0120] The input / output interface 1030 is used to connect input / output modules to implement information input and output. The input / output modules can be configured as components within the device (not shown in the figure) or can be externally connected to the device to provide corresponding functions. Input devices may include a keyboard, mouse, touch screen, microphone, various sensors, etc., and output devices may include a display, speaker, vibrator, indicator light, etc.

[0121] The communication interface 1040 is used to connect to a communication module (not shown) to enable communication between the device and other devices. The communication module can communicate via a wired method (such as USB, network cable, etc.) or a wireless method (such as mobile network, WiFi, Bluetooth, etc.).

[0122] The bus 1050 comprises a path for transmitting information between the various components of the device (eg, the processor 1010 , the memory 1020 , the input / output interface 1030 , and the communication interface 1040 ).

[0123] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040, and the bus 1050, in a specific implementation, the device may also include other components necessary for normal operation. In addition, it will be understood by those skilled in the art that the above device may only include the components necessary to implement the embodiments of this specification, and does not necessarily include all the components shown in the figure.

[0124] The electronic device of the above embodiment is used to implement the corresponding regional network boundary interruption detection method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0125] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the regional network boundary interruption detection method described in any of the above embodiments.

[0126] The computer-readable media of this embodiment include permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0127] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute the regional network boundary interruption detection method as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0128] Based on the same inventive concept, corresponding to the regional network boundary interruption detection method described in any of the above embodiments, the present disclosure further provides a computer program product comprising computer program instructions. In some embodiments, the computer program instructions can be executed by one or more processors of a computer to cause the computer and / or the processors to perform the regional network boundary interruption detection method. For the execution entities corresponding to the steps in each embodiment of the regional network boundary interruption detection method, the processors executing the corresponding steps can belong to the corresponding execution entities.

[0129] The computer program product of the above embodiment is used to enable the computer and / or the processor to execute the regional network boundary interruption detection method as described in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0130] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application (including the claims) is limited to these examples. Within the scope of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0131] In addition, for simplicity of description and discussion, and in order not to make the embodiment of the application difficult to understand, the known power supply / ground connection with integrated circuit (IC) chip and other components may or may not be shown in the accompanying drawings provided. In addition, the device can be shown in the form of a block diagram to avoid making the embodiment of the application difficult to understand, and this also takes into account the following fact, that is, the details of the embodiment of these block diagram devices are highly dependent on the platform to be implemented in the embodiment of the application (that is, these details should be fully within the scope of understanding of those skilled in the art). When specific details (for example, circuit) are set forth to describe exemplary embodiments of the application, it will be apparent to those skilled in the art that the embodiment of the application can be implemented without these specific details or when these specific details are changed. Therefore, these descriptions should be considered to be illustrative rather than restrictive.

[0132] Although the present invention has been described in conjunction with specific embodiments thereof, many alternatives, modifications, and variations of these embodiments will be apparent to those skilled in the art based on the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may utilize the embodiments discussed.

[0133] The embodiments of the present application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the scope of protection of this application.

Claims

1. A method for detecting regional network boundary interruption, characterized in that: include: Determine the target area and the autonomous systems within the target area, screen the autonomous systems within the target area, and determine the target autonomous system set; Collecting data from a routing message collector according to the target autonomous system set to determine a regional network connection relationship dataset and a regional network prefix path dataset; Performing data collection on a routing message collector according to the target autonomous system set, determining a routing update dump file, and determining a time series of the number of peers according to the routing update dump file, the regional network connection relationship dataset, and the regional network prefix path dataset; The peer quantity time series is input into a pre-trained anomaly detection model to determine an outage detection result.

2. The method according to claim 1, characterized in that The screening of autonomous systems in the target area to determine the target autonomous system includes: Determining routing information of the autonomous system within a target area, and determining a plurality of target autonomous systems based on the routing information; The target autonomous system set is determined according to the multiple target autonomous systems.

3. The method according to claim 2, characterized in that The routing information includes current routing information and initial routing information; Determining the target autonomous system according to the routing information includes: In response to determining that the current routing information of the autonomous system is the same as the initial routing information, determining the autonomous system as the target autonomous system; In response to determining that the current routing information and the initial routing information of the autonomous system are not the same, the autonomous system is ignored.

4. The method according to claim 1, wherein The step of collecting data from a routing message collector according to the target autonomous system set to determine a regional network connection relationship dataset and a regional network prefix path dataset includes: Collecting data from a routing message collector according to the target autonomous system set to determine a current routing snapshot dump file of the target area; According to the current routing snapshot dump file, a regional network connection relationship dataset and a regional network prefix path dataset are determined.

5. The method according to claim 1, characterized in that The routing update dump file includes a routing withdrawal file and a routing announcement file; Determining the time series of the number of peers according to the routing update dump file, the regional network connection relationship data set, and the regional network prefix path data set includes: In response to determining that the routing update dump file is the routing fallback file, determining the peer quantity time series according to the routing fallback file, the regional network connection relationship dataset, and the regional network prefix path dataset; In response to determining that the routing update dump file is the routing announcement file, the peer quantity time series is determined according to the routing announcement file, the regional network connection relationship dataset, and the regional network prefix path dataset.

6. The method according to claim 1, wherein The anomaly detection model is a long short-term memory network; Inputting the peer quantity time series into a pre-trained anomaly detection model to determine an interruption detection result includes: The peer quantity time series is input into the long short-term memory network to determine the interruption detection result.

7. The method according to claim 6, characterized in that The method further comprises: Determine when the disruption occurred; Determine a connection relationship data set, and determine the network connection relationship before the interruption and the network connection relationship at the time of the interruption according to the occurrence time and the connection relationship data set; The network connection relationship before the interruption is compared with the network connection relationship during the interruption to determine the autonomous system where the interruption occurs.

8. A regional network boundary interruption detection device, characterized in that: include: a screening module configured to determine a target area and autonomous systems within the target area, screen the autonomous systems within the target area, and determine a target autonomous system set; A first data collection module is configured to collect data from a routing message collector according to the target autonomous system set, and determine a regional network connection relationship dataset and a regional network prefix path dataset; a second data collection module configured to collect data from a routing message collector according to the target autonomous system set, determine a routing update dump file, and determine a time series of the number of peers based on the routing update dump file, the regional network connection relationship dataset, and the regional network prefix path dataset; The detection module is configured to input the peer quantity time series into a pre-trained anomaly detection model to determine an interruption detection result.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable by the processor, wherein the processor implements the method according to any one of claims 1 to 7 when executing the computer program. 10 . A non-transitory computer-readable storage medium storing computer instructions for causing a computer to execute the method according to claim 1 .

Images