Route leak detection method, apparatus, device, medium, and program

Abstract

The application relates to the technical field of Internet routing security, in particular to a routing leakage detection method, device, equipment, medium and program, wherein the method comprises the following steps: acquiring routing table data, autonomous system commercial relationship data and routing announcement data; constructing a three-tuple set of the autonomous system according to the routing table data, calculating the legal probability of each three-tuple in the three-tuple set according to the observation data of the three-tuple; extracting the autonomous system path in the routing announcement data, detecting whether the autonomous system path is a valley path according to the commercial relationship data, and generating a routing leakage detection result according to the legal probability of the valley three-tuple in the valley path. Therefore, the problems that the detection routing leakage method based on the valley path in the related art is difficult to meet the needs of the complex Internet environment due to the high false alarm rate and the static rule limitation are solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet routing security, and in particular to a route leakage detection method, device, equipment, medium and program. BACKGROUND

[0002] With the continuous expansion of the Internet, the interconnection between different AS (Autonomous Systems) is increasingly complex. BGP (Border Gateway Protocol) as the core routing protocol of the Internet is responsible for exchanging routing information between different AS to ensure efficient packet delivery. However, in actual BGP configuration and management, due to configuration errors, etc., route leakage may occur, which will disrupt the normal routing behavior of the network and affect the security and stability of the network.

[0003] Route leakage refers to a route announced by an AS exceeding its intended scope. That is, an AS passes on the announced routes learned through BGP to another AS, which violates the intended policy of the receiving party, the sending party and / or some AS along the previous AS path.

[0004] In related technologies, the detection method is based on the valley principle, and whether the AS path in the BGP route announcement is a "valley path" is analyzed to determine leakage. However, relying solely on valley path detection will misjudge a large number of normal routes as leakage, resulting in a high false positive rate; the long-term stability of the route path is not considered. Some valley paths may appear temporarily due to temporary policy adjustments, lacking dynamic adaptability; it is difficult to meet the needs of complex Internet environments. SUMMARY

[0005] The present application provides a route leakage detection method, device, equipment, medium and program to solve the problem that the detection method based on the valley path in related technologies has a high false positive rate and is limited by static rules, making it difficult to meet the needs of complex Internet environments.

[0006] The first aspect embodiment of the present application provides a route leakage detection method, comprising the following steps: obtaining route table data, business relationship data of autonomous systems and route announcement data; constructing a triple set of autonomous systems according to the route table data, calculating the legality probability of each triple in the triple set according to the observation data of the corresponding triple; extracting the autonomous system path in the route announcement data, detecting whether the autonomous system path is a valley path according to the business relationship data, and generating a route leakage detection result according to the legality probability of the valley triple in the valley path.

[0007] Optionally, before calculating the legitimacy probability of each triple in the triple set according to the observation data of each triple, it comprises: traversing whether each triple appears in the routing table data of each routing collector; if the triple appears in the routing table data of any routing collector, recording a positive observation data; if the triple does not appear in the routing table data of any routing collector and the path hop difference condition is met, recording a negative observation data; counting the positive observation data and the negative observation data of the routing table data to generate the observation data.

[0008] Optionally, before calculating the legitimacy probability of each triple in the triple set according to the observation data of each triple, it further comprises: identifying the observation data of the routing table data of each routing collector; calculating the prior probability of the legitimacy of the triple according to the observation data by using a target algorithm, including the prior probability of the legitimacy of the valley triple and the prior probability of the legitimacy of the valley triple.

[0009] Optionally, the calculation of the legitimacy probability of each triple in the triple set according to the observation data of each triple comprises:

[0010] ;

[0011] wherein, is the legitimacy probability of the triple (x, y, z); is the accuracy rate of the observation of the routing collector, and are the true positive rate and the positive rate of the observation of each routing collector; =1 indicates that the triple (x, y, z) is legitimate, =0 indicates that the triple (x, y, z) is not legitimate, and the observation vector is the observation vector of the triple (x, y, z), wherein is the RC positive observation time of the triple . is the RC negative observation time of the triple . represents the probability of observing the observation vector given that the triple (x, y, z) is legitimate; represents the probability of observing the observation vector given that the triple (x, y, z) is not legitimate; represents the prior probability of the legitimacy of the triple, represents the prior probability of the legitimacy of the valley triple, represents the prior probability of the legitimacy of the valley triple; represents the triple whether the autonomous system path is a valley path, then not a valley triple, then a valley triple.

[0012] Optionally, the detecting whether the autonomous system path is a valley path according to the business relationship data and identifying a valley triple therefrom comprises: identifying a neighboring link relationship in the autonomous system path; if the neighboring link relationship matches the business relationship data of at least one valley triple, the autonomous system path is a valley path, and an autonomous system triple of the neighboring link is a valley triple.

[0013] Optionally, the generating a route leakage detection result according to the legitimate probability of the valley triple comprises: if the legitimate probability of the valley triple is higher than a preset threshold, considering that the route configuration is normal; if the legitimate probability of the valley triple is lower than the preset threshold, considering that there is route leakage.

[0014] The second aspect of the present application provides a route leakage detection device, comprising: an acquisition module configured to acquire route table data, business relationship data of an autonomous system, and route announcement data; a construction module configured to construct a triple set of the autonomous system according to the route table data, and calculate a legitimate probability of each triple in the triple set according to observation data of the corresponding triple; and an extraction module configured to extract, from the route announcement data, whether the autonomous system path is a valley path according to the business relationship data, and generate a route leakage detection result according to a legitimate probability of a valley triple in the valley path.

[0015] The third aspect of the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to perform the route leakage detection method as described in the above embodiments.

[0016] The fourth aspect of the present application provides a computer readable storage medium having a computer program stored thereon, wherein the program is executed by a processor to perform the route leakage detection method as described in the above embodiments.

[0017] The fifth aspect of the present application provides a computer program product comprising a computer program or instructions, wherein the computer program or instructions are executed to implement the route leakage detection method as described in the above embodiments.

[0018] Therefore, the present application has at least the following beneficial effects:

[0019] The embodiment of the application can extract all possible continuous autonomous system triplets from the routing table data to construct a triplet set of autonomous systems, calculate the legal probability of the triplets through a Bayesian model combined with positive observation and negative observation, so as to distinguish long-term stable legal paths from occasional abnormal paths; extract autonomous system paths in the routing announcement data, detect whether the autonomous system paths are valley paths according to the commercial relationship data, so as to accurately locate abnormal paths, generate a routing leakage detection result according to the legal probability of the valley triplets in the valley paths, reduce the overall false positive rate and false negative rate, and improve the detection efficiency and adaptability.

[0020] Additional aspects and advantages of the application will be set forth in part in the description that follows, and in part will become apparent to those skilled in the art upon examination of the following and / or can be learned by practice of the application. BRIEF DESCRIPTION OF DRAWINGS

[0021] The above and / or additional aspects and advantages of the application will become apparent and be readily appreciated from the following description, taken in conjunction with the accompanying drawings, in which:

[0022] Figure 1 A flowchart of a routing leakage detection method according to an embodiment of the application;

[0023] Figure 2 An overall flowchart according to an embodiment of the application;

[0024] Figure 3 An example diagram of a routing leakage detection device according to an embodiment of the application;

[0025] Figure 4 A structural diagram of an electronic device according to an embodiment of the application. DETAILED DESCRIPTION

[0026] Embodiments of the application are described in detail below with reference to the accompanying drawings, in which the same or similar elements or elements having the same or similar functions are denoted by the same or similar reference numerals throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to explain the application, and cannot be understood as limiting the application.

[0027] The strategy of AS route propagation is usually determined according to the commercial relationship between ASs. There are two kinds of commercial relationship between ASs, one is the customer-provider relationship, a customer AS pays a fee to another provider AS to obtain route service to access other parts of the Internet. The other is a peer-to-peer relationship, two ASs reach an agreement to exchange each other's customer route information for free. When an AS performs route propagation, it will announce all routes to its own customers; announce routes to its own peers or providers to itself and its customers, but not announce routes learned from other peers or providers.

[0028] Under the route announcement principle based on business relationship, the path between two ASs satisfies the no-valley principle: the path starts from one AS, goes through zero or more customer-to-provider (c2p) links, then goes through zero or one peer-to-peer (p2p) link, and finally goes through zero or more provider-to-customer (p2c) links to the destination AS.

[0029] If a route leak occurs, the AS path violates the no-valley principle, and a "valley AS triplet" (or simply valley triplet) appears in the path, i.e., three ASs form a "valley". The possible business relationships of the valley triplet are: p2c c2p, p2c p2p, p2p c2p, p2p p2p. In route leak, the most concerned valley triplet is the one with business relationship "p2c c2p", which means an AS propagates the learned route from an upstream provider to another upstream provider.

[0030] An obvious idea is to monitor all the BGP announced Update messages in the Internet, and detect whether the AS path in the Update message is a valley path according to the business relationship. If the AS path is a valley path, a route leak occurs. By traversing the AS path, a valley triplet <AS1, AS2, AS3> can be found. AS2 in the valley triplet is the leaker AS, which incorrectly announces the learned route from AS3 to AS1.

[0031] However, valley paths are widely existed in the Internet. Studies show that 4% of IPv4 and 22.3% of IPv6 BGP Update messages contain valley paths, and 1.7% of IPv4 and 5.4% of IPv6 BGP RIB tables contain valley paths. These widely existed valley paths may be caused by normal route configuration. If only the AS path in the BGP Update message is used to determine whether a route leak occurs, a large number of false positives (i.e., normal valley paths are incorrectly determined as route leaks) will be caused.

[0032] Considering the valley triplets caused by normal routing configuration, the valley triplets usually appear in the RIB (Routing Information Base) table for a long time. Therefore, the multi-day RIB table data can be collected from multiple RCs (Route Collectors), and the legal probability of the triplets can be analyzed through the occurrence of the triplets in each RIB table. The legal probability of the triplets refers to the probability that an AS triplet <AS1, AS2, AS3> is caused by the normal configuration of the network manager, that is, the probability that there is a normal configuration in the network to enable AS2 to provide traffic transmission services for AS1 and AS3. The triplets with high legal probability are caused by normal routing configuration. The triplets with low legal probability are more likely to be caused by routing leakage.

[0033] Therefore, the present application first uses the RIB table and the AS commercial relationship data to infer the legal probability of the triplets. After obtaining the legal probability of all triplets, routing leakage detection is performed. In the routing leakage detection, when a valley triplet is encountered, if the legal probability of the valley triplet is less than a set threshold, it is considered that leakage has occurred, and an alarm is given. Therefore, through multi-source data integration, probability-driven decision making, and dynamic parameter optimization, the high false alarm problem of the traditional routing leakage detection method is solved, and the detection efficiency and adaptability are improved, thereby providing reliable protection for the routing security of the Internet.

[0034] The routing leakage detection method, device, electronic equipment, storage medium, and program of the embodiments of the present application are described below with reference to the accompanying drawings.

[0035] Specifically, Figure 1 A flowchart of a routing leakage detection method provided by an embodiment of the present application is shown in FIG. 1.

[0036] As Figure 1 indicated, the routing leakage detection method includes the following steps:

[0037] In step S101, routing table data, autonomous system commercial relationship data, and routing announcement data are obtained.

[0038] It can be understood that the routing table data, autonomous system commercial relationship data, and routing announcement data can be obtained by the embodiments of the present application, so as to facilitate subsequent detection of routing leakage.

[0039] It should be noted that the routing table data of the present application provides a global view of all known routes in the current network, including the connection relationship between autonomous systems, path priority and routing strategy, which is the basis for analyzing legal paths; commercial relationship data: clear economic agreement between ASs (such as customer-provider relationship, peering relationship), which provides the basis for judging the legality of route announcement; real-time or historical route update information of route announcement data, which is used to capture abnormal route propagation behavior (such as unauthorized path announcement). Specifically:

[0040] (1) BGP RIB table data

[0041] The legality probability of the valley triplet is judged by the occurrence of the triplet in the RIB table. The RIB table data can be obtained from RouteViews (Route Views Project) and RIPE (European IP Networks). RouteViews and RIPE provide BGP RIB table data from more than 60 RCs.

[0042] (2) AS commercial relationship data

[0043] The detection of valley path is based on AS commercial relationship, and it is necessary to know what the commercial relationship between the two ASs of each AS link is. The AS commercial relationship can be obtained from CAIDA (Cooperative Association for Internet Data Analysis) or calculated by using TopoScope and other methods.

[0044] (3) BGP route announcement data

[0045] The occurrence of route leakage is detected by detecting whether the valley path is in the AS path of the Update message of the real-time BGP route announcement, and judging the legality probability of the valley triplet in the valley path. The BGP route announcement data can be obtained from RouteViews and RIPE.

[0046] In step S102, a triplet set of autonomous systems is constructed according to the routing table data, and the legality probability of each triplet in the triplet set is calculated according to the observation data of the corresponding triplet.

[0047] It can be understood that the embodiments of the application can extract all possible continuous autonomous system triplets from the routing table data to construct a triplet set of autonomous systems, calculate the legal probability of the triplet through a Bayesian model, combine positive observation and negative observation, judge whether each triplet is caused by normal routing configuration by counting the occurrence frequency and stability of each triplet in the historical RIB table, distinguish long-term stable legal paths from occasional abnormal paths, and improve the confidence and accuracy of subsequent route leakage detection.

[0048] Specifically, as shown in the RIB table data collection: Figure 2 collect the RIB table data of one day from each RC. In the RIB table of the RC at the first time, the set of all AS paths contained therein can be obtained .

[0049] Construct all possible triplets: from all collected RIB table data, all existing AS links can be obtained. That is, for AS and AS , if the link appears in the link set of any RC at any day , it is considered that the link exists.

[0050] In the AS path, the possible AS triplet is composed of two continuously appearing links. Therefore, for each AS , enumerate all its existing "inbound links" and "outbound links" , and then a possible triplet is formed.

[0051] Record the set of all possible triplets as ; using the AS commercial relationship data, the commercial relationship of the two links in each triplet can be known, and it can be judged whether the triplet is a valley triplet.

[0052] Record the set of valley triplets as , and the set of non-valley triplets as . Then .

[0053] Use to represent whether the triplet is a valley triplet: then is not a valley triplet, that is ; then​ is a valley triple, i.e. .

[0054] In an embodiment of the present application, before calculating the legal probability of the corresponding triplet based on the observation data of each triplet in the triplet set, it includes: traversing each triplet to see whether it appears in the routing table data of each routing collector; if the triplet appears in the routing table data of any routing collector, then recording positive observation data once; if the triplet does not appear in the routing table data of any routing collector and meets the path hop difference condition, then recording negative observation data once; and statistically analyzing the positive observation data and negative observation data of the routing table data to generate observation data.

[0055] It can be understood that the embodiment of the present application can determine the type of observation data based on the matching relationship between the triplet and the routing table data of the routing collector, and through the two-dimensional data collection of positive observation and negative observation, realize the full verification of the legitimacy of the autonomous system triplet combination, so as to distinguish between long-term stable legal paths and occasional abnormal paths, and improve the confidence and accuracy of subsequent routing leak detection.

[0056] Specifically, using RC RIB table at observation time, for each triple Observe and get the corresponding observation vector , in is the kth RC triplet The number of positive observation moments, It is RC Pair triples The number of negative observation moments. For all triples Observation.

[0057] Definition of positive observation: If in RC time In the RIB table, any AS path contains the triple , then RC At the moment Pair triples There are positive observations.

[0058] Negative Observation Definition: Recorded in RC time In the RIB table, to AS The shortest distance (in terms of the number of hops in the path) is , to AS The shortest distance is If in RC time In the RIB table, all AS paths do not contain triples. ,and , then RC At the moment Pair triples There are negative observations.

[0059] The reason for defining negative observations in this way is that the AS path seen in the RIB table is the best route selected by the router from all received routes according to certain routing rules. Therefore, the AS path in the RIB table does not contain the triple , does not mean that the triplet is not legal, it may just be that the path containing the triplet is not selected as the optimal path. However, in the BGP routing process, shorter paths will be preferred. , then in RC to AS The shortest path to connect triples , we can construct a line that is better than the current RC to AS If such a shorter path does not appear in the RIB table (i.e., the triple does not appear in the RIB table), which means that RC At the moment No such shorter circuit has been received, i.e., the triple It may be illegal in BGP routing and is therefore recorded as a negative observation.

[0060] In an embodiment of the present application, before calculating the legal probability of the corresponding triple based on the observation data of each triple in the triple set, it also includes: identifying the routing table data observation data of each routing collector; iteratively calculating the prior probability of the ternary combination method using the target algorithm based on the observation data, including the prior probability of the valley-free ternary combination method and the prior probability of the valley ternary combination method.

[0061] It can be understood that the embodiments of the present application can identify the routing table data observation data of each routing collector, and use the target algorithm to iteratively calculate the prior probability of the ternary combination method, the prior probability of the valley-free ternary combination method, and the prior probability of the valley ternary combination method based on these observation data to infer the legal probability of each AS triple, thereby effectively reducing the misjudgment caused by data noise or incomplete information, thereby improving the accuracy of routing leak detection.

[0062] Specifically, if Figure 2 As shown, remember is the actual model of the AS triple in the network. Legal (that is, caused by normal routing configuration), then ,otherwise .

[0063] Considering that each RC can have data missing, or data pollution due to routing leaks, routing hijacks, etc., the observations of RCs are not necessarily accurate. Let TPR (True Positive Rate) of each RC's observation be , FPR (False Positive Rate) be . Then FNR (False Negative Rate) is , TNR (True Negative Rate) is .

[0064] TPR and FPR of all M RCs form parameter vectors and , respectively. Let 。

[0065] Then using RCs at time instants to observe triplets , according to whether triplet is legal or not, the probability of observation vector is:

[0066] Equation (1)

[0067] where represents the probability of observing data under the assumption that triplet (x, y, z) is legal, is the true positive rate of the kth RC, is the number of positive observations of triplet by the kth RC, is the number of negative observations of triplet by the kth RC, represents the joint probability of the observation data of a specific triplet (x, y, z) by all M route collectors under the assumption that triplet is legal, represents the probability of the kth RC having positive observations of triplet when triplet is legal, represents the probability of the kth RC having negative observations of triplet when triplet

[0068] is legal. or,

[0069] Equation (2)

[0070] where, denotes the probability of observing data assuming that the triple (x, y, z) is not legal, is the false positive rate of the kth RC, is the number of positive observations of the triple by the kth RC, is the number of negative observations of the triple by the kth RC, denotes the joint probability of observing data for a particular triple (x, y, z) by all M route collectors assuming that the triple is not legal, denotes the probability that the kth RC has positive observations of the triple assuming that the triple is not legal, denotes the probability that the kth RC has negative observations of the triple assuming that the triple

[0071] is not legal. Data Model The data model describes the probability of observing given and

[0072] as: Equation (3)

[0073] where, is the probability of observing the dataset D given the actual triple the model and the parameters is the probability of observing data assuming that the triple (x, y, z) is legal, is the probability of observing data assuming that the triple (x, y, z) is not legal, is an indicator variable that is equal to if the triple (x, y, z) is legal; and if the triple (x, y, z) is not legal.

[0074] Let the prior probability that a triple is legal be . Given that eBGP routes are typically used, the prior probability that an eBGP triple is legal is higher than an AS path triple. Let the prior probability that an eBGP triple is legal be , the prior probability of the valley triple combination is , then The network model describes the actual model of the AS triple in the network as The probability of

[0075] Equation (4)

[0076] wherein is the probability of the triple (x, y, z) being legal given the prior probability parameter p; is an indicator variable, if is not a valley triple then if is a valley triple then .

[0077] Equation (5)

[0078] wherein is the probability of the triple (x, y, z) being illegal given the prior probability parameter p; is an indicator variable, if is not a valley triple then if is a valley triple then .

[0079] Equation (6)

[0080] wherein is the probability of the actual model of the AS triple being given the prior probability of the triple being ; is the prior probability of the no-valley triple combination, is the prior probability of the valley triple combination. is an indicator variable, if is not a valley triple then if is a valley triple then ; is an indicator variable, if the triple (x, y, z) is legal then ; if the triple (x, y, z) is illegal then .

[0081] The present scheme assumes that the parameters , , , are uniformly distributed over , i.e. .

[0082] In the embodiments of the present application, the legal probability of each triple in the triple set is calculated according to the observation data of the triple, including:

[0083] ;

[0084] wherein, is the legal probability of the triple (x, y, z); is the accuracy rate of the route collector observation, and are the true positive rate and the positive rate of the observation of each route collector; =1 indicates that the triple (x, y, z) is legal, =0 indicates that the triple (x, y, z) is illegal, and the observation vector is the observation vector of the triple (x, y, z), wherein is the RC positive observation time of the triple . is the RC negative observation time of the triple . represents the probability of observing the observation vector given that the triple (x, y, z) is legal; represents the probability of observing the observation vector given that the triple (x, y, z) is illegal; represents the prior probability of the legal triple, represents the prior probability of the non-valley triple, represents the prior probability of the valley triple. represents whether the triple is a valley triple, then is not a valley triple, then is a valley triple.

[0085] It can be understood that the embodiments of the present application use the observation data, the defined data and the network model, and use the Bayesian statistical inference method to infer the legal probability of the triple, which can more accurately evaluate whether each AS triple is caused by normal routing configuration, reduces the situation of misjudging the normal valley path as a routing leak by combining the prior probability and the actual observation data, and improves the detection accuracy; has good adaptability to different types of network environment and conditions, can dynamically adjust the inference result according to different observation data, and enhances the robustness of the entire routing leak detection system.

[0086] Specifically, as Figure 2 As shown in FIG, after obtaining observations of all triples at multiple times of multiple RCs, these observation data are used to infer the legitimacy probability of the triples using the Bayesian statistical inference method based on the defined data and network model.

[0087] According to Bayes' theorem, given an observation ,but 、 、 The posterior probability is:

[0088] Formula (7)

[0089] in, The actual model of the AS triple in the network when the observation is D is , the TPR and FPR of RC are , the prior probability of the ternary combination method is The probability of The actual model of AS triples in the network is , the TPR and FPR of RC are In the case of The probability of The prior probability of the ternary combination method is The actual model of the AS triple is The probability of The TPR and FPR of RC are probability; The prior probability of the ternary combination method is The probability of For observation probability.

[0090] Then given the observation and parameters 、 , the network model is The probability is:

[0091] Formula (8)

[0092] in, For observation D, the TPR and FPR of RC are , the prior probability of the ternary combination method is The actual model of AS triples in the network is The probability of The actual model of the AS triple in the network when the observation is D is , the TPR and FPR of RC are , the prior probability of the ternary combination method is The probability of The TPR and FPR of RC when the observation is D are , the prior probability of the ternary combination method is probability.

[0093] Substituting equations (3) and (6) into equation (8), we can derive:

[0094] Formula (9)

[0095] in, For observation D, the TPR and FPR of RC are , the prior probability of the ternary combination method is The actual model of AS triples in the network is The probability of is the legal probability of the triple (x, y, z); is an indicator variable. If the triple (x, y, z) is legal, then ; If the triple (x,y,z) is illegal then .

[0096] in, for:

[0097] Formula (10)

[0098]

[0099] in, is the legal probability of the triple (x, y, z); is the accuracy observed by the routing collector, and is the observed true positive rate and positive rate for each routing collector; =1 means the triple (x, y, z) is legal, =0 means the triple (x, y, z) is illegal, the observation vector is the observation vector of the triple (x, y, z), where It is RC Pair triples The number of positive observation moments, It is RC Pair triples The number of negative observation moments. Indicates that given a legal triple (x, y, z), the observation vector is observed probability; Indicates that given a triple (x, y, z) is illegal, the observation vector is observed probability; represents the prior probability of the ternary combination method, The prior probability of the valley-free ternary combination method is, Denotes the prior probability of the valley triple combination method. Represents a triple Is it a valley triple? but Not a valley triplet, but It is a valley triplet.

[0100] (Formula (10)) is the triplet observation data , the parameters are and When, triple However, in reality, the accuracy of RC observation (parameter ) and the prior probability of the ternary combination method (parameter ) is unknown and needs to be estimated based on observed data and value.

[0101] This solution uses the Expectation-Maximization Algorithm (EMalgorithm) to estimate parameters and The EM Algorithm is used to find the maximum likelihood estimate or maximum a posteriori estimate of the parameters in a probability model with latent variables. Under the conditions, the most likely parameters and is the parameter that maximizes the value of:

[0102] ;Formula (11)

[0103] in, The TPR and FPR of RC when the observation is D are , the prior probability of the ternary combination method is The probability of The actual model of the AS triple in the network when the observation is D is , the TPR and FPR of RC are , the prior probability of the ternary combination method is The probability of is the prior probability of the valley-free ternary combination method, P (x,y,z) is the prior probability of a valid triple (x,y,z), P (x,y,z) is the prior probability of a valid triple (x,y,z), then (x,y,z) is not a valid triple, then (x,y,z) is a valid triple, P (x,y,z) is the probability of observing data given that the triple (x,y,z) is valid, P (x,y,z) is the probability of observing data given that the triple (x,y,z) is not valid, P (x,y,z) is the probability of observing .

[0104] The parameters and that maximize equation (11) can be found by taking the partial derivatives of equation (10) with respect to , , , and solving the resulting equations for the values of the partial derivatives that are equal to zero. The expressions for the parameters are:

[0105] Equation (12)

[0106] where is the true positive rate observed by the kth RC, is the probability that the triple is valid, is the number of positive observations of the triple by the kth RC, is the number of negative observations of the triple by the kth RC, and S is the set of all possible triples.

[0107] Equation (13)

[0108] where is the false positive rate observed by the kth RC, is the probability that the triple is valid, is the number of positive observations of the triple by the kth RC, is the number of negative observations of the triple by the kth RC, and S is the set of all possible triples.

[0109] Equation (14)

[0110] where is the prior probability of a valid triple, is the probability of a legal triple is the set of valley triples.

[0111] Equation (15)

[0112] where is the prior probability of a legal triple is the probability of a legal triple is the set of valley triples.

[0113] After the expressions of the parameters (Equations (12)-(15)) are known, the EM Algorithm can be used to iteratively solve the values of the parameters according to the observed data . After the values of the parameters are obtained, the probability of a legal triple can be calculated according to Equation (10).

[0114] In step S103, the autonomous system path in the route announcement data is extracted, whether the autonomous system path is a valley path is detected according to the commercial relationship data, and the route leakage detection result is generated according to the legal probability of the valley triple in the valley path.

[0115] It can be understood that the embodiments of the present application can extract the autonomous system path in the route announcement data, detect whether the autonomous system path is a valley path according to the commercial relationship data, and generate the route leakage detection result according to the legal probability of the valley triple in the valley path, which can effectively distinguish the valley path caused by normal configuration and the actual route leakage situation, significantly reduce the probability of misjudging the normal route as route leakage, timely and accurately detect and respond to route leakage, and help maintain the route security and stability of the Internet, and avoid the problems of traffic interruption or redirection caused by false routes.

[0116] In the embodiments of the present application, whether the autonomous system path is a valley path is detected according to the commercial relationship data, and the valley triple is identified, including: identifying the adjacent link relationship in the autonomous system path; if the adjacent link relationship matches the commercial relationship data of at least one valley triple, the autonomous system path is a valley path, and the autonomous system triple of the adjacent link is a valley triple.

[0117] ​​​It can be understood that the embodiments of the present application can detect whether the autonomous system path is a valley path and identify the valley triplets therein according to the business relationship data, including identifying the relationships of valley adjacent links in the autonomous system path, and judging whether the relationships match at least one valley triplet business relationship data, so as to determine whether the triplets corresponding to the adjacent links are valley triplets. Based on the business relationship between ASs, it can be judged whether a given route meets the valley-free principle. If it is found that the principle is violated, it indicates that there may be a route leakage or other abnormal routing behavior. The potential route leakage problem can be effectively identified from complex route announcement data, and the false positive situation is reduced.

[0118] In the embodiments of the present application, the route leakage detection result is generated according to the legal probability of the valley triplet, including: if the legal probability of the valley triplet is higher than a preset threshold, it is considered as a normal route configuration; if the legal probability of the valley triplet is lower than the preset threshold, it is considered as route leakage.

[0119] The preset threshold can be set according to actual needs, and is not specifically limited.

[0120] It can be understood that the embodiments of the present application can effectively distinguish the normal route configuration from the actual route leakage by setting a reasonable threshold to evaluate the legal probability of the valley triplet, which helps to avoid false positives and ensures that only the routes with real problems are marked as leakage.

[0121] Specifically, as shown in Figure 2 , in the route leakage detection, the input is a real-time BGP Update data stream, and the leakage detection is performed according to the business relationship data set and the legal probability of the triplet.

[0122] For each BGP Update message, the following steps are performed:

[0123] 1. Analyze the BGP Update message and extract the timestamp, AS Path, prefix and other fields therein.

[0124] 2. Check the business relationship of the adjacent two AS links (i.e. adjacent three ASs) in the AS path in turn. If the business relationship is one of p2c c2p, p2c p2p, p2p c2p, p2p p2p, it is judged that a valley triplet appears. If there is no any valley triplet, the checking step is ended, and the next BGP Update message is checked; if a valley triplet appears, the subsequent steps are performed.

[0125] 3. Check the legality probability of valley triplets. If the legality probability is higher than the threshold, it is considered as normal route configuration, the checking step is ended, and the next BGP Update message is checked; if the legality probability is lower than the threshold, it is considered as route leakage, and the subsequent step is executed.

[0126] 4. The detected route leakage is recorded, including the following information: BGP Update timestamp, ASPath, valley triplet, associated prefix, etc., and a route leakage alarm is generated.

[0127] In summary, the application first uses the RIB table and AS business relationship data to infer the legality probability of triplets. After obtaining the legality probability of all triplets, route leakage detection is performed. In route leakage detection, when a valley triplet is encountered, if its legality probability is less than a set threshold, it is considered that leakage has occurred, and an alarm is given.

[0128] In specific embodiments, all RIB tables of RCs from RouteViews and RIPE are used as input for triplet probability inference, and more than 800 million possible triplets are constructed. The probability of these triplets is inferred, and more than 550,000 high-probability triplets (legality probability greater than 0.7) and more than 40,000 low-probability triplets (legality probability less than 0.1) are obtained.

[0129] Route leakage detection is performed using the inferred triplet probability. AS business relationship data is obtained from CAIDA, and BGP Update data is obtained from 300 observation points of RouteViews and RIPE.

[0130] In the target time period, about 210 million BGP Update messages of prefix announcement are processed per day. The probability threshold for leakage detection is set to 0.1, that is, when the legality probability of the detected valley triplet is less than 0.1, it is considered as high-confidence leakage. During the detection period, 928 route leakages of business relationship p2c and c2p are detected, including 40 high-confidence leakages. Compared with 118 route leakage events reported by the Cloudflare platform at the same time, 49 of them are verified as leakages, and 60 of them are identified as false positives caused by triplets with high legality probability (legality probability greater than 0.7), and 9 of them are not received by our program related BGP Update messages.

[0131] The detection results show that the application can effectively judge the legality probability of triplets. Applying the legality probability to route leakage detection can effectively identify high-confidence route leakages occurring in the Internet. The legality probability of triplets inferred by the application can also be applied to judge the authenticity of route leakages reported by public platforms. Therefore, it has good application prospect.

[0132] According to the route leakage detection method provided in the embodiments of the present application, all possible continuous autonomous system triplets are extracted from the routing table data to construct a triplet set of autonomous systems, the legal probability of the triplets is calculated through a Bayesian model in combination with positive observation and negative observation to distinguish long-term stable legal paths from occasional abnormal paths, the autonomous system paths in the route announcement data are extracted, whether the autonomous system paths are valley paths and the valley triplets therein are identified according to the commercial relationship data to accurately locate abnormal paths, the route leakage detection result is generated according to the legal probability of the valley triplets, the overall false positive rate and the false negative rate are reduced, and the detection efficiency and adaptability are improved.

[0133] Secondly, the route leakage detection device provided in the embodiments of the present application is described with reference to the accompanying drawings.

[0134] Figure 3 is a block schematic diagram of the route leakage detection device in the embodiments of the present application.

[0135] As shown in Figure 3 , the route leakage detection device 10 comprises an acquisition module 100, a construction module 200 and an extraction module 300.

[0136] The acquisition module 100 is configured to acquire routing table data, commercial relationship data of autonomous systems and route announcement data, the construction module 200 is configured to construct a triplet set of autonomous systems according to the routing table data, and calculate the legal probability of each triplet in the triplet set according to the observation data of the corresponding triplet, and the extraction module 300 is configured to extract autonomous system paths in the route announcement data, detect whether the autonomous system paths are valley paths and identify the valley triplets therein according to the commercial relationship data, and generate a route leakage detection result according to the legal probability of the valley triplets.

[0137] It should be noted that the foregoing explanation and description of the route leakage detection method embodiments are also applicable to the route leakage detection device of this embodiment, which will not be described here again.

[0138] According to the route leakage detection device provided in the embodiments of the present application, all possible continuous autonomous system triplets are extracted from the routing table data to construct a triplet set of autonomous systems, the legal probability of the triplets is calculated through a Bayesian model in combination with positive observation and negative observation to distinguish long-term stable legal paths from occasional abnormal paths, the autonomous system paths in the route announcement data are extracted, whether the autonomous system paths are valley paths and the valley triplets therein are identified according to the commercial relationship data to accurately locate abnormal paths, the route leakage detection result is generated according to the legal probability of the valley triplets, the overall false positive rate and the false negative rate are reduced, and the detection efficiency and adaptability are improved.

[0139] Figure 4A structural schematic diagram of an electronic device is provided in the embodiments of the present application. The electronic device can include

[0140] The memory 401, the processor 402 and the computer program stored in the memory 401 and executable on the processor 402.

[0141] The processor 402 implements the route leakage detection method provided in the above embodiments when executing the program.

[0142] Further, the electronic device further includes

[0143] The communication interface 403 is used for communication between the memory 401 and the processor 402.

[0144] The memory 401 is used for storing the computer program executable on the processor 402.

[0145] The memory 401 can include a high-speed RAM memory, and can also include a non-volatile memory, for example, at least one disk memory.

[0146] If the memory 401, the processor 402 and the communication interface 403 are independently implemented, the communication interface 403, the memory 401 and the processor 402 can be connected to each other through a bus and complete communication between each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, Figure 4 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0147] Optionally, in specific implementation, if the memory 401, the processor 402 and the communication interface 403 are integrated on a chip, the memory 401, the processor 402 and the communication interface 403 can complete communication between each other through an internal interface.

[0148] The processor 402 can be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement one or more embodiments of the present application.

[0149] The embodiments of the present application further provide a computer readable storage medium, which stores a computer program or instructions, and the computer program or instructions are executed by a processor to implement the above-mentioned route leakage detection method.

[0150] The embodiments of the present application further provide a computer program product, which comprises a computer program or instructions, and the computer program or instructions are executed by a processor to implement the above-mentioned route leakage detection method.

[0151] In the description of the present application, the description of the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the present application, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in one or N embodiments or examples. In addition, the person skilled in the art can combine and combine the different embodiments or examples described in the present application and the features of the different embodiments or examples without contradiction.

[0152] In addition, the terms "first", "second" are only used for description purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include at least one of the features. In the description of the present application, the meaning of "N" is at least two, for example, two, three, etc., unless otherwise specifically limited.

[0153] Any process or method descriptions in flow charts or described elsewhere herein can be understood as representing one or N executable instructions, code segments, or portions of computer readable code that include the steps for implementing the custom logic function or process, and the scope of the preferred embodiments of the present application includes additional implementation involving other processes or methods that can be performed according to the claimed application, where the steps are performed in different order, including essentially simultaneously, or in reverse order, as the function and results of the processes would support, which should be understood by those skilled in the art of the embodiments of the present application.

[0154] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiment, the N steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, it can be implemented using any one or a combination of the following technologies known in the art: discrete logic circuits having logic gate circuits for implementing logical functions on data signals, application-specific integrated circuits having suitable combinational logic gate circuits, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0155] Those skilled in the art will understand that all or part of the steps in the method of the above embodiment can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiment.

Claims

1. A routing leak detection method, characterized in that: The following steps are involved: Obtain routing table data, autonomous system business relationship data and routing announcement data; Constructing a triplet set of the autonomous system according to the routing table data, and calculating the legal probability of each triplet in the triplet set according to the observed data of each triplet; Extract the autonomous system path in the routing announcement data, detect whether the autonomous system path is a valley path based on the business relationship data, and generate a routing leakage detection result based on the valley ternary combination method probability in the valley path.

2. The routing leak detection method according to claim 1, wherein: Before calculating the legal probability of each triple in the triple set according to the observed data of each triple, the method includes: Check whether each triplet appears in the routing table data of each routing collector; If the triplet appears in the routing table data of any routing collector, a positive observation data is recorded; If the triplet does not appear in the routing table data of any routing collector and meets the path hop difference condition, a negative observation data is recorded; Observation data is generated by counting positive observation data and negative observation data of the routing table data.

3. The routing leak detection method according to claim 2, wherein: Before calculating the legal probability of each triple in the triple set according to the observed data of each triple, the method further includes: Identify routing table data observation data for each routing collector; The prior probability of the ternary combination method, the prior probability of the valley-free ternary combination method and the prior probability of the valley ternary combination method are iteratively calculated using a target algorithm according to the observed data.

4. The routing leak detection method according to claim 1, wherein: The detecting, based on the business relationship data, whether the autonomous system path is a valley path includes: Identifying adjacent link relationships in the autonomous system path; If the adjacent link relationship matches the business relationship data of at least one valley triple, the autonomous system path is a valley path, and the autonomous system triple of the adjacent link is a valley triple.

5. The routing leak detection method according to claim 1, wherein: The generating of the route leak detection result according to the probability of the valley triple combination method includes: If the legitimacy probability of the valley triplet is higher than a preset threshold, it is considered to be a normal routing configuration; If the legitimacy probability of the valley triplet is lower than a preset threshold, it is considered as a route leak.

6. A routing leak detection device, characterized in that: include: An acquisition module, used to acquire routing table data, business relationship data of the autonomous system and routing announcement data; A construction module, configured to construct a triple set of autonomous systems based on the routing table data, and calculate a legitimacy probability of each triple in the triple set based on the observed data of each triple; The extraction module is used to extract the autonomous system path in the routing announcement data, detect whether the autonomous system path is a valley path based on the business relationship data, and generate a routing leakage detection result based on the valley ternary combination method probability in the valley path.

7. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the routing leak detection method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the route leak detection method according to any one of claims 1 to 5.

9. A computer program product, characterized in that The method comprises a computer program, which is used to implement the routing leak detection method according to any one of claims 1 to 5 when executed by a processor.

Images