Routing hijacking event asynchronous detection method and device, equipment and medium

Abstract

The invention relates to the technical field of internet security, in particular to a routing hijacking event asynchronous detection method, device and equipment and a medium, and the method comprises the steps: constructing a biplane detection pair, and enabling the biplane detection pair and preset biplane detection points to form an available detection point set; obtaining an active IP address and a network port of the target single routing exception event, and then selecting target detection points with the number required by the target single routing exception event from the available detection point set according to the active IP address and the network port; based on an asynchronous detection framework, calling a required number of target detection points to initiate detection to a target single routing exception event, and recovering a detection result; and analyzing whether the abnormal event of the target single route is caused by a hijacking event or not according to a detection result. Therefore, the problems that the number of detection points used in the detection process of an existing detection scheme combining a control layer and a data layer is limited, frequent calling may cause the fact that the service of the detection points is rejected, and the detection efficiency and the accuracy of a detection result are reduced are solved.

Description

Technical Field

[0001] The present invention relates to the field of Internet security technology, and particularly relates to a method, device, equipment and medium for asynchronously detecting routing hijacking events. Background Technique

[0002] Routing hijacking is a major threat to the security of the Internet BGP (Border Gateway Protocol) protocol, which mainly includes the following two types: (1) Origin hijacking: The attacker forges a BGP announcement, claiming the routing right to an IP prefix that it does not own, causing traffic to be misforwarded to the network it controls. (2) Fake link hijacking: The attacker inserts false intermediate path information in the BGP announcement, resulting in the routing traffic deviating from the original path. Both types of hijacking may lead to serious consequences, including data leakage, service interruption, and even being used for further DDoS attacks or phishing attacks.

[0003] In response to the above hidden dangers in the BGP protocol, relevant researchers have proposed many technical solutions to enhance the security of the BGP protocol, which can be mainly divided into two types: route origin verification and hijacking detection. Route Origin Validation (ROV) verifies the ownership relationship between the IP prefix and the autonomous system (AS) in the BGP announcement to prevent the spread of unauthorized routing announcements. The hijacking detection mechanism monitors the routing announcements and related network traffic to detect possible hijacking behaviors in real time. In principle, ROV can well suppress origin hijacking based on forged BGP announcements. However, due to the insufficient deployment of the ROV mechanism in the existing network, origin hijacking may still exist in the network, and the ROV mechanism cannot well handle fake link hijacking. Therefore, a hijacking detection mechanism is still needed to assist in maintaining Internet security.

[0004] Existing hijacking detection mechanisms can be divided into the following three methods: (1) Routing control layer detection scheme: By monitoring abnormal changes in BGP routing information, such as path changes, abnormal prefix ownership, etc., potential hijacking events are discovered. The advantage of this method is strong real-time performance, but the accuracy rate is relatively low, and it is easy to generate too many false alarms. (2) Routing data layer detection scheme: Relying on active probing technology, the reachability of abnormal prefixes or relevant BGP routing information is used to verify abnormal events. This method has a high detection accuracy rate, but it needs to continuously initiate probes, which may increase the network burden and cannot handle the probing requirements in real time. (3) Detection scheme combining the control layer and the data layer: Combining the advantages of the two schemes, after the control layer discovers an abnormality, it drives the data layer to initiate a probe. The data layer uses multiple routing servers as probing points to detect the network status of abnormal prefixes, including using ping to detect the reachability of active IPs, and using show ip bgp to check the BGP information of abnormal prefixes in the routing servers (such a probing point that can obtain both the routing information of the control layer and the reachability of active IPs in the data layer is called a dual-plane probing point). Then, correlation analysis is performed based on the probing results to determine whether the routing abnormal event is a hijacking event.

[0005] Although the existing detection scheme combining the control layer and the data layer has improved the detection accuracy and real-time performance, there are still the following problems: With the growth of the network scale, the number of abnormal routing events to be detected daily also gradually increases. The number of probing points (mainly using routing servers) used in the existing detection scheme combining the control layer and the data layer is limited, and frequent calls may lead to denial of service of the probing points, thus reducing the probing efficiency. In addition, the probing points used in the existing scheme are limited to several ASes. However, the propagation range of hijacking events in the network is usually limited. If the ASes where the probing points for detection are located are not affected by the hijacking event, it will lead to misjudging the hijacking event as a non-hijacking event, which will reduce the accuracy of the detection results of the existing detection scheme. Summary of the Invention

[0006] The present invention provides a method, device, equipment and medium for asynchronous probing of routing hijacking events, so as to solve the problems that the number of probing points used in the existing detection scheme combining the control layer and the data layer is limited, and frequent calls may lead to denial of service of the probing points, thus reducing the probing efficiency and the accuracy of the probing results.

[0007] An embodiment of the first aspect of the present invention provides a method for asynchronously detecting a route hijacking event, including the following steps: constructing a dual-plane detection pair, and forming an available detection point set with the dual-plane detection pair and a preset dual-plane detection point; obtaining the active IP address and network port of a target single route anomaly event, and selecting the target detection points required for the target single route anomaly event in the available detection point set according to the active IP address and network port; based on an asynchronous detection framework, calling the target detection points of the required quantity to initiate detection on the target single route anomaly event, and recovering the detection results; analyzing whether the target single route anomaly event is caused by a hijacking event according to the detection results.

[0008] Optionally, the constructing a dual-plane detection pair, and forming an available detection point set with the dual-plane detection pair and a preset dual-plane detection point includes: Obtaining detection points of different control planes and detection points of different data planes within the same autonomous system; respectively obtaining the geographical locations of the detection points of different control planes and the detection points of different data planes, and constructing a plurality of initial dual-plane detection pairs with any detection point of a control plane and any detection point of a data plane with the same geographical location; obtaining the second-hop autonomous system in the routing paths obtained by the control plane and the data plane in each initial dual-plane detection pair to filter a plurality of dual-plane detection pairs in which the second-hop autonomous systems in the routing paths obtained by the control plane and the data plane are consistent; forming the available detection point set with the plurality of dual-plane detection pairs and the preset dual-plane detection point.

[0009] Optionally, the obtaining the active IP address and network port of a target single route anomaly event, and selecting the target detection points required for the target single route anomaly event in the available detection point set according to the active IP address and network port includes: Determine the active IP addresses and network ports corresponding to the target IP prefix according to the target IP prefix of the target single routing anomaly event; obtain the autonomous system path included in the Border Gateway Protocol information of the target IP prefix; extract the multiple autonomous systems included in the autonomous system path to form an autonomous system set; select a first preset number of target detection points in the autonomous system set, where the first preset number is the first preset proportion less than or equal to the number of detection points required for a single task; select a second preset number of target detection points in the available detection point set according to the classification in the autonomous system topology to cover different types of autonomous systems, where the second preset number is the second preset proportion less than or equal to the number of detection points required for a single task; randomly select multiple target detection points from the detection points not selected in the available detection point set to make up the required number of target detection points, where the required number of target detection points includes mirror class detection points, route server class detection points, and side channel detection points that support IP ID counters and can respond to TCP packets.

[0010] Optionally, based on the asynchronous detection framework, call the required number of target detection points to initiate a detection on the target single routing anomaly event and recover the detection results, including: Based on the asynchronous detection framework, interact with the periscope-like detection point by calling the network port corresponding to the target IP prefix to initiate detection towards the target IP prefix and its corresponding active IP addresses; recover the Border Gateway Protocol (BGP) information of the periscope-like detection point to the target IP prefix and return the first set of autonomous system paths reaching the target IP prefix, and extract the first optimal path from the first set of autonomous system paths. Check whether the first optimal path contains the hijacker autonomous system in prefix origin hijacking or the suspicious autonomous system pair in forged link hijacking. If it contains the hijacker autonomous system in prefix origin hijacking or the suspicious autonomous system pair in forged link hijacking, it is considered that the periscope-like detection point is affected by the routing anomaly event; otherwise, it is considered that the periscope-like detection point is not affected by the routing anomaly event. If the return result of the ping command executed by the periscope-like detection point shows that there are reachable active IPs under the prefix, it is considered that the periscope-like detection point is reachable to the target IP prefix; otherwise, it is considered that the periscope-like detection point is not reachable to the target IP prefix. Call the routing server-like detection point to log in to the routing server corresponding to the target single routing anomaly event in a script interaction manner to initiate detection towards the target single routing anomaly event; recover the BGP information of the server-like detection point to the target IP prefix and return the second set of autonomous system paths reaching the target IP prefix, and extract the second optimal path from the second set of autonomous system paths. Check whether the second optimal path contains the hijacker autonomous system in prefix origin hijacking or the suspicious autonomous system pair in forged link hijacking. If it contains the hijacker autonomous system in prefix origin hijacking or the suspicious autonomous system pair in forged link hijacking, it is considered that the server-like detection point is affected by the routing anomaly event; otherwise, it is considered that the periscope-like detection point is not affected by the routing anomaly event. If the return result of the ping command executed by the server-like detection point shows that there are reachable active IPs under the prefix, it is considered that the server-like detection point is reachable to the target IP prefix; otherwise, it is considered that the server-like detection point is not reachable to the target IP prefix. Send a TCP SYN-ACK packet to the side-channel detection point and receive the TCP RST packet returned by the side-channel detection point to recover the IPID field value in the TCP RST packet. Send a TCP SYN spoofing packet to the active IP address corresponding to the target IP prefix and trigger a change in the IP ID counter of the side-channel detection point. Send the TCP SYN-ACK packet to the side-channel detection point multiple times and receive multiple new TCP RST packets returned by the side-channel detection point to recover multiple new IPID field values in the new TCP RST packets.Compare the IP ID field value with each new IP ID field value respectively to obtain multiple change values. If there are at least two 2s among the multiple change values, it is considered that the side-channel detection point is unreachable to the target IP prefix; otherwise, it is considered that the side-channel detection point is reachable to the target IP prefix.

[0011] Optionally, the working node responsible for the current detection task in the asynchronous detection framework will set multiple concurrent threads to interact with each target detection point during the detection period. Among them, each target detection point corresponds to two threads. One thread is responsible for obtaining the border gateway information of the target detection point to the target IP prefix, and the other thread is responsible for obtaining the reachability of the active IP addresses under the target detection point to the target IP prefix. The working node responsible for the current detection task in the asynchronous detection framework will also return the detection results recovered from each target detection point to the asynchronous detection task scheduling main process through the message middleware.

[0012] Optionally, analyzing whether the target single routing anomaly event is caused by a hijacking event according to the detection result includes: If the number of detection points in the detection result is greater than the preset third proportion of the required number of target detection points, where the number of detection points affected by the routing anomaly event and unreachable to the target IP prefix is greater than the preset fourth proportion of the number of detection points in the detection result, then the target single routing anomaly event is considered a high-confidence hijacking event; if the number of detection points in the detection result is greater than the preset third proportion of the required number of target detection points, where the number of detection points affected by the routing anomaly event and unreachable to the target IP prefix is less than or equal to the preset fourth proportion of the number of detection points in the detection result, and the number of detection points affected by the routing anomaly event and unreachable to the target IP prefix is greater than the preset fourth proportion of the number of detection points in the detection result, then the target single routing anomaly event is considered a medium-confidence hijacking event; if the number of detection points in the detection result is less than or equal to the preset third proportion of the required number of target detection points but greater than the preset fourth proportion of the required number of target detection points, where the number of detection points affected by the routing anomaly event and unreachable to the target IP prefix is greater than the preset third proportion of the number of detection points in the detection result, then the target single routing anomaly event is considered a medium-confidence hijacking event; if the number of detection points in the detection result is less than or equal to the preset third proportion of the required number of target detection points but greater than the preset fourth proportion of the required number of target detection points, where the number of detection points affected by the routing anomaly event and unreachable to the target IP prefix is less than the preset third proportion of the number of detection points in the detection result, or the number of detection points in the detection result is less than or equal to the preset fourth proportion of the required number of target detection points, then the target single routing anomaly event is considered a low-confidence hijacking event.

[0013] An embodiment of the second aspect of the present invention provides a routing hijacking event asynchronous detection device, including: a construction module for constructing a dual-plane detection pair and forming an available detection point set with the preset dual-plane detection points; a determination module for obtaining the active IP address and network port of the target single routing anomaly event, and selecting the required number of target detection points for the target single routing anomaly event from the available detection point set according to the active IP address and network port; a detection module for initiating a detection of the target single routing anomaly event by invoking the required number of target detection points based on an asynchronous detection framework and recovering the detection result; and an analysis module for analyzing whether the target single routing anomaly event is caused by a hijacking event according to the detection result.

[0014] An embodiment of the third aspect of the present invention provides an electronic device, including: a memory, a processor, and a computer program stored on the memory and executable on the processor, where the processor executes the program to implement the asynchronous detection method for route hijacking events as described in the above embodiments.

[0015] An embodiment of the fourth aspect of the present invention provides a computer program product, where when the computer program / instructions are executed by a processor, the asynchronous detection method for route hijacking events as described above is implemented.

[0016] An embodiment of the fifth aspect of the present invention provides a computer-readable storage medium, where the computer-readable storage medium stores a computer program, and when the program is executed by a processor, the asynchronous detection method for route hijacking events as described above is implemented.

[0017] The asynchronous detection method, device, equipment, and medium for route hijacking events proposed in the embodiments of the present invention construct a dual-plane detection pair by combining a detection point that can only obtain control-layer route information (such as a Looking Glass detection point that only supports the show ip bgp command) and a detection point that can only perform reachability detection at the data layer (such as a detection point that supports side-channel detection technology). On the premise of ensuring that the two types of detection points can provide comparable routing paths, the detection results of the dual-plane detection pair are regarded as the results from the same detection point. This design enables it to have the equivalent ability to a dual-plane detection point that can independently initiate control-layer and data-layer detections, thus significantly increasing the number of available detection points in the network and expanding the coverage of detection points; based on the dual-plane detection points (such as Looking Glass and route servers) in the network and the newly constructed dual-plane detection pair, a detection scheme that supports asynchronous concurrency is designed. This scheme includes the scheduling of detection points and detection pairs. On the premise of ensuring the accuracy of detection results, it reduces the number of detection points or detection pairs required for a single routing anomaly event and reduces the call pressure on detection points (pairs). It also includes the confidence evaluation of the detection results of hijacking events. Combining the number of effective detection results and other relevant information, a confidence evaluation mechanism is established to comprehensively evaluate the detection results of each route hijacking event to ensure the reliability and accuracy of the detection results; through the above improvements, the present invention can effectively meet the detection requirements for routing anomaly events in large-scale networks and achieve efficient and accurate detection of the two main types of route hijacking events, namely origin hijacking and forged link hijacking.

[0018] Additional aspects and advantages of the present invention will be given in part in the following description, become apparent in part from the following description, or be learned through the practice of the present invention. Description of the Drawings

[0019] The above and / or additional aspects and advantages of the present invention will become apparent and be readily understood from the following description of embodiments in conjunction with the accompanying drawings, where: Figure 1 It is a flowchart of a method for asynchronously detecting routing hijacking events provided by an embodiment of the present invention; Figure 2 It is a schematic framework diagram of a method for asynchronously detecting routing hijacking events provided by an embodiment of the present invention; Figure 3 It is a schematic diagram of a side-channel detection method based on IP ID provided by an embodiment of the present invention, where (a) indicates that the side-channel detection point is reachable to the target prefix, and (b) indicates that the side-channel detection point is unreachable to the target prefix; Figure 4 It is a schematic block diagram of a device for asynchronously detecting routing hijacking events provided by an embodiment of the present invention; Figure 5 It is a schematic structural diagram of an electronic device provided by an embodiment of the present invention.

[0020] Description of reference numerals: 40 - Device for asynchronously detecting routing hijacking events, 401 - Construction module, 402 - Determination module, 403 - Detection module, and 404 - Analysis module. Detailed implementation manners

[0021] The embodiments of the present invention are described in detail below. Examples of the embodiments are shown in the accompanying drawings, where the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described by referring to the accompanying drawings are exemplary and are intended to explain the present invention, and should not be construed as a limitation to the present invention.

[0022] The method, device, equipment, and medium for asynchronously detecting routing hijacking events according to embodiments of the present invention are described below with reference to the accompanying drawings.

[0023] Figure 1 It is a schematic flow diagram of a method for asynchronously detecting routing hijacking events provided by an embodiment of the present invention.

[0024] As Figure 1 shown, the method for asynchronously detecting routing hijacking events includes the following steps: In step S101, a dual-plane detection pair is constructed, and the dual-plane detection pair and a preset dual-plane detection point form a set of available detection points.

[0025] In some embodiments, constructing a dual-plane detection pair and forming a set of available detection points with the dual-plane detection pair and a preset dual-plane detection point includes: Obtaining detection points on different control planes and detection points on different data planes within the same autonomous system; Obtain the geographical locations of the probe points of different control planes and the probe points of different data planes respectively, and construct multiple initial dual-plane probe pairs by combining the probe points of any control plane and the probe points of any data plane with the same geographical location; Obtain the second-hop autonomous systems in the routing paths obtained by the control plane and the data plane in each initial dual-plane probe pair, so as to screen out multiple dual-plane probe pairs in which the second-hop autonomous systems in the routing paths obtained by the control plane and the data plane in multiple initial dual-plane probe pairs are the same; Form an available probe point set according to multiple dual-plane probe pairs and preset dual-plane probe points.

[0026] In the actual execution process, among the distributed probe points existing in the current network, some probe points provided by Looking Glass websites and routing servers can support obtaining the routing path information of a specified prefix in the control plane and detecting the reachability of active IPs under the target prefix in the data plane at the same time. Such probe points are called dual-plane probe points in the detection framework implemented in the embodiments of the present invention. Since the control and data plane detections initiated by these probe points come from the same geographical location and use the same routing policy, this means that the routing behaviors of these probe points in the control plane and the data plane are consistent. Therefore, the detection results obtained by these probe points can be directly used to evaluate whether a routing anomaly event is caused by a hijacking event.

[0027] In addition, in the control plane, some of the probe points and route servers provided by Looking Glass websites only support initiating probes in the control plane to obtain route path information for a specified prefix. However, CAIDA (Center for Applied Internet Data Analysis, an international cooperation institution that studies the global Internet structure and data), Ark (Archipelago, an active measurement infrastructure of CAIDA serving the network research community), and RIPE Atlas (a global Internet measurement platform operated by the RIPE Network Coordination Centre in Europe) provide a number of probe points that can support the execution of the traceroute probing command for a specified prefix. The traceroute probing command can be used to determine the reachability of the prefix. At the same time, there are also some side-channel probe points in the network that support IP Identification (ID) counters and can respond to Transmission Control Protocol (TCP) packets. These probe points utilize the sequential incrementality of the IP ID field in the IPv4 (Internet Protocol Version 4) packet header and observe the responses of remote devices by sending TCP packets to infer their reachability. For the above-mentioned probe points, they cannot be independently used to evaluate routing anomaly events, so previous routing hijacking detection methods have not considered using such probe points.

[0028] However, if it can be ensured that a control plane probe point and a data plane probe point can provide comparable route paths, they can be regarded as a dual-plane probe pair, and their respective probing results can be combined to evaluate routing anomaly events.

[0029] To achieve the above premise, the embodiments of the present invention propose a method for constructing probe pairs to screen control plane and data plane probe points that meet the requirements. The specific construction process is as follows: First, it is necessary to ensure that the probe points on different planes are within the same autonomous system (AS). However, considering that different probe points within the same AS may also adopt different routing strategies, in order to ensure the consistency of routing strategies as much as possible, it is also necessary to further ensure that these pairs of observation points are located in the same city. The geographical location can be obtained through the IP address of the probe point and the IP geographical location database, or through the AS where the probe point is located and the Internet Exchange Point (IXP) connected to it, combined with open-source platforms such as PeeringDB to infer its geographical location. If the above information is not available, a domain name inference algorithm can also be tried to extract the geographical code from the domain name and deduce its geographical location. Generally, if the probe points on the control plane and the data plane are within the same AS and have basically the same geographical location, it can be considered that their routing behaviors on the control plane and the data plane are basically the same. However, it should be noted that even for observation point pairs in the same AS and the same city, there may still be different strategies for some specific routes. For some probe pairs (mainly for probe pairs containing probe points from CAIDA Ark and RIPE Atlas), if the second-hop AS in the routing paths obtained on the control plane and the data plane is inconsistent after using the IP-to-AS mapping method, this probe pair will be considered not to be used for initiating probes to further reduce the interference of possible routing strategy inconsistencies within the observation point pair on the accuracy of the detection results.

[0030] The qualified dual-plane probe pairs obtained in the above manner can form an available set of probe points together with the preset dual-plane probe points, which can be called by the asynchronous routing hijacking event detection method to obtain detection results for evaluating whether the routing anomaly event is caused by a hijacking event.

[0031] In step S102, the active IP address and network port of the target single routing anomaly event are obtained, and the required number of target probe points for the target single routing anomaly event are selected from the available set of probe points according to the active IP address and network port.

[0032] In some embodiments, obtaining the active IP address and network port of the target single routing anomaly event and selecting the required number of target probe points for the target single routing anomaly event from the available set of probe points according to the active IP address and network port includes: Determining the active IP address and network port corresponding to the target IP prefix according to the target IP prefix of the target single routing anomaly event; Obtaining the autonomous system path included in the Border Gateway Protocol information of the target IP prefix; Extracting multiple autonomous systems included in the autonomous system path to form an autonomous system set; Select the first preset number of target detection points from the set of autonomous systems, where the first preset number is the first preset percentage less than or equal to the number of detection points required for a single task; Select the second preset number of target detection points from the set of available detection points according to the classification in the autonomous system topology to cover different types of autonomous systems, where the second preset number is the second preset percentage less than or equal to the number of detection points required for a single task; Randomly select multiple target detection points from the detection points not selected in the set of available detection points to make up the required number of target detection points, where the required number of target detection points includes periscope-type detection points, routing server-type detection points, and side-channel detection points that support IP ID counters and can respond to TCP packets.

[0033] During the actual execution process, it is necessary to determine multiple active IP addresses and network ports (such as port 80) available for detection under this target IP prefix according to information such as the target IP prefix included in the routing anomaly event, and use them to determine the reachability from the detection point to the target IP prefix in the subsequent detection process. Further, several detection points are selected from the set of available detection points for detection. The factors considered when selecting detection points mainly include the following two aspects: (1) The number of detection points should be sufficient to ensure that enough detection results are collected, thereby improving the accuracy of the detection results. At the same time, the number of detection points should not be too large to avoid frequent calls to the same detection point, thereby triggering the access protection mechanism of the detection point (such as denial of service) or causing potential ethical issues.

[0034] (2) Ensure that the distribution of the AS where the detection point is located in the AS topology is relatively uniform, which is also to improve the accuracy of the detection results.

[0035] To meet the above requirements, the embodiment of the present invention proposes that the selection process of the detection point is as follows: (1) Calculate the range of the number of detection points required for a single detection task according to the total number of currently available detection points and the maximum number of concurrent detection tasks supported by the system. According to actual operation experience, when the product of the number of detection points required for a single task and the maximum number of concurrent tasks is about 1 to 1.5 times the total number of currently available detection points, the proportion of valid detection results returned by the detection points can reach more than 60%.

[0036] (2) Select detection points based on the Border Gateway Protocol (BGP) path information: Collect the AS paths included in the BGP messages that announce the IP prefix corresponding to the current detection task from the historical routing information, extract the ASs included in the paths and form a set. Then select detection points according to this AS set (each detection point also corresponds to an AS), and ensure that the number of ASs selected according to this criterion does not exceed 60% of the number of detection points required for the task at most.

[0037] (3)Select probing points based on AS topology classification: Select a certain number of probing points from each category according to the classification in the AS topology structure (Tier-1 of type one, Tier-2 of type two, Stub AS of the end autonomous system) to cover different types of ASs. The number of probing points in this part does not exceed 30% of the total number of probing points required for a single task.

[0038] (4)Randomly supplement probing points: Randomly select from the remaining unselected probing points to make up the remaining required number of probing points.

[0039] Through the above screening process, the asynchronous probing framework can maximize the effectiveness and efficiency of the probing task while ensuring the diversity and representativeness of the probing points.

[0040] In step S103, based on the asynchronous probing framework, call the required number of target probing points to initiate a probe against the target single routing anomaly event and recover the probing results.

[0041] In some embodiments, based on the asynchronous probing framework, call multiple target probing points to initiate a probe against the target single routing anomaly event and recover the probing results, including: Based on the asynchronous probing framework, interact with the mirroring probing points by calling the network port corresponding to the target IP prefix to initiate a probe against the target IP prefix and its corresponding active IP addresses; Recover the Border Gateway Protocol information of the mirroring probing points to the target IP prefix to the first autonomous system path set reaching the target IP prefix, and extract the first optimal path in the first autonomous system path set. Check whether the first optimal path contains the hijacker autonomous system in the prefix origin hijacking or the suspicious autonomous system pair in the forged link hijacking. If it contains the hijacker autonomous system in the prefix origin hijacking or the suspicious autonomous system pair in the forged link hijacking, it is considered that the mirroring probing points are affected by the routing anomaly event, otherwise, it is considered that the mirroring probing points are not affected by the routing anomaly event; If the return result of the ping command executed by the mirroring probing points shows that there are reachable active IPs under the prefix, it is considered that the mirroring probing points are reachable to the target IP prefix, otherwise, it is considered that the mirroring probing points are not reachable to the target IP prefix; Call the routing server probing points to log in to the routing server corresponding to the target single routing anomaly event through the script interaction method to initiate a probe against the target single routing anomaly event; The Border Gateway Protocol information of the recycling server - type probe point to the target IP prefix is returned to obtain the set of the second autonomous system paths reaching the target IP prefix, and the second optimal path is extracted from the set of the second autonomous system paths. Check whether the second optimal path contains the hijacker autonomous system in the prefix origin hijacking or the suspicious autonomous system pair in the forged link hijacking. If it contains the hijacker autonomous system in the prefix origin hijacking or the suspicious autonomous system pair in the forged link hijacking, it is considered that the server - type probe point is affected by the routing anomaly event; otherwise, it is considered that the mirror - type probe point is not affected by the routing anomaly event. If the return result of the ping command executed by the server - type probe point shows that there is a reachable active IP under the prefix, it is considered that the server - type probe point is reachable to the target IP prefix; otherwise, it is considered that the server - type probe point is unreachable to the target IP prefix. Send a TCP SYN - ACK packet to the side - channel probe point and receive the TCP RST packet returned by the side - channel probe point to retrieve the IP ID field value in the TCP RST packet. Send a TCP SYN spoofing packet to the active IP address corresponding to the target IP prefix and trigger the change of the IP ID counter of the side - channel probe point. Send multiple TCP SYN - ACK packets to the side - channel probe point and receive multiple new TCP RST packets returned by the side - channel probe point to retrieve multiple new IP ID field values in the new TCP RST packets. Compare the IP ID field value with each new IP ID field value respectively to obtain multiple change values. If there are at least two 2s among the multiple change values, it is considered that the side - channel probe point is unreachable to the target IP prefix; otherwise, it is considered that the side - channel probe point is reachable to the target IP prefix.

[0042] It should be noted that when implementing this method in the embodiments of the present invention, in order to efficiently process a large number of routing anomaly events to be detected, a framework supporting asynchronous task scheduling (such as the Celery framework) can be introduced, and the unified management of detection tasks is realized through a distributed task queue. In this architecture, each event to be detected is encapsulated as an independent task, and is asynchronously executed by the worker node (which can be regarded as an independent process) of the Celery framework. The specific execution steps include calling the probe point to initiate detection and retrieving the detection results. In addition, there is also a main process responsible for processes such as task distribution, status monitoring, and subsequent processing of detection results. The Celery framework passes messages between different task processes through a message middleware (such as RabbitMQ or Redis). This framework not only supports the distributed parallel execution of tasks, but also provides a task status tracking and retry mechanism, which can effectively ensure the reliability and stability of the detection process.

[0043] In the actual execution process, during the process of initiating a probe by calling the probe point probe command: For the LookingGlass class probe point, it is necessary to interact with the probe point by calling web interfaces or other means to initiate a probe to the target prefix and its corresponding active IP addresses. For the routing server class probe point, it is necessary to log in to the corresponding routing server through script interaction and then execute relevant commands to initiate a probe. For the side-channel probe point that supports the IP ID counter and can respond to TCP packets, the probe needs to be initiated in the manner shown in Figure 3 . The specific probing method is as follows: The system where the asynchronous probing framework is located first sends a TCP SYN-ACK packet to the side-channel probe point. After receiving this packet, the side-channel probe point usually returns a TCP RST (Reset) packet. The system records the value of the IP ID field in the IP header of this returned packet as the initial IP ID baseline value (such as the operation numbered 1 in (a) of Figure 3 ). Subsequently, a forged TCP SYN packet is sent to the active host (corresponding active network port) under the target IP prefix, and the source IP address of this forged packet is set to the IP address of the side-channel probe point (such as the operation numbered 2 in (a) of Figure 3 ). After sending the forged packet, wait for a period of time to ensure that the target host responds to the forged packet (the target host will perform similar TCP packet interactions with the side-channel probe point), and trigger a change in the IP ID counter of the side-channel probe point (such as the operation numbered 3 in (a) of Figure 3 ). After the waiting time ends, send TCP SYN-ACK packets to the side-channel probe point multiple times again, and record the values of the IP ID fields in the TCP RST packets returned each time (such as the operation numbered 4 in (a) of Figure 3 ). By comparing the IP ID values recorded in two adjacent times, it can be inferred whether the side-channel probe point has processed the network activities triggered by the forged packet during the waiting period. A complete probing process ends here. To improve the accuracy of the probing results, the system usually repeats the above process multiple times, and reduces the impact of network noise or abnormal packets on the probing accuracy by statistically analyzing multiple probing results.

[0044] Further, in the process of retrieving the detection results returned by the detection points: for detection points such as Looking Glass and route servers, querying the BGP information of the detection point to the specified target IP prefix will return the set of AS paths reaching this IP prefix, and the optimal path is extracted. If this path contains the hijacker AS in the prefix origin hijacking (i.e., the AS that conflicts with the origin AS announcing the target IP prefix in the historical routing information record) or the suspicious AS pair in the forged link hijacking (i.e., the AS pair that has not appeared in the historical routing information database), then it is considered that this detection point is affected by the event of routing anomaly. Regarding the reachability of the detection point to the specified target IP prefix, if the return result of the detection point executing the ping command shows that there is an active reachable IP under this prefix, then it is considered that this detection point is reachable to the target IP prefix.

[0045] For side-channel detection points that support IP ID counters and can respond to TCP packets, if during the multiple TCP packet interactions between the asynchronous routing hijacking event detection system and the side-channel detection point, there is only one occurrence where the IP ID change value is 2, and the rest of the change values are all 1 (as shown in (a) of Figure 3 , only t the IP ID difference between 4 and t 1 is 2), then it is considered that the target IP prefix is reachable. Otherwise, if there are two occurrences where the IP ID change value is 2 during the TCP packet interaction (as shown in (b) of Figure 3 , t the IP ID differences between 4 and t 1 and between t 6 and t 4 are both 2), then it is considered that the target IP prefix is unreachable.

[0046] During the execution of the above detection tasks, the worker (working point) of the asynchronous detection framework responsible for the current detection task will set multiple concurrent threads to interact with the detection points within the detection period. Each detection point corresponds to two threads. Among them, one thread is responsible for obtaining the routing information of the control layer (i.e., obtaining the BGP information of the detection point to the target IP prefix), and the other thread is responsible for obtaining the reachability of the data layer (i.e., obtaining the reachability of the detection point to the active IP addresses under the target IP prefix). Finally, the worker responsible for the current detection task will return the detection results returned by each detection point to the asynchronous detection task scheduling main process through the message middleware for further analysis and processing.

[0047] For multiple detection results returned by each detection point within the detection period, if there is a strong positive correlation between the affected routing situation displayed by the control layer and the reachability situation displayed by the data layer, that is, there is a certain number (higher than a preset threshold) of detection points whose routing information to the target prefix is shown to be affected by a routing anomaly event and whose reachability to the target prefix is unreachable, while the reachability of the remaining detection points not affected by the routing anomaly event to the target prefix is reachable, then the current routing anomaly event is considered to be related to a hijacking event.

[0048] In step S104, analyze whether a target single routing anomaly event is caused by a hijacking event according to the detection results.

[0049] In some embodiments, analyzing whether a target single routing anomaly event is caused by a hijacking event according to the detection results includes: If the number of detection points in the detection results is greater than the preset third proportion of the target detection points required, and among them, the number of detection points affected by the routing anomaly event and unreachable to the target IP prefix is greater than the preset fourth proportion of the number of detection points in the detection results, then the target single routing anomaly event is considered a high-confidence hijacking event; If the number of detection points in the detection results is greater than the preset third proportion of the target detection points required, and among them, the number of detection points affected by the routing anomaly event and unreachable to the target IP prefix is less than or equal to the preset fourth proportion of the number of detection points in the detection results, and among them, the number of detection points affected by the routing anomaly event and unreachable to the target IP prefix is greater than the preset fourth proportion of the number of detection points in the detection results, then the target single routing anomaly event is considered a medium-confidence hijacking event; If the number of detection points in the detection results is less than or equal to the preset third proportion of the target detection points required but greater than the preset fourth proportion of the target detection points required, and among them, the number of detection points affected by the routing anomaly event and unreachable to the target IP prefix is greater than the preset third proportion of the number of detection points in the detection results, then the target single routing anomaly event is considered a medium-confidence hijacking event; If the number of detection points in the detection results is less than or equal to the preset third proportion of the target detection points required but greater than the preset fourth proportion of the target detection points required, and among them, the number of detection points affected by the routing anomaly event and unreachable to the target IP prefix is less than the preset third proportion of the number of detection points in the detection results, or the number of detection points in the detection results is less than or equal to the preset fourth proportion of the target detection points required, then the target single routing anomaly event is considered a low-confidence hijacking event.

[0050] In the actual execution process, according to the number of probe points and other information that receive valid probe results during the detection of each routing anomaly event, the confidence level of the current hijacking event detection result can also be evaluated. The specific evaluation basis is as follows: For the two types of hijacking events, if the number of probe points that receive valid probe results exceeds 60% of the total number of called probe points, and the number of probe points affected by the routing anomaly event and unreachable to the target prefix exceeds 30% of the number of probe points that receive valid probe results, it is considered that the current event is a high-confidence hijacking event. If the number of probe points that receive valid probe results exceeds 60% of the total number of called probe points, but the number of probe points affected by the routing anomaly event and unreachable to the target prefix is less than 30% of the number of probe points that receive valid probe results, or the number of probe points that receive valid probe results is less than 60% of the total number of called probe points, but exceeds 30% of the total number of called probe points, and the number of probe points affected by the routing anomaly event and unreachable to the target prefix exceeds 30% of the number of probe points that receive valid probe results, then the current event is considered a medium-confidence hijacking event. If the number of probe points that receive valid probe results is less than 60% of the total number of called probe points, but exceeds 30% of the total number of called probe points, and the number of probe points affected by the routing anomaly event and unreachable to the target prefix is less than 30% of the number of probe points that receive valid probe results, or the number of probe points that receive valid probe results is less than 30% of the total number of called probe points, then the current event is considered a low-confidence hijacking event.

[0051] Specifically, for origin hijacking events, if there is a record of the legitimate origin AS in the Resource Public Key Infrastructure (RPKI) repository for the target prefix, and the record shows that the legitimate origin AS is the same as the victim AS in the routing anomaly event (i.e., the origin AS that announces the target IP prefix in the historical routing information record), then the hijacking event originally determined to be of medium confidence will be re-identified as a high-confidence hijacking event (the low-confidence hijacking event will be re-identified as a medium-confidence hijacking event). And if the record shows that the legitimate origin AS includes both the victim AS and the hijacker AS in the anomaly event, then the hijacking event originally determined to be of high confidence will be re-identified as a medium-confidence hijacking event (the medium-confidence hijacking event will be re-identified as a low-confidence hijacking event).

[0052] It should be noted that within the 6 months of actual operation of the asynchronous detection method for routing hijacking events proposed in the embodiments of the present invention, currently, 3,000 - 7,000 dual-plane detections can be initiated per day, and the number of hijacking events with high confidence detected is 4 per day on average. Among the currently obtained routing anomaly events (about 300), only 4% of the events have discrepancies with the detection results of third-party reports (such as Cloudflare cloud protection). Thus, it can be seen that the asynchronous detection method for routing hijacking events proposed in the embodiments of the present invention has achieved the expected goal.

[0053] In summary, according to the asynchronous detection method for routing hijacking events proposed in the embodiments of the present invention, the following beneficial effects are achieved: (1) By constructing a detection pair of a dual plane by combining a detection point that can only obtain control layer routing information (such as a Looking Glass detection point that only supports the SHOW IP BGP command) and a detection point that can only perform reachability detection at the data layer (such as a detection point that supports side-channel detection technology). On the premise of ensuring that the two types of detection points can provide comparable routing paths, the detection results of the dual-plane detection pair are regarded as the results from the same detection point. This design enables it to have the equivalent ability to a dual-plane detection point that can independently initiate control layer and data layer detections, thus significantly increasing the number of available detection points in the network and expanding the coverage of detection points; (2) Based on the dual-plane detection points (such as Looking Glass and routing servers) in the network and the newly constructed dual-plane detection pairs, a detection scheme that supports asynchronous concurrency is designed; this scheme includes the scheduling of detection points and detection pairs. On the premise of ensuring the accuracy of detection results, the number of detection points or detection pairs required for a single routing anomaly event is reduced, and the call pressure on detection points (pairs) is reduced; in addition, this scheme also includes the confidence evaluation of the detection results of hijacking events. Combining the number of effective detection results and other relevant information, a confidence evaluation mechanism is established to comprehensively evaluate the detection results of each routing hijacking event to ensure the reliability and accuracy of the detection results; (3) It can effectively meet the detection requirements for routing anomaly events in large-scale networks and achieve efficient and accurate detection of the two main types of routing hijacking events, namely origin hijacking and forged link hijacking.

[0054] Next, a device for asynchronous detection of routing hijacking events proposed according to an embodiment of the present invention will be described with reference to the accompanying drawings.

[0055] Figure 4 It is a block diagram of a device for asynchronous detection of routing hijacking events provided by an embodiment of the present invention.

[0056] As Figure 4As shown in the figure, the asynchronous detection device 40 for route hijacking events includes: a construction module 401, a determination module 402, a detection module 403, and an analysis module 404.

[0057] Among them, the construction module 401 is used to construct a dual-plane detection pair and form an available detection point set with the preset dual-plane detection points. The determination module 402 is used to obtain the active IP address and network port of the target single route anomaly event, and select the target detection points with the required number for the target single route anomaly event from the available detection point set according to the active IP address and network port. The detection module 403 is used to initiate detection of the target single route anomaly event by calling the required number of target detection points based on the asynchronous detection framework and recover the detection results. The analysis module 404 is used to analyze whether the target single route anomaly event is caused by a hijacking event according to the detection results.

[0058] In some embodiments, the construction module 401 includes: A first acquisition unit, configured to acquire detection points on different control planes and detection points on different data planes within the same autonomous system; A construction unit, configured to respectively acquire the geographical locations of the detection points on different control planes and the detection points on different data planes, and construct multiple initial dual-plane detection pairs with any detection point on the control plane and any detection point on the data plane with consistent geographical locations; A screening unit, configured to acquire the second-hop autonomous system in the routing paths obtained by the control plane and the data plane in each initial dual-plane detection pair, so as to screen multiple dual-plane detection pairs with consistent second-hop autonomous systems in the routing paths obtained by the control plane and the data plane in the multiple initial dual-plane detection pairs; A formation unit, configured to form an available detection point set according to the multiple dual-plane detection pairs and the preset dual-plane detection points.

[0059] In some embodiments, the determination module 402 includes: A determination unit, configured to determine the active IP address and network port corresponding to the target IP prefix according to the target IP prefix of the target single route anomaly event; A second acquisition unit, configured to acquire the autonomous system path included in the border gateway protocol information of the target IP prefix; An extraction unit, configured to extract multiple autonomous systems included in the autonomous system path to form an autonomous system set; A first selection unit, configured to select a first preset number of target detection points from the autonomous system set, where the first preset number is the first preset proportion less than or equal to the number of detection points required for a single task; A second selection unit, configured to select a second preset number of target detection points from the set of available detection points according to the classification in the autonomous system topology structure, so as to cover different types of autonomous systems, where the second preset number is a second preset ratio less than or equal to the number of detection points required for a single task; A complement unit, configured to randomly select multiple target detection points from the detection points not selected in the set of available detection points to complement the required number of target detection points, where the required number of target detection points includes periscope detection points, routing server detection points, and side-channel detection points that support IP ID counters and can respond to TCP packets.

[0060] In some embodiments, the detection module 403 includes: An interaction unit, configured to interact with a periscope detection point by calling the network port corresponding to the target IP prefix based on an asynchronous detection framework, so as to initiate detection on the target IP prefix and its corresponding active IP address; A first recovery unit, configured to recover the Border Gateway Protocol information of the periscope detection point to the target IP prefix to the first autonomous system path set reaching the target IP prefix, extract the first optimal path in the first autonomous system path set, and check whether the first optimal path contains the hijacker autonomous system in the prefix origin hijacking or the suspicious autonomous system pair in the forged link hijacking. If it contains the hijacker autonomous system in the prefix origin hijacking or the suspicious autonomous system pair in the forged link hijacking, it is considered that the periscope detection point is affected by the routing anomaly event. Otherwise, it is considered that the periscope detection point is not affected by the routing anomaly event; A first judgment unit, configured to consider that the periscope detection point is reachable to the target IP prefix if the return result of the ping command executed by the periscope detection point shows that there is a reachable active IP under the prefix. Otherwise, it is considered that the periscope detection point is unreachable to the target IP prefix; A second recovery unit, configured to recover the Border Gateway Protocol information of the server detection point to the target IP prefix to the second autonomous system path set reaching the target IP prefix, extract the second optimal path in the second autonomous system path set, and check whether the second optimal path contains the hijacker autonomous system in the prefix origin hijacking or the suspicious autonomous system pair in the forged link hijacking. If it contains the hijacker autonomous system in the prefix origin hijacking or the suspicious autonomous system pair in the forged link hijacking, it is considered that the server detection point is affected by the routing anomaly event. Otherwise, it is considered that the periscope detection point is not affected by the routing anomaly event; A second judgment unit, configured to consider that the server detection point is reachable to the target IP prefix if the return result of the ping command executed by the server detection point shows that there is a reachable active IP under the prefix. Otherwise, it is considered that the server detection point is unreachable to the target IP prefix A third recovery unit, configured to send a TCP SYN-ACK packet to a side-channel detection point and receive a TCP RST packet returned by the side-channel detection point, so as to recover the IP ID field value in the TCP RST packet as a detection result; A triggering unit, configured to send a TCP SYN spoofing packet to an active IP address corresponding to a target IP prefix and trigger a change in the IP ID counter of the side-channel detection point; A fourth recovery unit, configured to send a TCP SYN-ACK packet to the side-channel detection point multiple times and receive multiple new TCP RST packets returned by the side-channel detection point, so as to recover multiple new IP ID field values in the new TCP RST packets as detection results; A third determination unit, configured to compare the IP ID field value with each new IP ID field value respectively to obtain multiple change values. If there are at least two 2s among the multiple change values, it is considered that the side-channel detection point is unreachable to the target IP prefix; otherwise, it is considered that the side-channel detection point is reachable to the target IP prefix.

[0061] In some embodiments, the working node responsible for the current detection task in the asynchronous detection framework will set multiple concurrent threads to interact with each target detection point during the detection period. Among them, each target detection point corresponds to two threads. One thread is responsible for obtaining the border gateway information of the target detection point to the target IP prefix, and the other thread is responsible for obtaining the reachability of the target detection point to the active IP address under the target IP prefix. The working node responsible for the current detection task in the asynchronous detection framework will also return the detection results recovered by each target detection point to the asynchronous detection task scheduling main process through a message middleware.

[0062] In some embodiments, the analysis module 404 includes: A first comparison unit, configured to determine that a target single routing anomaly event is a high-confidence hijacking event if the number of detection points in the detection result is greater than a preset third ratio of the number of target detection points required, and the number of detection points affected by the routing anomaly event and unreachable to the target IP prefix is greater than a preset fourth ratio of the number of detection points in the detection result; A second comparison unit, configured to determine that a target single routing anomaly event is a medium-confidence hijacking event if the number of detection points in the detection result is greater than a preset third ratio of the number of target detection points required, and the number of detection points affected by the routing anomaly event and unreachable to the target IP prefix is less than or equal to a preset fourth ratio of the number of detection points in the detection result, and the number of detection points affected by the routing anomaly event and unreachable to the target IP prefix is greater than a preset fourth ratio of the number of detection points in the detection result; A third comparison unit, configured to determine that a target single routing anomaly event is a medium-confidence hijacking event if the number of detection points in the detection result is less than or equal to a preset third ratio of the required number of target detection points but greater than a preset fourth ratio of the required number of target detection points, where the number of detection points affected by a routing anomaly event and unreachable to the target IP prefix is greater than the preset third ratio of the number of detection points in the detection result; A fourth comparison unit, configured to determine that a target single routing anomaly event is a low-confidence hijacking event if the number of detection points in the detection result is less than or equal to a preset third ratio of the required number of target detection points but greater than a preset fourth ratio of the required number of target detection points, where the number of detection points affected by a routing anomaly event and unreachable to the target IP prefix is less than the preset third ratio of the number of detection points in the detection result, or the number of detection points in the detection result is less than or equal to the preset fourth ratio of the required number of target detection points;

[0063] It should be noted that the foregoing explanation of the embodiments of the asynchronous detection method for routing hijacking events also applies to the asynchronous detection device for routing hijacking events in this embodiment, and will not be elaborated here.

[0064] The asynchronous detection device for routing hijacking events according to the embodiments of the present invention has the following beneficial effects: (1) By constructing a dual-plane detection pair with a detection point that can only obtain control-plane routing information (such as a Looking Glass detection point that only supports the show ip bgp command) and a detection point that can only perform reachability detection at the data layer (such as a detection point that supports side-channel detection technology). On the premise of ensuring that the two types of detection points can provide comparable routing paths, the detection results of the dual-plane detection pair are regarded as the results from the same detection point. This design enables it to have the equivalent ability to a dual-plane detection point that can independently initiate control-plane and data-layer detections, thereby significantly increasing the number of available detection points in the network and expanding the coverage of detection points; (2) Based on the dual-plane detection points (such as Looking Glass and routing servers) in the network and the newly constructed dual-plane detection pairs, a detection scheme that supports asynchronous concurrency is designed; this scheme includes the scheduling of detection points and detection pairs. On the premise of ensuring the accuracy of detection results, it reduces the number of detection points or detection pairs required for a single routing anomaly event and reduces the call pressure on detection points (pairs); in addition, this scheme also includes the confidence evaluation of the detection results of hijacking events. Combining the number of effective detection results and other relevant information, a confidence evaluation mechanism is established to comprehensively evaluate the detection results of each routing hijacking event to ensure the reliability and accuracy of the detection results; (3) It can effectively meet the requirements for detecting routing anomaly events in large-scale networks and achieve efficient and accurate detection of two main types of routing hijacking events, namely origin hijacking and forged link hijacking.

[0065] Figure 5 This is a schematic structural diagram of the electronic device provided by the embodiment of the present invention. The electronic device may include: A memory 501, a processor 502, and a computer program stored on the memory 501 and executable on the processor 502.

[0066] When the processor 502 executes the program, it implements the asynchronous detection method for routing hijacking events provided in the above embodiment.

[0067] Further, the electronic device further includes: A communication interface 503 for communication between the memory 501 and the processor 502.

[0068] The memory 501 is used to store a computer program executable on the processor 502.

[0069] The memory 501 may include a high-speed RAM memory and may also include non-volatile memory, such as at least one disk memory.

[0070] If the memory 501, the processor 502, and the communication interface 503 are independently implemented, the communication interface 503, the memory 501, and the processor 502 can be interconnected through a bus and complete communication with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the sake of representation, Figure 5 only a thick line is used to represent it in the figure, but it does not mean that there is only one bus or one type of bus.

[0071] Optionally, in specific implementation, if the memory 501, the processor 502, and the communication interface 503 are integrated on a chip, the memory 501, the processor 502, and the communication interface 503 can complete communication with each other through an internal interface.

[0072] The processor 502 may be a Central Processing Unit (CPU), or an Application Specific Integrated Circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention.

[0073] The embodiments of the present invention further provide a computer program product, and when the computer program / instructions are executed by a processor, the method for asynchronously detecting a route hijacking event as described above is implemented.

[0074] The embodiments of the present invention further provide a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, the method for asynchronously detecting a route hijacking event as described above is implemented.

[0075] In the description of this specification, the descriptions with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples", etc. mean that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms are not necessarily directed to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any one or N embodiments or examples in a suitable manner. In addition, without contradiction, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0076] In addition, the terms "first" and "second" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, the features defined with "first" and "second" may explicitly or implicitly include at least one of such features. In the description of the present invention, the meaning of "N" is at least two, such as two, three, etc., unless otherwise specifically defined.

[0077] Any process or method description shown in a flowchart or described in other ways herein may be understood to represent a module, segment, or portion of code including one or N executable instructions for implementing a customized logical function or process, and the scope of the preferred embodiments of the present invention includes additional implementations, where the functions may be executed in a substantially simultaneous manner or in a reverse order according to the involved functions, rather than in the order shown or discussed, which should be understood by those skilled in the art to which the embodiments of the present invention pertain.

[0078] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a definitional sequence list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processor, or other systems that can fetch and execute instructions from the instruction execution system, apparatus, or device), or used in conjunction with these instruction execution systems, apparatus, or devices. For the purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection portion (electronic device) having one or N wirings, a portable computer diskette (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium can even be paper or other suitable media on which the program can be printed, since the program can be obtained electronically by optically scanning the paper or other media, followed by editing, interpretation, or otherwise processing as appropriate, and then storing it in a computer memory.

[0079] It should be understood that various parts of the present invention can be implemented by hardware, software, firmware, or a combination thereof. In the above-described embodiments, the N steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. If implemented in hardware, as in another embodiment, any one or a combination of the following techniques well known in the art can be used: discrete logic circuits having logic gate circuits for implementing logical functions on data signals, application-specific integrated circuits having appropriate combinational logic gate circuits, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), and the like.

[0080] Those of ordinary skill in the art of this technology can understand that all or part of the steps carried by the method of the above embodiments can be completed by a program instructing relevant hardware, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiments.

[0081] In addition, each functional unit in various embodiments of the present invention may be integrated into a processing module, may exist separately physically for each unit, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. When the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0082] The above-mentioned storage medium may be a read-only memory, a magnetic disk, an optical disc, etc. Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those of ordinary skill in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention.

Claims

1. An asynchronous detection method for route hijacking events, characterized in that, Including the following steps: Construct a dual-plane detection pair, and form an available detection point set by combining the dual-plane detection pair with a preset dual-plane detection point; Obtain the active IP address and network port of the target single routing anomaly event, and select the target detection points with the required quantity for the target single routing anomaly event from the available detection point set according to the active IP address and network port; Based on the asynchronous detection framework, call the target detection points with the required quantity to initiate detection on the target single routing anomaly event, and recover the detection results; Analyze whether the target single routing anomaly event is caused by a hijacking event according to the detection results.

2. The asynchronous detection method for route hijacking events according to claim 1, wherein The constructing of the dual-plane detection pair and forming the available detection point set by combining the dual-plane detection pair with the preset dual-plane detection point includes: Obtain the detection points of different control planes and the detection points of different data planes within the same autonomous system; Respectively obtain the geographical locations of the detection points of different control planes and the detection points of different data planes, and construct multiple initial dual-plane detection pairs by combining any detection point of a control plane and any detection point of a data plane with the same geographical location; Obtain the second-hop autonomous system in the routing paths obtained by the control plane and the data plane in each initial dual-plane detection pair, so as to filter out multiple dual-plane detection pairs in which the second-hop autonomous systems in the routing paths obtained by the control plane and the data plane are consistent; Form the available detection point set according to the multiple dual-plane detection pairs and the preset dual-plane detection point.

3. The asynchronous detection method for route hijacking events according to claim 1, wherein The obtaining of the active IP address and network port of the target single routing anomaly event and the selection of the target detection points with the required quantity for the target single routing anomaly event from the available detection point set according to the active IP address and network port includes: Determine the active IP address and network port corresponding to the target IP prefix according to the target IP prefix of the target single routing anomaly event; Obtain the autonomous system path included in the Border Gateway Protocol information of the target IP prefix; Extract the multiple autonomous systems included in the autonomous system path to form an autonomous system set; Select the first preset quantity of target detection points from the autonomous system set, where the first preset quantity is the first preset proportion less than or equal to the quantity of detection points required for a single task; Select the second preset quantity of target detection points from the available detection point set according to the classification in the autonomous system topology structure to cover different types of autonomous systems, where the second preset quantity is the second preset proportion less than or equal to the quantity of detection points required for a single task; Randomly select multiple target detection points from the detection points not selected in the available detection point set to make up the target detection points with the required quantity, where the target detection points with the required quantity include mirror probe detection points, routing server probe detection points, and side-channel detection points that support IP ID counters and can respond to TCP packets.

4. The asynchronous detection method for route hijacking events according to claim 3, wherein The based on the asynchronous detection framework, calling the target detection points with the required quantity to initiate detection on the target single routing anomaly event and recovering the detection results includes: Based on the asynchronous detection framework, interact with the periscope-like detection point by calling the network port corresponding to the target IP prefix to initiate detection towards the target IP prefix and its corresponding active IP addresses; Recover the Border Gateway Protocol (BGP) information of the periscope-like detection point to the target IP prefix and return it to the first autonomous system path set reaching the target IP prefix. Extract the first optimal path from the first autonomous system path set, and check whether the first optimal path contains the hijacker autonomous system in the prefix origin hijacking or the suspicious autonomous system pair in the forged link hijacking. If it contains the hijacker autonomous system in the prefix origin hijacking or the suspicious autonomous system pair in the forged link hijacking, it is considered that the periscope-like detection point is affected by the routing anomaly event. Otherwise, it is considered that the periscope-like detection point is not affected by the routing anomaly event; If the return result of the ping command executed by the periscope-like detection point shows that there are reachable active IPs under the prefix, it is considered that the periscope-like detection point is reachable to the target IP prefix. Otherwise, it is considered that the periscope-like detection point is unreachable to the target IP prefix; Call the routing server-like detection point to log in to the routing server corresponding to the target single routing anomaly event through script interaction to initiate detection towards the target single routing anomaly event; Recover the Border Gateway Protocol (BGP) information of the server-like detection point to the target IP prefix and return it to the second autonomous system path set reaching the target IP prefix. Extract the second optimal path from the second autonomous system path set, and check whether the second optimal path contains the hijacker autonomous system in the prefix origin hijacking or the suspicious autonomous system pair in the forged link hijacking. If it contains the hijacker autonomous system in the prefix origin hijacking or the suspicious autonomous system pair in the forged link hijacking, it is considered that the server-like detection point is affected by the routing anomaly event. Otherwise, it is considered that the periscope-like detection point is not affected by the routing anomaly event; If the return result of the ping command executed by the server-like detection point shows that there are reachable active IPs under the prefix, it is considered that the server-like detection point is reachable to the target IP prefix. Otherwise, it is considered that the server-like detection point is unreachable to the target IP prefix; Send a TCP SYN-ACK packet to the side-channel detection point and receive the TCP RST packet returned by the side-channel detection point to recover the IP ID field value in the TCP RST packet; Send a TCP SYN spoofing packet to the active IP address corresponding to the target IP prefix and trigger the change of the IP ID counter of the side-channel detection point; Send the TCP SYN-ACK packet to the side-channel detection point multiple times and receive multiple new TCP RST packets returned by the side-channel detection point to recover multiple new IP ID field values in the new TCP RST packets; Compare the IP ID field value with each new IP ID field value respectively to obtain a plurality of change values. If there are at least two 2s among the plurality of change values, it is considered that the side-channel detection point is unreachable to the target IP prefix; otherwise, it is considered that the side-channel detection point is reachable to the target IP prefix.

5. The asynchronous detection method for routing hijacking events according to claim 4, characterized in that The working node responsible for the current detection task in the asynchronous detection framework will set multiple concurrent threads to interact with each target detection point during the detection period. Among them, each target detection point corresponds to two threads. One thread is responsible for obtaining the border gateway information of the target detection point to the target IP prefix, and the other thread is responsible for obtaining the reachability of the active IP addresses under the target IP prefix of the target detection point; The working node responsible for the current detection task in the asynchronous detection framework will also return the detection results recovered by each target detection point to the asynchronous detection task scheduling main process through the message middleware.

6. The asynchronous detection method for route hijacking events according to claim 4, wherein Analyzing whether the target single routing anomaly event is caused by a hijacking event according to the detection result includes: If the number of detection points in the detection result is greater than the preset third ratio of the required number of target detection points, and among them, the number of detection points affected by the routing anomaly event and unreachable to the target IP prefix is greater than the preset fourth ratio of the number of detection points in the detection result, it is considered that the target single routing anomaly event is a high-confidence hijacking event; If the number of detection points in the detection result is greater than the preset third ratio of the required number of target detection points, and among them, the number of detection points affected by the routing anomaly event and unreachable to the target IP prefix is less than or equal to the preset fourth ratio of the number of detection points in the detection result, and the number of detection points affected by the routing anomaly event and unreachable to the target IP prefix is greater than the preset fourth ratio of the number of detection points in the detection result, it is considered that the target single routing anomaly event is a medium-confidence hijacking event; If the number of detection points in the detection result is less than or equal to the preset third ratio of the required number of target detection points but greater than the preset fourth ratio of the required number of target detection points, and among them, the number of detection points affected by the routing anomaly event and unreachable to the target IP prefix is greater than the preset third ratio of the number of detection points in the detection result, it is considered that the target single routing anomaly event is a medium-confidence hijacking event; If the number of detection points in the detection result is less than or equal to the preset third ratio of the required number of target detection points but greater than the preset fourth ratio of the required number of target detection points, and among them, the number of detection points affected by the routing anomaly event and unreachable to the target IP prefix is less than the preset third ratio of the number of detection points in the detection result, or the number of detection points in the detection result is less than or equal to the preset fourth ratio of the required number of target detection points, it is considered that the target single routing anomaly event is a low-confidence hijacking event.

7. An asynchronous detection device for route hijacking events, characterized in that, Including: A building module, configured to build a dual-plane detection pair and form a set of available detection points by combining the dual-plane detection pair with preset dual-plane detection points; A determination module, configured to obtain the active IP address and network port of a target single routing anomaly event, and select the required number of target detection points for the target single routing anomaly event from the set of available detection points according to the active IP address and network port; A detection module, configured to initiate detection of the target single routing anomaly event by invoking the required number of target detection points based on an asynchronous detection framework, and recover detection results; An analysis module, configured to analyze whether the target single routing anomaly event is caused by a hijacking event according to the detection results.

8. An electronic device, characterized in that, Comprising: A memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the program to implement the asynchronous detection method for routing hijacking events according to any one of claims 1-6.

9. A computer program product, characterized in that, When the computer program / instructions are executed by the processor, the asynchronous detection method for routing hijacking events according to any one of claims 1-6 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by the processor for implementing the asynchronous detection method for routing hijacking events according to any one of claims 1-6.

Images