Route hijacking event asynchronous detection method and device, equipment and medium

Abstract

The present application relates to the technical field of Internet security, and particularly relates to a route hijacking event asynchronous detection method, device, equipment and medium, wherein the method comprises: constructing a double-plane detection pair, and forming a set of available detection points by combining the double-plane detection pair with preset double-plane detection points; obtaining an active IP address and a network port of a target single route abnormal event, and then selecting a required number of target detection points for the target single route abnormal event from the set of available detection points according to the active IP address and the network port; based on an asynchronous detection framework, calling the required number of target detection points to initiate detection on the target single route abnormal event, and recycling the detection results; and analyzing whether the target single route abnormal event is caused by a hijacking event according to the detection results. Thus, the problems of limited number of detection points used in the detection process of the existing detection scheme combining the control layer and the data layer, frequent calling possibly leading to denial of service of the detection points, and reduced detection efficiency and precision of the detection results are solved.

Description

Technical Field

[0001] This invention relates to the field of Internet security technology, and in particular to an asynchronous detection method, apparatus, device, and medium for routing hijacking events. Background Technology

[0002] Routing hijacking poses a significant threat to the security of the Internet's BGP (Border Gateway Protocol), primarily encompassing two types: (1) Origin hijacking: Attackers forge BGP advertisements, claiming routing rights to IP prefixes they do not own, causing traffic to be incorrectly forwarded to networks under their control. (2) Forged link hijacking: Attackers insert false intermediate path information into BGP advertisements, causing routed traffic to deviate from its intended path. Both types of hijacking can lead to serious consequences, including data breaches, service interruptions, and even being used to further carry out DDoS attacks or phishing attacks.

[0003] To address the vulnerabilities in the BGP protocol mentioned above, researchers have proposed numerous technical solutions to enhance its security, primarily categorized into route origin validation (ROV) and hijacking detection. ROV verifies the affiliation between the IP prefix in the BGP advertisement and the Autonomous System (AS), preventing the propagation of unauthorized route advertisements. Hijacking detection mechanisms, on the other hand, monitor route advertisements and related network traffic to detect potential hijacking activities in real time. While ROV can theoretically effectively suppress origin hijacking based on forged BGP advertisements, its deployment in existing networks is still insufficient, meaning origin hijacking may still occur, and it cannot effectively counter forged link hijacking. Therefore, hijacking detection mechanisms remain necessary to assist in maintaining internet security.

[0004] Existing hijacking detection mechanisms can be divided into the following three types: (1) Routing control layer detection scheme: By monitoring abnormal changes in BGP routing information, such as path changes and abnormal prefix affiliation, potential hijacking events can be discovered. The advantage of this method is its strong real-time performance, but its accuracy is low and it is easy to generate too many false alarms. (2) Routing data layer detection scheme: Relying on active probing technology, abnormal events are verified by probing the reachability of abnormal prefixes or related BGP routing information. This method has a high detection accuracy, but it requires continuous probing, which may increase the network burden and cannot handle probing needs in real time. (3) Detection scheme combining control layer and data layer: Combining the advantages of the two schemes, the control layer discovers an anomaly and drives the data layer to initiate probing. The data layer uses multiple routing servers as probe points to probe the network status of abnormal prefixes, including using ping to detect the reachability of active IPs and show ip bgp to check the BGP information of abnormal prefixes in the routing server (such a probe point that can obtain both control layer routing information and data layer active IP reachability is called a dual-plane probe point). Then, the correlation analysis is performed based on the probe results to determine whether the routing anomaly event is a hijacking event.

[0005] While existing detection schemes combining control and data layers improve accuracy and real-time performance, they still suffer from the following problems: As network scale increases, the number of abnormal routing events to be detected daily also grows. These schemes have a limited number of probe points (primarily routing servers) used during detection, and frequent calls may lead to denial-of-service attacks at these points, reducing detection efficiency. Furthermore, existing schemes limit probe points to a few Application Servers (ASs), but the propagation range of hijacking events in the network is typically limited. If none of the ASs used for detection are affected by the hijacking event, it may lead to the hijacking event being misclassified as a non-hijacking event, reducing the accuracy of the detection results. Summary of the Invention

[0006] This invention provides an asynchronous detection method, apparatus, device, and medium for route hijacking events, which solves the problems of existing detection schemes that combine control and data layers having a limited number of detection points used during the detection process, and frequent calls may lead to denial of service at detection points, thereby reducing detection efficiency and accuracy of detection results.

[0007] A first aspect of the present invention provides an asynchronous detection method for route hijacking events, comprising the following steps: constructing a dual-plane probe pair and forming an available probe point set by combining the dual-plane probe pair with preset dual-plane probe points; obtaining the active IP address and network port of a target single route anomaly event, and selecting a required number of target probe points for the target single route anomaly event from the available probe point set based on the active IP address and network port; invoking the required number of target probe points to initiate detection on the target single route anomaly event based on an asynchronous detection framework, and collecting the detection results; and analyzing whether the target single route anomaly event is caused by a hijacking event based on the detection results.

[0008] Optionally, the step of constructing a dual-plane detection pair and forming a set of usable detection points with the dual-plane detection pair and a preset dual-plane detection point includes:

[0009] Obtain probe points from different control planes and different data planes within the same autonomous system; obtain the geographical locations of the probe points from the different control planes and different data planes respectively, and construct multiple initial dual-plane probe pairs by connecting probe points from any control plane and any data plane with consistent geographical locations; obtain the second-hop autonomous system in the routing paths obtained by the control plane and data plane in each initial dual-plane probe pair, and filter out multiple dual-plane probe pairs with consistent second-hop autonomous systems in the routing paths obtained by the control plane and data plane; form the available probe point set by combining the multiple dual-plane probe pairs with the preset dual-plane probe points.

[0010] Optionally, obtaining the active IP address and network port of the target single routing anomaly event, and selecting the required number of target probe points for the target single routing anomaly event from the set of available probe points based on the active IP address and network port, includes:

[0011] Based on the target IP prefix of the single routing anomaly event, determine the active IP address and network port corresponding to the target IP prefix; obtain the Autonomous System path contained in the Border Gateway Protocol information of the target IP prefix; extract multiple Autonomous Systems contained in the Autonomous System path to form an Autonomous System set; select a first preset number of target probe points from the Autonomous System set, wherein the first preset number is a first preset percentage less than or equal to the number of probe points required for a single task; select a second preset number of target probe points from the available probe point set according to the classification in the Autonomous System topology to cover different types of Autonomous Systems, wherein the second preset number is a second preset percentage less than or equal to the number of probe points required for a single task; randomly select multiple target probe points from the unselected probe points in the available probe point set to supplement the required number of target probe points, wherein the required number of target probe points includes spy camera-type probe points, routing server-type probe points, and side-channel probe points that support IP ID counters and can respond to TCP packets.

[0012] Optionally, the step of invoking the required number of target probe points to probe a single routing anomaly event based on the asynchronous probe framework, and collecting the probe results, includes:

[0013] Based on an asynchronous probing framework, the system interacts with the spy camera-like probe point by calling the network port corresponding to the target IP prefix to initiate probing towards the target IP prefix and its corresponding active IP address. It collects Border Gateway Protocol (BGP) information from the spy camera-like probe point to the target IP prefix, returning a first set of Autonomous System (AS) paths leading to the target IP prefix. Within this set, it extracts a first optimal path and checks whether it contains a hijacker AS in prefix origin hijacking or a suspicious AS in spoofed link hijacking. If it does, the spy camera-like probe point is considered affected by a routing anomaly; otherwise, it is considered unaffected. If the ping command returned by the spy camera-like probe point shows a reachable active IP under the prefix, the target IP prefix is ​​considered reachable from the spy camera-like probe point; otherwise, it is considered unreachable. The system also uses script interaction to call... The server-type probe logs into the routing server corresponding to the single routing anomaly event of the target IP prefix to initiate a probe for the single routing anomaly event. It collects the Border Gateway Protocol (BGP) information from the server-type probe to the target IP prefix and returns a second set of autonomous system paths to the target IP prefix. It then extracts a second optimal path from this set and checks whether the second optimal path contains a hijacker autonomous system in the prefix origin hijacking or a suspicious autonomous system pair in the forged link hijacking. If it does, the server-type probe is considered to be affected by the routing anomaly event; otherwise, it is considered unaffected. If the ping command returned by the server-type probe shows a reachable active IP under the prefix, the target IP prefix is ​​considered reachable from the server-type probe; otherwise, it is considered unreachable from the server-type probe. Finally, it sends a TCP packet to the side-channel probe. The system sends SYN-ACK packets and receives TCP RST packets returned by the side channel probe point to reclaim the IPID field value in the TCP RST packets; it sends TCP SYN forgery packets to the active IP address corresponding to the target IP prefix and triggers a change in the IP ID counter of the side channel probe point; it sends the TCP SYN-ACK packets to the side channel probe point multiple times and receives multiple new TCP RST packets returned by the side channel probe point to reclaim multiple new IPID field values ​​in the new TCP RST packets;The IP ID field value is compared with each new IP ID field value to obtain multiple change values. If at least two of the multiple change values ​​are 2, the side channel probe point is considered unreachable from the target IP prefix; otherwise, the side channel probe point is considered reachable from the target IP prefix.

[0014] Optionally, in the asynchronous detection framework, the worker node responsible for the current detection task will set up multiple concurrent threads to interact with each target detection point within the detection period. Each target detection point corresponds to two threads: one thread is responsible for obtaining the border gateway information from the target detection point to the target IP prefix, and the other thread is responsible for obtaining the reachability of the target detection point to the active IP address under the target IP prefix.

[0015] In the asynchronous detection framework, the worker node responsible for the current detection task also returns the detection results collected from each target detection point to the asynchronous detection task scheduling master process through a message middleware.

[0016] Optionally, the step of analyzing whether the target single routing anomaly event was caused by a hijacking event based on the detection results includes:

[0017] If the number of probe points in the detection results is greater than the preset third percentage of the required number of target probe points, wherein the number of probe points affected by routing anomalies and unreachable to the target IP prefix is ​​greater than the preset fourth percentage of the number of probe points in the detection results, then the target single routing anomaly event is considered a high-confidence hijacking event; if the number of probe points in the detection results is greater than the preset third percentage of the required number of target probe points, wherein the number of probe points affected by routing anomalies and unreachable to the target IP prefix is ​​less than or equal to the preset fourth percentage of the number of probe points in the detection results, wherein the number of probe points affected by routing anomalies and unreachable to the target IP prefix is ​​greater than the preset fourth percentage of the number of probe points in the detection results, then the target single routing anomaly event is considered a medium-confidence hijacking event; if the number of probe points in the detection results is less than or equal to the preset third percentage of the required number of target probe points, wherein the number of probe points affected by routing anomalies and unreachable to the target IP prefix is ​​greater than the preset fourth percentage of the number of probe points in the detection results, then the target single routing anomaly event is considered a medium-confidence hijacking event; if the number of probe points in the detection results is less than or equal to the preset fourth percentage of the required number of target probe points .... If the number of target probe points required is greater than the preset third percentage, and the number of probe points affected by the routing anomaly event and unreachable to the target IP prefix is ​​greater than the preset third percentage of the number of probe points in the detection results, then the target single routing anomaly event is considered a medium-confidence hijacking event. If the number of probe points in the detection results is less than or equal to the preset third percentage, but greater than the preset fourth percentage, and the number of probe points affected by the routing anomaly event and unreachable to the target IP prefix is ​​less than the preset third percentage, or the number of probe points in the detection results is less than or equal to the preset fourth percentage of the number of target probe points, then the target single routing anomaly event is considered a low-confidence hijacking event.

[0018] A second aspect of the present invention provides an asynchronous detection device for routing hijacking events, comprising: a construction module, configured to construct a dual-plane detection pair and form an available detection point set by combining the dual-plane detection pair with preset dual-plane detection points; a determination module, configured to obtain the active IP address and network port of a target single routing anomaly event, and select a required number of target detection points for the target single routing anomaly event from the available detection point set based on the active IP address and network port; a detection module, configured to initiate detection on the target single routing anomaly event by calling the required number of target detection points based on an asynchronous detection framework, and collect the detection results; and an analysis module, configured to analyze whether the target single routing anomaly event is caused by a hijacking event based on the detection results.

[0019] A third aspect of the present invention provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the asynchronous detection method for routing hijacking events as described in the above embodiments.

[0020] A fourth aspect of the present invention provides a computer program product that, when executed by a processor, implements the above-described asynchronous detection method for routing hijacking events.

[0021] A fifth aspect of the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described asynchronous detection method for routing hijacking events.

[0022] The asynchronous detection method, apparatus, device, and medium for route hijacking events proposed in this invention construct a dual-plane detection pair by combining detection points that can only obtain control layer routing information (such as Looking Glass detection points that only support the `show ip bgp` command) with detection points that can only perform reachability detection at the data layer (such as detection points that support side-channel detection technology). Under the premise that both types of detection points can provide comparable routing paths, the detection results of the dual-plane detection pair are considered to originate from the same detection point. This design gives it the capability equivalent to a dual-plane detection point that can independently initiate control layer and data layer detection, thereby significantly increasing the number of available detection points in the network and expanding the coverage of detection points. Based on the dual-plane detection points in the network (such as Looking Glass detection points), the detection results are considered to originate from the same detection point. The invention utilizes a newly constructed dual-plane probe pair (Glass and routing server) to design an asynchronous concurrent probe scheme. This scheme includes scheduling of probe points and probe pairs, reducing the number of probe points or probe pairs required for a single routing anomaly event while ensuring the accuracy of the probe results, thus reducing the call pressure on probe points (pairs). It also includes confidence assessment of the hijacking event detection results. Combining the number of valid probe results and other relevant information, a confidence assessment mechanism is established to comprehensively evaluate the detection results of each routing hijacking event, ensuring the reliability and accuracy of the detection results. Through the above improvements, this invention can effectively address the routing anomaly event detection needs in large-scale networks and achieve efficient and accurate detection of the two main types of routing hijacking events: origin hijacking and forged link hijacking.

[0023] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0024] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0025] Figure 1 A flowchart of an asynchronous detection method for route hijacking events provided in an embodiment of the present invention;

[0026] Figure 2 This is a schematic diagram of the framework of an asynchronous detection method for route hijacking events provided in an embodiment of the present invention;

[0027] Figure 3 This is a schematic diagram of a side-channel detection method based on IP ID provided in an embodiment of the present invention, wherein (a) the side-channel detection point is reachable from the target prefix, and (b) the side-channel detection point is not reachable from the target prefix;

[0028] Figure 4 This is a block diagram of an asynchronous detection device for routing hijacking events provided in an embodiment of the present invention;

[0029] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention.

[0030] Explanation of reference numerals in the attached figures:

[0031] 40 - Asynchronous detection device for route hijacking events, 401 - Construction module, 402 - Determination module, 403 - Detection module and 404 - Analysis module. Detailed Implementation

[0032] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0033] The asynchronous detection method, apparatus, device, and medium for routing hijacking events according to embodiments of the present invention are described below with reference to the accompanying drawings.

[0034] Figure 1 This is a flowchart illustrating an asynchronous detection method for route hijacking events provided in an embodiment of the present invention.

[0035] like Figure 1 As shown, the asynchronous detection method for route hijacking events includes the following steps:

[0036] In step S101, a dual-plane detection pair is constructed, and the dual-plane detection pair and the preset dual-plane detection points form a set of available detection points.

[0037] In some embodiments, a dual-plane detector pair is constructed, and the dual-plane detector pair and a preset dual-plane detector point form a set of available detector points, including:

[0038] Acquire probe points on different control planes and different data planes within the same autonomous system;

[0039] The geographical locations of the probe points on different control planes and the probe points on different data planes are obtained respectively, and the probe points on any control plane and any data plane with the same geographical location are constructed into multiple initial dual-plane probe pairs;

[0040] Obtain the second-hop autonomous system in the routing path obtained by the control plane and data plane in each initial two-plane probe pair, so as to filter multiple two-plane probe pairs in which the second-hop autonomous system in the routing path obtained by the control plane and data plane is consistent;

[0041] A set of usable detection points is formed by combining multiple dual-plane detection pairs with preset dual-plane detection points.

[0042] In actual implementation, among the distributed probe points currently existing in the network, some "Looking Glass" websites provide probe points and routing servers that can simultaneously support obtaining routing path information for a specified prefix in the control plane and probing the reachability of active IPs under the target prefix in the data plane. These probe points are referred to as dual-plane probe points in the probe framework implemented in this invention. Since the control and data plane probes initiated by these probe points originate from the same geographical location and use the same routing strategy, this means that the routing behavior of these probe points in the control and data planes is consistent. Therefore, the probe results obtained by these probe points can be directly used to assess whether routing anomalies are caused by hijacking events.

[0043] Furthermore, in the control plane, some probing points and routing servers provided by Looking Glass websites only support probing in the control plane to obtain routing path information for a specified prefix. CAIDA (Center for Applied Internet Data Analysis, an international collaborative organization researching global Internet structure and data), Ark (Archipelago, CAIDA's active measurement infrastructure serving the network research community), and RIPEAtlas (a global Internet measurement platform operated by RIPE NC, the European IP Resource Coordination Center) provide a number of probing points capable of executing traceroute probing commands for a specified prefix. The traceroute probing command can be used to determine the reachability of that prefix. Additionally, there are side-channel probing points in the network that support IP Identification (ID) counters and respond to Transmission Control Protocol (TCP) messages. These probing points utilize the sequentially increasing IP ID field in the IPv4 (Internet Protocol version 4) header to infer reachability by sending TCP messages and observing the responses of remote devices. The aforementioned probe points cannot be used independently to assess routing anomalies, therefore previous routing hijacking detection methods did not consider using these probe points.

[0044] However, if it can be guaranteed that a control plane probe point and a data plane probe point can provide comparable routing paths, they can be regarded as a two-plane probe pair, and their respective probe results can be combined to evaluate routing anomalies.

[0045] To achieve the above prerequisites, this invention proposes a probe pair construction method to screen control plane and data plane probe points that meet the requirements. The specific construction process is as follows:

[0046] First, it's necessary to ensure that probes from different planes are within the same Autonomous System (AS). However, considering that different probes within the same AS may employ different routing strategies, to ensure consistency in routing strategies, it's also necessary to further ensure that the pair of observation points are located in the same city. The geographical location of the probe can be obtained through its IP address and IP geolocation database, or it can be inferred from the AS where the probe is located and its connected Internet Exchange Point (IXP), combined with open-source platforms such as PeeringDB. If neither of these information is available, a domain name inference algorithm can be used to extract the geographic code from the domain name and deduce its geographical location. Generally, if two probes from the control plane and data plane are located within the same AS and their geographical locations are largely consistent, their routing behavior in the control plane and data plane can be considered largely consistent. However, it's important to note that even for a pair of observation points in the same AS and the same city, some specific routes may still have different strategies. For certain probe pairs (mainly those containing probes from CAIDA Ark and RIPE Atlas), if the second-hop AS in the routing paths obtained from the control plane and data plane is found to be inconsistent after using the IP-to-AS mapping method, it will be considered not to use this probe pair to initiate a probe, in order to further reduce the interference of possible inconsistencies in routing policies within the observation point pair on the accuracy of the probe results.

[0047] By obtaining the required dual-plane probe pairs through the above method, a set of usable probe points can be formed together with the preset dual-plane probe points. This set can be called by the asynchronous route hijacking event detection method to obtain the detection results, which can be used to evaluate whether the route anomaly event was caused by a hijacking event.

[0048] In step S102, the active IP address and network port of the target single routing anomaly event are obtained, and the required number of target probe points for the target single routing anomaly event are selected from the set of available probe points based on the active IP address and network port.

[0049] In some embodiments, obtaining the active IP address and network port of a single target routing anomaly event, and selecting the required number of target probe points from the set of available probe points based on the active IP address and network port, includes:

[0050] Based on the target IP prefix of a single routing anomaly event, determine the active IP address and network port corresponding to the target IP prefix;

[0051] Obtain the autonomous system path contained in the border gateway protocol information of the target IP prefix;

[0052] Extract multiple autonomous systems contained in the autonomous system path to form an autonomous system set;

[0053] Select a first preset number of target detection points in the set of autonomous systems, wherein the first preset number is a first preset percentage of the number of detection points required for a single task that is less than or equal to the number of detection points required for a single task;

[0054] Based on the classification in the autonomous system topology, a second preset number of target probes are selected from the set of available probes to cover different types of autonomous systems. The second preset number is a second preset percentage that is less than or equal to the number of probes required for a single task.

[0055] Multiple target probes are randomly selected from the unselected probes in the available probe point set to supplement the required number of target probes. The required number of target probes includes spy camera-type probes, routing server-type probes, and side-channel probes that support IP ID counters and can respond to TCP packets.

[0056] In actual execution, based on information such as the target IP prefix contained in the routing anomaly event, it is necessary to determine multiple active IP addresses and network ports (such as port 80) under this target IP prefix that can be used for probing. This information is used by the probe points in the subsequent probing process to determine their own reachability to the target IP prefix. Furthermore, several probe points are selected from the set of available probe points for probing. The factors considered when selecting probe points mainly include the following two aspects:

[0057] (1) The number of probe points should be sufficient to ensure that enough probe results are collected, thereby improving the accuracy of the probe results. At the same time, the number of probe points should not be too large to avoid the same probe point being called frequently, thereby triggering the access protection mechanism of the probe point (such as denial of service) or causing potential ethical issues.

[0058] (2) Ensure that the AS where the detection point is located is relatively evenly distributed in the AS topology, which is also to improve the accuracy of the detection results.

[0059] To meet the above requirements, the present invention proposes the following process for selecting detection points:

[0060] (1) Calculate the range of the number of probe points required for a single probe task based on the total number of currently available probe points and the maximum number of concurrent probe tasks supported by the system. According to actual operating experience, when the product of the number of probe points required for a single task and the maximum number of concurrent tasks is approximately 1 to 1.5 times the total number of currently available probe points, the proportion of probe points returning valid probe results can reach more than 60%.

[0061] (2) Selecting probe points based on Border Gateway Protocol (BGP) path information: Collect the AS paths contained in the BGP messages announcing the IP prefix corresponding to the current probe task from historical routing information, extract the ASs contained in the paths and form a set. Then select probe points based on this AS set (each probe point also corresponds to an AS), and ensure that the number of ASs selected according to this standard does not exceed 60% of the number of probe points required by the task.

[0062] (3) Selecting probe points based on AS topology classification: Select a certain number of probe points from each category according to the classification in the AS topology structure (Type 1 Tier-1, Type 2 Tier-2, Stub AS) to cover different types of AS. The number of probe points in this part shall not exceed 30% of the total number of probe points required for a single task.

[0063] (4) Randomly supplement probe points: Randomly select from the remaining unselected probe points to supplement the remaining required number of probe points.

[0064] Through the above screening process, the asynchronous detection framework can maximize the effectiveness and efficiency of detection tasks while ensuring the diversity and representativeness of detection points.

[0065] In step S103, based on the asynchronous probing framework, the required number of target probe points are invoked to probe a single routing anomaly event of the target, and the probe results are collected.

[0066] In some embodiments, based on an asynchronous probing framework, multiple target probing points are invoked to probe a single routing anomaly event of the target, and the probing results are collected, including:

[0067] Based on the asynchronous detection framework, the target IP prefix is ​​detected by interacting with the spy camera-like detection point by calling the network port corresponding to the target IP prefix.

[0068] The system retrieves the Border Gateway Protocol information from the spy camera-type probe point to the target IP prefix and returns the first autonomous system path set to the target IP prefix. It then extracts the first optimal path from the first autonomous system path set and checks whether the first optimal path contains a hijacker autonomous system in prefix origin hijacking or a suspicious autonomous system pair in spoofed link hijacking. If it contains a hijacker autonomous system in prefix origin hijacking or a suspicious autonomous system pair in spoofed link hijacking, the spy camera-type probe point is considered to be affected by a routing anomaly event; otherwise, it is considered not to be affected by a routing anomaly event.

[0069] If the ping command returned by the spy camera probe shows that there is a reachable active IP under the prefix, then the spy camera probe is considered to be reachable from the target IP prefix; otherwise, the spy camera probe is considered to be unreachable from the target IP prefix.

[0070] By using script interaction to call the routing server class probe point to log in to the routing server corresponding to the target single routing anomaly event, a probe can be initiated for the target single routing anomaly event;

[0071] The system retrieves the Border Gateway Protocol information from the server-type probe point to the target IP prefix and returns the second set of autonomous system paths to the target IP prefix. It then extracts the second optimal path from the second set of autonomous system paths and checks whether the second optimal path contains a hijacker autonomous system in prefix origin hijacking or a suspicious autonomous system pair in spoofed link hijacking. If it contains a hijacker autonomous system in prefix origin hijacking or a suspicious autonomous system pair in spoofed link hijacking, the server-type probe point is considered to be affected by a routing anomaly event; otherwise, the spy camera-type probe point is considered not to be affected by a routing anomaly event.

[0072] If the ping command returned by the server-type probe point shows that there is a reachable active IP under the prefix, then the server-type probe point is considered to be reachable from the target IP prefix; otherwise, the server-type probe point is considered to be unreachable from the target IP prefix.

[0073] Send a TCP SYN-ACK packet to the side channel probe point and receive a TCP RST packet returned by the side channel probe point to retrieve the IP ID field value in the TCP RST packet;

[0074] Send a TCP SYN forged packet to the active IP address corresponding to the target IP prefix, and trigger a change in the IP ID counter of the side channel probe point;

[0075] Send TCP SYN-ACK packets multiple times to the side channel probe point and receive multiple new TCP RST packets returned by the side channel probe point to reclaim multiple new IP ID field values ​​in the new TCP RST packets;

[0076] The IP ID field value is compared with each new IP ID field value to obtain multiple change values. If at least two of the multiple change values ​​are 2, it is considered that the side channel probe point is unreachable from the target IP prefix; otherwise, it is considered that the side channel probe point is reachable from the target IP prefix.

[0077] It should be noted that, in implementing this method, to efficiently handle a large number of abnormal events in the routes to be probed, a framework supporting asynchronous task scheduling (such as the Celery framework) can be introduced. A distributed task queue is used to achieve unified management of the probe tasks. In this architecture, each event to be probed is encapsulated as an independent task, which is asynchronously executed by the Celery framework's worker nodes (which can be considered as independent processes). The specific execution steps include initiating probes by calling probe points and collecting probe results. In addition, a main process is responsible for task distribution, status monitoring, and subsequent processing of probe results. The Celery framework uses a message broker (such as RabbitMQ or Redis) to pass messages between different task processes. This framework not only supports distributed parallel execution of tasks but also provides task status tracking and retry mechanisms, effectively ensuring the reliability and stability of the probe process.

[0078] In actual execution, during the process of initiating a probe by calling the probe point probe command: For LookingGlass type probe points, it is necessary to interact with the probe point by calling web interfaces to initiate probes to the target prefix and its corresponding active IP address. For routing server type probe points, it is necessary to log in to the corresponding routing server through script interaction and execute relevant commands to initiate probes. For side-channel probe points that support IP ID counters and can respond to TCP packets, it is necessary to follow the instructions... Figure 3 The probe is initiated in the manner shown. Specifically, the asynchronous probe framework first sends a TCP SYN-ACK packet to the side-channel probe point. Upon receiving this packet, the side-channel probe point typically returns a TCP RST (Reset) packet. The system records the value of the IP ID field in the IP header of this returned packet as the initial IP ID baseline value (e.g., ...). Figure 3 (Operation number 1 in (a)). Subsequently, a forged TCP SYN packet is sent to the active host (corresponding active network port) under the target IP prefix. The source IP address of this forged packet is set to the IP address of the side-channel probe point (e.g., Figure 3 (Operation number 2 in (a)). After sending the forged message, wait for a period of time to ensure that the target host responds to the forged message (the target host will perform similar TCP message interactions with the side channel probe), and trigger a change in the IP ID counter of the side channel probe (e.g., Figure 3 (Operation number 3 in (a)). After the waiting time ends, TCP SYN-ACK packets are sent to the side channel probe point multiple times, and the IP ID field value in the TCP RST packet returned each time is recorded (e.g., ...). Figure 3(Operation number 4 in (a)). By comparing the IP ID values ​​of two adjacent records, it can be inferred whether the side-channel probe point processed network activity caused by spoofed packets during the waiting period. A complete probe process ends here. To improve the accuracy of the probe results, the system usually repeats the above process multiple times, reducing the impact of network noise or abnormal packets on the probe accuracy by statistically analyzing multiple probe results.

[0079] Furthermore, during the process of recovering the probe results returned by the probe points: For Looking Glass and routing server type probe points, querying the BGP information from the probe point to the specified target IP prefix will return a set of AS paths leading to that IP prefix. The optimal path is extracted. If this path contains a hijacker AS in prefix origin hijacking (i.e., an AS that conflicts with the origin AS that declared the target IP prefix in historical routing information records) or a suspicious AS pair in spoofed link hijacking (i.e., an AS pair that has not appeared in the historical routing information database), then the probe point is considered to be affected by a routing anomaly event. Regarding the reachability of the probe point to the specified target IP prefix, if the ping command returned by the probe point shows that there is a reachable active IP under this prefix, then the probe point is considered to be reachable to the target IP prefix.

[0080] For a side-channel probe point that supports IP ID counters and can respond to TCP packets, if the asynchronous route hijacking event detection system interacts with the side-channel probe point multiple times and only one IP ID change value of 2 occurs, while all other changes are 1 (e.g., ... Figure 3 As shown in (a) above, only t 4 and t If the IP ID difference between two points is 2, the target IP prefix is ​​considered reachable. Otherwise, if two IP ID changes of 2 occur during TCP packet exchange (e.g., ... Figure 3 As shown in (b) in the figure, t 4 and t 1 time and t 6 and t If the IP ID difference between the four time points is 2, then the target IP prefix is ​​considered unreachable.

[0081] During the execution of the above probe tasks, the asynchronous probe framework sets up multiple concurrent threads to interact with the probe points within the probe cycle. Each probe point corresponds to two threads: one thread is responsible for obtaining routing information from the control layer (i.e., obtaining BGP information from the probe point to the target IP prefix), and the other thread is responsible for obtaining reachability information from the data layer (i.e., obtaining reachability from the probe point to active IP addresses under the target IP prefix). Finally, the worker responsible for the current probe task returns the probe results from each probe point to the asynchronous probe task scheduling master process for further analysis and processing via a message middleware.

[0082] If there is a strong positive correlation between the routing impact status displayed by the control layer and the reachability status displayed by the data layer, i.e., there are a certain number of probe points (above a certain preset threshold) whose routing information to the target prefix is ​​affected by the routing anomaly event and whose reachability to the target prefix is ​​unreachable, while the remaining probe points not affected by the routing anomaly event are reachable to the target prefix, then the current routing anomaly event is considered to be related to the hijacking event.

[0083] In step S104, the detection results are analyzed to determine whether a single routing anomaly event of the target was caused by a hijacking event.

[0084] In some embodiments, analyzing whether a single routing anomaly event of a target is caused by a hijacking event based on the detection results includes:

[0085] If the number of probe points in the detection results is greater than the preset third proportion of the required number of target probe points, and the number of probe points affected by routing anomaly events and unreachable to the target IP prefix is ​​greater than the preset fourth proportion of the number of probe points in the detection results, then the target single routing anomaly event is considered a high-confidence hijacking event.

[0086] If the number of probe points in the detection results is greater than the preset third percentage of the required number of target probe points, and the number of probe points affected by the routing anomaly event and unreachable to the target IP prefix is ​​less than or equal to the preset fourth percentage of the number of probe points in the detection results, and the number of probe points affected by the routing anomaly event and unreachable to the target IP prefix is ​​greater than the preset fourth percentage of the number of probe points in the detection results, then the target single routing anomaly event is considered to be a medium confidence hijacking event.

[0087] If the number of probe points in the detection results is less than or equal to the preset third percentage of the required number of target probe points, but greater than the preset fourth percentage of the required number of target probe points, and the number of probe points affected by the routing anomaly event and unreachable to the target IP prefix is ​​greater than the preset third percentage of the number of probe points in the detection results, then the target single routing anomaly event is considered to be a medium confidence hijacking event.

[0088] If the number of probe points in the detection results is less than or equal to the preset third percentage of the required number of target probe points, but greater than the preset fourth percentage of the required number of target probe points, then the number of probe points affected by the routing anomaly event and unreachable to the target IP prefix is ​​less than the preset third percentage of the number of probe points in the detection results, or the number of probe points in the detection results is less than or equal to the preset fourth percentage of the required number of target probe points, then the single routing anomaly event of the target is considered a low-confidence hijacking event.

[0089] In actual execution, the confidence level of the current hijacking event detection result can be assessed based on the number of probe points that receive valid probe results and other information during the probing process for each routing anomaly event. The specific assessment criteria are as follows: For both types of hijacking events, if the number of probe points receiving valid probe results exceeds 60% of the total number of probe points called, and the number of probe points affected by the routing anomaly event and unreachable to the target prefix exceeds 30% of the number of probe points receiving valid probe results, the current event is considered a high-confidence hijacking event. If the number of probe points receiving valid probe results exceeds 60% of the total number of probe points called, but the number of probe points affected by the routing anomaly event and unreachable to the target prefix is ​​less than 30% of the number of probe points receiving valid probe results, or if the number of probe points receiving valid probe results is less than 60% of the total number of probe points called, but exceeds 30% of the total number of probe points called, and the number of probe points affected by the routing anomaly event and unreachable to the target prefix exceeds 30% of the number of probe points receiving valid probe results, the current event is considered a medium-confidence hijacking event. If the number of probe points that receive valid probe results is less than 60% but more than 30% of the total number of probe points called, and the number of probe points affected by routing anomalies and unreachable to the target prefix is ​​less than 30% of the number of probe points that receive valid probe results, or the number of probe points that receive valid probe results is less than 30% of the total number of probe points called, then the current event is considered a low-confidence hijacking event.

[0090] Specifically, for origin hijacking events, if the target prefix has a legitimate origin AS record in the Resource Public Key Infrastructure (RPKI) repository, and the record shows that the legitimate origin AS is the same as the victim AS in the routing anomaly event (i.e., the origin AS that advertised the target IP prefix in the historical routing information record), then the hijacking event that was originally judged as having medium confidence will be reclassified as a high confidence hijacking event (and a low confidence hijacking event will be reclassified as a medium confidence hijacking event). However, if the record shows that the legitimate origin AS includes both the victim AS and the hijacker AS in the anomaly event, then the hijacking event that was originally judged as having high confidence will be reclassified as a medium confidence hijacking event (and a medium confidence hijacking event will be reclassified as a low confidence hijacking event).

[0091] It should be noted that, within six months of actual operation, the asynchronous detection method for route hijacking events proposed in this embodiment of the invention can currently initiate 3,000 to 7,000 dual-plane probes per day, detecting an average of four high-confidence hijacking events per day. Of the approximately 300 route anomaly events for which detection results have been obtained, only 4% differ from the detection results reported by third-party sources (such as Cloudflare cloud protection). Therefore, it is evident that the asynchronous detection method for route hijacking events proposed in this embodiment of the invention has achieved its intended purpose.

[0092] In summary, the asynchronous detection method for route hijacking events proposed in this embodiment of the invention has the following beneficial effects:

[0093] (1) By constructing a dual-plane probe pair with probe points that can only obtain control layer routing information (such as Looking Glass probe points that only support SHOW IP BGP commands) and probe points that can only perform reachability probes at the data layer (such as probe points that support side-channel probe technology), the probe results of the dual-plane probe pair are regarded as the results from the same probe point, provided that both types of probe points can provide comparable routing paths. This design gives it the capability equivalent to a dual-plane probe point that can independently initiate control layer and data layer probes, thereby significantly increasing the number of available probe points in the network and expanding the coverage of probe points;

[0094] (2) Based on the dual-plane probe points (such as Looking Glass and routing server) in the network and the newly constructed dual-plane probe pairs, a probe scheme supporting asynchronous concurrency is designed. This scheme includes the scheduling of probe points and probe pairs. Under the premise of ensuring the accuracy of the probe results, the number of probe points or probe pairs required for a single routing anomaly event is reduced, and the call pressure of probe points (pairs) is reduced. In addition, this scheme also includes the confidence evaluation of the hijacking event detection results. Combining the number of effective probe results and other relevant information, a confidence evaluation mechanism is established to comprehensively evaluate the detection results of each routing hijacking event, so as to ensure the reliability and accuracy of the detection results.

[0095] (3) It can effectively meet the needs of detecting routing anomaly events in large-scale networks and achieve efficient and accurate detection of the two main types of routing hijacking events: origin hijacking and forged link hijacking.

[0096] Next, the asynchronous detection device for routing hijacking events proposed according to an embodiment of the present invention is described with reference to the accompanying drawings.

[0097] Figure 4 This is a block diagram of an asynchronous detection device for routing hijacking events provided in an embodiment of the present invention.

[0098] like Figure 4 As shown, the asynchronous detection device 40 for routing hijacking events includes: a construction module 401, a determination module 402, a detection module 403, and an analysis module 404.

[0099] The system comprises the following modules: Construction module 401 constructs a dual-plane probe pair and combines it with preset dual-plane probe points to form a set of available probe points. Determination module 402 obtains the active IP address and network port of the target single routing anomaly event, and selects the required number of target probe points from the set of available probe points based on the active IP address and network port. Probe module 403 uses an asynchronous probe framework to initiate probes to the target single routing anomaly event using the required number of target probe points and collects the probe results. Analysis module 404 analyzes the probe results to determine whether the target single routing anomaly event was caused by a hijacking event.

[0100] In some embodiments, the construction module 401 includes:

[0101] The first acquisition unit is used to acquire probe points on different control planes and probe points on different data planes within the same autonomous system.

[0102] The construction unit is used to obtain the geographical locations of the probe points on different control planes and the probe points on different data planes, and to construct multiple initial dual-plane probe pairs by combining the probe points on any control plane and the probe points on any data plane with the same geographical location.

[0103] A filtering unit is used to obtain the second-hop autonomous system in the routing path obtained by the control plane and data plane in each initial dual-plane probe pair, so as to filter multiple dual-plane probe pairs in which the second-hop autonomous system in the routing path obtained by the control plane and data plane is consistent.

[0104] A forming unit is used to form a set of available detection points based on multiple dual-plane detection pairs and preset dual-plane detection points.

[0105] In some embodiments, the determining module 402 includes:

[0106] The determination unit is used to determine the active IP address and network port corresponding to the target IP prefix based on the target IP prefix of a single routing anomaly event.

[0107] The second acquisition unit is used to acquire the autonomous system path contained in the border gateway protocol information of the target IP prefix;

[0108] The extraction unit is used to extract multiple autonomous systems contained in the autonomous system path to form an autonomous system set;

[0109] The first selection unit is used to select a first preset number of target detection points from the set of autonomous systems, wherein the first preset number is a first preset percentage of the number of detection points required for a single task that is less than or equal to the number of detection points required for a single task.

[0110] The second selection unit is used to select a second preset number of target detection points from the set of available detection points according to the classification in the topology of the autonomous system, so as to cover different types of autonomous systems. The second preset number is a second preset proportion that is less than or equal to the number of detection points required for a single task.

[0111] The supplementary unit is used to randomly select multiple target probe points from the unselected probe points in the available probe point set to supplement the required number of target probe points. The required number of target probe points includes spy camera-type probe points, routing server-type probe points, and side-channel probe points that support IP ID counters and can respond to TCP packets.

[0112] In some embodiments, the detection module 403 includes:

[0113] The interactive unit is used to interact with the spy camera-like probe point by calling the network port corresponding to the target IP prefix based on the asynchronous probe framework, so as to launch probes to the target IP prefix and its corresponding active IP address;

[0114] The first recycling unit is used to recycle the Border Gateway Protocol information from the spy camera-type probe point to the target IP prefix and return the first autonomous system path set to the target IP prefix. It then extracts the first optimal path from the first autonomous system path set and checks whether the first optimal path contains a hijacker autonomous system in prefix origin hijacking or a suspicious autonomous system pair in spoofed link hijacking. If it contains a hijacker autonomous system in prefix origin hijacking or a suspicious autonomous system pair in spoofed link hijacking, the spy camera-type probe point is considered to be affected by a routing anomaly event. Otherwise, the spy camera-type probe point is considered not to be affected by a routing anomaly event.

[0115] The first judgment unit is used to determine if the ping command returned by the spy camera-type probe point shows that there is a reachable active IP under the prefix, then the spy camera-type probe point is considered to be reachable from the target IP prefix; otherwise, the spy camera-type probe point is considered to be unreachable from the target IP prefix.

[0116] The second recycling unit is used to recycle the Border Gateway Protocol information from server-type probe points to the target IP prefix and return the second autonomous system path set to the target IP prefix. It then extracts the second optimal path from the second autonomous system path set and checks whether the second optimal path contains a hijacker autonomous system in prefix origin hijacking or a suspicious autonomous system pair in spoofed link hijacking. If it contains a hijacker autonomous system in prefix origin hijacking or a suspicious autonomous system pair in spoofed link hijacking, the server-type probe point is considered to be affected by a routing anomaly event; otherwise, the spy camera-type probe point is considered not to be affected by a routing anomaly event.

[0117] The second judgment unit is used to determine whether the server-type probe point is reachable from the target IP prefix if the ping command returned by the server-type probe point shows that there is a reachable active IP under the prefix; otherwise, it is considered that the server-type probe point is not reachable from the target IP prefix.

[0118] The third recycling unit is used to send TCP SYN-ACK packets to the side channel probe point and receive TCP RST packets returned by the side channel probe point, so as to reclaim the IP ID field value in the TCP RST packet as the probe result;

[0119] The triggering unit is used to send a TCP SYN forged packet to the active IP address corresponding to the target IP prefix and trigger a change in the IP ID counter of the side channel probe point;

[0120] The fourth recycling unit is used to send TCP SYN-ACK packets to the side channel probe point multiple times and receive multiple new TCP RST packets returned by the side channel probe point, so as to recycle multiple new IP ID field values ​​in the new TCP RST packets as probe results;

[0121] The third judgment unit is used to compare the IP ID field value with each new IP ID field value to obtain multiple change values. If there are at least two 2s among the multiple change values, it is considered that the side channel probe point is unreachable from the target IP prefix; otherwise, it is considered that the side channel probe point is reachable from the target IP prefix.

[0122] In some embodiments, the worker node responsible for the current probe task in the asynchronous probe framework will set up multiple concurrent threads to interact with each target probe point during the probe period. Each target probe point corresponds to two threads: one thread is responsible for obtaining the border gateway information from the target probe point to the target IP prefix, and the other thread is responsible for obtaining the reachability from the target probe point to the active IP address under the target IP prefix. The worker node responsible for the current probe task in the asynchronous probe framework will also return the probe results collected from each target probe point to the asynchronous probe task scheduling master process through a message middleware.

[0123] In some embodiments, the analysis module 404 includes:

[0124] The first comparison unit is used to determine if the number of probe points in the detection results is greater than the required number of target probe points by a preset third proportion, wherein the number of probe points affected by the routing anomaly event and unreachable to the target IP prefix is ​​greater than the preset fourth proportion of the number of probe points in the detection results, then the target single routing anomaly event is considered to be a high-confidence hijacking event.

[0125] The second comparison unit is used to determine if the number of probe points in the detection result is greater than the required number of target probe points by a preset third proportion, wherein the number of probe points affected by the routing anomaly event and unreachable to the target IP prefix is ​​less than or equal to the number of probe points in the detection result by a preset fourth proportion, wherein the number of probe points affected by the routing anomaly event and unreachable to the target IP prefix is ​​greater than the preset fourth proportion of the number of probe points in the detection result by a preset fourth proportion, then the target single routing anomaly event is considered to be a medium confidence hijacking event.

[0126] The third comparison unit is used to determine if the number of probe points in the detection result is less than or equal to the preset third proportion of the required number of target probe points, but greater than the preset fourth proportion of the required number of target probe points. In this case, if the number of probe points affected by the routing anomaly event and unreachable to the target IP prefix is ​​greater than the preset third proportion of the number of probe points in the detection result, then the target single routing anomaly event is considered to be a medium confidence hijacking event.

[0127] The fourth comparison unit is used to determine if the number of probe points in the detection result is less than or equal to the preset third percentage of the required number of target probe points, but greater than the preset fourth percentage of the required number of target probe points. Specifically, if the number of probe points affected by the routing anomaly event and unreachable to the target IP prefix is ​​less than the preset third percentage of the number of probe points in the detection result, or the number of probe points in the detection result is less than or equal to the preset fourth percentage of the required number of target probe points, then the target single routing anomaly event is considered a low-confidence hijacking event.

[0128] It should be noted that the foregoing explanation of the asynchronous detection method for route hijacking events also applies to the asynchronous detection device for route hijacking events in this embodiment, and will not be repeated here.

[0129] The asynchronous detection device for routing hijacking events proposed in the embodiments of the present invention has the following beneficial effects:

[0130] (1) By constructing a dual-plane probe pair with probe points that can only obtain control layer routing information (such as the Looking Glass probe point that only supports the show ip bgp command) and probe points that can only perform reachability probes at the data layer (such as probe points that support side-channel probe technology), the probe results of the dual-plane probe pair are regarded as the results from the same probe point, provided that the two types of probe points can provide comparable routing paths. This design enables it to have the same capability as a dual-plane probe point that can independently initiate control layer and data layer probes, thereby significantly increasing the number of available probe points in the network and expanding the coverage of the probe points;

[0131] (2) Based on the dual-plane probe points (such as Looking Glass and routing server) in the network and the newly constructed dual-plane probe pairs, a probe scheme supporting asynchronous concurrency is designed. This scheme includes the scheduling of probe points and probe pairs. Under the premise of ensuring the accuracy of the probe results, the number of probe points or probe pairs required for a single routing anomaly event is reduced, and the call pressure of probe points (pairs) is reduced. In addition, this scheme also includes the confidence evaluation of the hijacking event detection results. Combining the number of effective probe results and other relevant information, a confidence evaluation mechanism is established to comprehensively evaluate the detection results of each routing hijacking event, so as to ensure the reliability and accuracy of the detection results.

[0132] (3) It can effectively meet the needs of detecting routing anomaly events in large-scale networks and achieve efficient and accurate detection of the two main types of routing hijacking events: origin hijacking and forged link hijacking.

[0133] Figure 5 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. The electronic device may include:

[0134] The memory 501, the processor 502, and the computer program stored on the memory 501 and capable of running on the processor 502.

[0135] When processor 502 executes the program, it implements the asynchronous detection method for route hijacking events provided in the above embodiments.

[0136] Furthermore, electronic devices also include:

[0137] Communication interface 503 is used for communication between memory 501 and processor 502.

[0138] The memory 501 is used to store computer programs that can run on the processor 502.

[0139] Memory 501 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0140] If the memory 501, processor 502, and communication interface 503 are implemented independently, then the communication interface 503, memory 501, and processor 502 can be interconnected via a bus to complete communication between them. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 5 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0141] Optionally, in a specific implementation, if the memory 501, processor 502, and communication interface 503 are integrated on a single chip, then the memory 501, processor 502, and communication interface 503 can communicate with each other through an internal interface.

[0142] Processor 502 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention.

[0143] This invention also provides a computer program product that, when executed by a processor, implements the above-described asynchronous detection method for route hijacking events.

[0144] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described asynchronous detection method for route hijacking events.

[0145] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0146] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0147] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or N executable instructions for implementing custom logic functions or processes, and the scope of preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.

[0148] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0149] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. If implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0150] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0151] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0152] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention.

Claims

1. An asynchronous detection method for route hijacking events, characterized in that, Includes the following steps: Construct a dual-plane detection pair, and combine the dual-plane detection pair with a preset dual-plane detection point to form a set of available detection points; Obtain the active IP address and network port of the target single routing anomaly event, and select the required number of target probe points from the available probe point set based on the active IP address and network port, specifically including: Based on the target IP prefix of the single routing anomaly event, determine the active IP address and network port corresponding to the target IP prefix; Obtain the autonomous system path contained in the border gateway protocol information of the target IP prefix; Extract multiple autonomous systems contained in the autonomous system path to form an autonomous system set; A first preset number of target detection points are selected from the set of autonomous systems, wherein the first preset number is a first preset percentage of the number of detection points required for a single task that is less than or equal to the number of detection points required for a single task; Based on the classification in the autonomous system topology, a second preset number of target probes are selected from the set of available probes to cover different types of autonomous systems. The second preset number is a second preset percentage that is less than or equal to the number of probes required for a single task. Multiple target probes are randomly selected from the unselected probes in the set of available probes to make up the required number of target probes. The required number of target probes includes spy camera-type probes, routing server-type probes, and side-channel probes that support IP ID counters and can respond to TCP packets. Based on an asynchronous probing framework, the required number of target probe points are invoked to probe a single routing anomaly event of the target, and the probe results are collected. Specifically, this includes: Based on the asynchronous detection framework, the target IP prefix is ​​detected by interacting with the spy camera-like detection point by calling the network port corresponding to the target IP prefix; The Border Gateway Protocol information from the spy camera-type detection point to the target IP prefix is ​​retrieved, and a first set of autonomous system paths leading to the target IP prefix is ​​returned. A first optimal path is extracted from the first set of autonomous system paths. It is then checked whether the first optimal path contains a hijacker autonomous system in prefix origin hijacking or a suspicious autonomous system pair in forged link hijacking. If it contains a hijacker autonomous system in prefix origin hijacking or a suspicious autonomous system pair in forged link hijacking, the spy camera-type detection point is considered to be affected by a routing anomaly event. Otherwise, the spy camera-type detection point is considered not to be affected by a routing anomaly event. If the ping command returned by the spy-type detection point shows that there is a reachable active IP under the prefix, then the spy-type detection point is considered to be reachable from the target IP prefix; otherwise, the spy-type detection point is considered to be unreachable from the target IP prefix. By using a script interaction method, the router server-type probe point is invoked to log in to the router server corresponding to the target single routing anomaly event, so as to initiate a probe on the target single routing anomaly event; The system retrieves the Border Gateway Protocol information from the server-type probe point to the target IP prefix and returns a second set of autonomous system paths to the target IP prefix. It then extracts a second optimal path from this set and checks whether the second optimal path contains a hijacker autonomous system in the prefix origin hijacking or a suspicious autonomous system pair in the forged link hijacking. If it does, the server-type probe point is considered to be affected by a routing anomaly event; otherwise, it is considered that the spy camera-type probe point is not affected by the routing anomaly event. If the ping command returned by the server-type probe point shows that there is a reachable active IP under the prefix, then the server-type probe point is considered to be reachable from the target IP prefix; otherwise, the server-type probe point is considered to be unreachable from the target IP prefix. Send a TCP SYN-ACK packet to the side channel probe point and receive a TCP RST packet returned by the side channel probe point to retrieve the IP ID field value in the TCP RST packet; A TCP SYN forged packet is sent to the active IP address corresponding to the target IP prefix, and the IP ID counter of the side channel probe point is triggered to change. The TCP SYN-ACK packet is sent multiple times to the side channel probe point, and multiple new TCP RST packets are received from the side channel probe point to reclaim multiple new IP ID field values ​​in the new TCP RST packets; The IP ID field value is compared with each new IP ID field value to obtain multiple change values. If at least two of the multiple change values ​​are 2, it is considered that the side channel probe point is unreachable from the target IP prefix; otherwise, it is considered that the side channel probe point is reachable from the target IP prefix. Based on the detection results, analyze whether the single routing anomaly event of the target was caused by a hijacking event.

2. The asynchronous detection method for routing hijacking events according to claim 1, characterized in that, The construction of a dual-plane detection pair, and the combination of the dual-plane detection pair with preset dual-plane detection points to form a set of usable detection points, includes: Acquire probe points on different control planes and different data planes within the same autonomous system; The geographical locations of the detection points on different control planes and the detection points on different data planes are obtained respectively, and the detection points on any control plane and any data plane with the same geographical location are constructed into multiple initial dual-plane detection pairs; Obtain the second-hop autonomous system in the routing path obtained by the control plane and data plane in each initial dual-plane probe pair, so as to filter multiple dual-plane probe pairs in which the second-hop autonomous system in the routing path obtained by the control plane and data plane is consistent; The available detection point set is formed by the plurality of dual-plane detection pairs and the preset dual-plane detection points.

3. The asynchronous detection method for routing hijacking events according to claim 1, characterized in that, In the asynchronous detection framework, the working node responsible for the current detection task will set up multiple concurrent threads to interact with each target detection point within the detection period. Each target detection point corresponds to two threads: one thread is responsible for obtaining the border gateway information from the target detection point to the target IP prefix, and the other thread is responsible for obtaining the reachability of the target detection point to the active IP address under the target IP prefix. In the asynchronous detection framework, the worker node responsible for the current detection task also returns the detection results collected from each target detection point to the asynchronous detection task scheduling master process through a message middleware.

4. The asynchronous detection method for routing hijacking events according to claim 1, characterized in that, The step of analyzing whether the target single routing anomaly event was caused by a hijacking event based on the detection results includes: If the number of probe points in the detection results is greater than the preset third proportion of the required number of target probe points, and the number of probe points affected by the routing anomaly event and unreachable to the target IP prefix is ​​greater than the preset fourth proportion of the number of probe points in the detection results, then the target single routing anomaly event is considered to be a high-confidence hijacking event. If the number of probe points in the detection results is greater than the preset third proportion of the required number of target probe points, wherein the number of probe points affected by the routing anomaly event and unreachable to the target IP prefix is ​​less than or equal to the preset fourth proportion of the number of probe points in the detection results, then the target single routing anomaly event is considered to be a medium confidence hijacking event. If the number of probe points in the detection results is less than or equal to the preset third proportion of the required number of target probe points, but greater than the preset fourth proportion of the required number of target probe points, wherein the number of probe points affected by the routing anomaly event and unreachable to the target IP prefix is ​​greater than the preset third proportion of the number of probe points in the detection results, then the target single routing anomaly event is considered to be a medium confidence hijacking event. If the number of probe points in the detection results is less than or equal to the preset third proportion of the required number of target probe points, but greater than the preset fourth proportion of the required number of target probe points, wherein the number of probe points affected by the routing anomaly event and unreachable to the target IP prefix is ​​less than the preset third proportion of the number of probe points in the detection results, or the number of probe points in the detection results is less than or equal to the preset fourth proportion of the required number of target probe points, then the target single routing anomaly event is considered a low-confidence hijacking event.

5. An asynchronous detection device for routing hijacking events, characterized in that, include: The construction module is used to construct dual-plane detection pairs and form a set of usable detection points by combining the dual-plane detection pairs with preset dual-plane detection points; The determination module is used to obtain the active IP address and network port of a single target routing anomaly event, and select the required number of target probe points from the set of available probe points based on the active IP address and network port, including: The determination unit is used to determine the active IP address and network port corresponding to the target IP prefix based on the target IP prefix of a single routing anomaly event. The second acquisition unit is used to acquire the autonomous system path contained in the border gateway protocol information of the target IP prefix; The extraction unit is used to extract multiple autonomous systems contained in the autonomous system path to form an autonomous system set; The first selection unit is used to select a first preset number of target detection points from the set of autonomous systems, wherein the first preset number is a first preset percentage of the number of detection points required for a single task that is less than or equal to the number of detection points required for a single task. The second selection unit is used to select a second preset number of target detection points from the set of available detection points according to the classification in the topology of the autonomous system, so as to cover different types of autonomous systems. The second preset number is a second preset proportion that is less than or equal to the number of detection points required for a single task. The supplementary unit is used to randomly select multiple target probe points from the unselected probe points in the available probe point set to supplement the required number of target probe points. The required number of target probe points includes spy camera-type probe points, routing server-type probe points, and side-channel probe points that support IP ID counters and can respond to TCP packets. The detection module, based on an asynchronous detection framework, invokes the required number of target detection points to initiate detection of a single routing anomaly event of the target, and collects the detection results, including: An interactive unit is used to interact with the spy camera-like detection point by calling the network port corresponding to the target IP prefix based on an asynchronous detection framework, so as to initiate detection on the target IP prefix and its corresponding active IP address; The first recycling unit is used to recycle the Border Gateway Protocol information from the spy camera-type detection point to the target IP prefix and return the first autonomous system path set to the target IP prefix. It then extracts the first optimal path from the first autonomous system path set and checks whether the first optimal path contains a hijacker autonomous system in prefix origin hijacking or a suspicious autonomous system pair in forged link hijacking. If it contains a hijacker autonomous system in prefix origin hijacking or a suspicious autonomous system pair in forged link hijacking, it is considered that the spy camera-type detection point is affected by a routing anomaly event; otherwise, it is considered that the spy camera-type detection point is not affected by a routing anomaly event. The first judgment unit is used to determine if the ping command returned by the peephole-type detection point shows that there is a reachable active IP under the prefix, then the peephole-type detection point is considered to be reachable from the target IP prefix; otherwise, the peephole-type detection point is considered to be unreachable from the target IP prefix. The initiating unit is used to call the routing server-type probe point to log in to the routing server corresponding to the target single routing anomaly event through script interaction, so as to initiate a probe to the target single routing anomaly event; The second recycling unit recycles the Border Gateway Protocol information from the server-type probe point to the target IP prefix and returns a second set of autonomous system paths to the target IP prefix. It then extracts a second optimal path from the second set of autonomous system paths and checks whether the second optimal path contains a hijacker autonomous system in the prefix origin hijacking or a suspicious autonomous system pair in the forged link hijacking. If it contains a hijacker autonomous system in the prefix origin hijacking or a suspicious autonomous system pair in the forged link hijacking, the server-type probe point is considered to be affected by a routing anomaly event; otherwise, the spy camera-type probe point is considered not to be affected by a routing anomaly event. The second judgment unit is used to determine that if the ping command returned by the server-type probe point shows that there is a reachable active IP under the prefix, then the server-type probe point is considered to be reachable from the target IP prefix; otherwise, the server-type probe point is considered to be unreachable from the target IP prefix. The third recycling unit is used to send a TCP SYN-ACK packet to the side channel probe point and receive a TCP RST packet returned by the side channel probe point to reclaim the IP ID field value in the TCP RST packet; The triggering unit is used to send a TCP SYN forged packet to the active IP address corresponding to the target IP prefix and trigger a change in the IP ID counter of the side channel probe point; The fourth recycling unit is used to send the TCP SYN-ACK message to the side channel probe point multiple times, and receive multiple new TCP RST messages returned by the side channel probe point, so as to reclaim multiple new IP ID field values ​​in the new TCP RST messages; The third judgment unit is used to compare the IP ID field value with each new IP ID field value to obtain multiple change values. If there are at least two 2s among the multiple change values, it is considered that the side channel probe point is unreachable from the target IP prefix; otherwise, it is considered that the side channel probe point is reachable from the target IP prefix. The analysis module is used to analyze, based on the detection results, whether the single routing anomaly event of the target was caused by a hijacking event.

6. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, the processor executing the program to implement the asynchronous detection method for routing hijacking events as described in any one of claims 1-4.

7. A computer program product, characterized in that, When the computer program / instruction is executed by the processor, it implements the asynchronous detection method for routing hijacking events as described in any one of claims 1-4.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by the processor to implement the asynchronous detection method for route hijacking events as described in any one of claims 1-4.

Images