A router alias identification system

Abstract

The application discloses a router alias identification system, comprising: an active detection module, which fuses multiple active detection protocols to generate an initial candidate set; a dynamic scheduling module, which optimizes active detection task allocation complexity; and a passive data verification module, which verifies active detection results. Compared with the original typical router alias identification method MBT, the application has obvious advantages in identification efficiency and anti-interference, and the speed of identifying every 10,000 routers is reduced from 42.3 seconds to 4.1 seconds. Through local smoothing by a sliding window and dynamic threshold adjustment by Kalman filtering, the application inhibits IP identification randomization noise and equal-cost multi-path interference, and realizes an alias identification accuracy of 90.1% in a 25% noise environment, which is 7%-25% higher than that of a traditional method.

Description

Technical Field

[0001] This invention belongs to the field of router alias resolution technology, specifically, it relates to a router alias recognition system. Background Technology

[0002] Router alias identification is a key technology for determining whether multiple IP addresses belong to the same physical router. Its accuracy directly impacts network topology analysis, fault diagnosis, and security tracing. The key steps in router alias identification include: First, alias set filtering: Router combinations that may contain aliases are pre-filtered according to specific rules. This aims to reduce the workload and overhead of subsequent detection phases, such as eliminating IP address combinations that clearly do not belong to the same router, thus improving overall identification efficiency. Second, data detection and analysis: Data acquisition methods include direct measurement, such as obtaining the IPID (IP Identification), path information (obtaining the IP address information of each hop on the routing path using tools like traceroute), and timestamps from response packets. This data reflects relevant characteristics in the network communication process. Third, data analysis: The acquired data is processed and analyzed to uncover features that reveal IP address relationships. Finally, alias identification is performed based on the results obtained during the data probing and analysis phase. It is determined whether a specific IP pair belongs to the same router as an alias. If the routing paths of two IP addresses are almost identical and the IPID values ​​of the response packets show similar trends and fluctuate within a set threshold range, it can be inferred that they are likely aliases of the same router.

[0003] Router alias recognition has undergone twenty years of development, and scholars both domestically and internationally have conducted in-depth research on it. Current research can be mainly divided into three categories:

[0004] (1) Active Probe Method: This method analyzes the router's response characteristics by sending customized probe packets (such as ICMP and TCP). The core principle is to infer alias relationships based on the continuity of IPID sequences or the similarity of interface states. Its advantage is high interface coverage (>85%), but it is susceptible to ECMP interference, resulting in a high false positive rate.

[0005] (2) Passive monitoring method: Alias ​​relationships are built by parsing network logs such as BGP route updates and SNMP traps. The advantage is that no active traffic injection is required. However, the data is fragmented (coverage <60%).

[0006] (3) Hybrid method: Existing hybrid methods attempt to integrate active and passive data to complement each other's shortcomings, resist path jump interference, and improve noise robustness. However, due to the limitations of task scheduling efficiency and noise suppression mechanism, the performance improvement is limited.

[0007] The current problems faced by router alias recognition are: (1) Difficulty in balancing efficiency and anti-interference: Existing methods cannot simultaneously achieve low complexity (O(n)) and high robustness (accuracy >90% under noise). Active detection and hybrid methods generally rely on pairwise interface matching (O(n)). 2 (1) Complexity), when processing millions of devices, the MBT algorithm takes more than 42.3 seconds, and the Hybrid Alias ​​still takes 28.9 seconds, which is difficult to meet the real-time requirements; (2) Dynamic load sensitivity: ECMP path jumps cause the false positive rate of the active detection method to surge, while the passive monitoring method is difficult to support topology discovery independently due to low data coverage; the hybrid method does not solve the problem of cross-regional scheduling delay and load imbalance; (3) Insufficient noise suppression, the existing method uses static thresholds, and the accuracy drops by 20%~30% in the IPID randomization scenario, and it cannot adapt to sudden traffic interference.

[0008] In view of this, the present invention proposes a proactive and passive collaborative router alias recognition method to achieve efficient and high-precision alias recognition. Summary of the Invention

[0009] The technical problem to be solved by the present invention is to overcome the shortcomings of the prior art and provide a method for identifying aliases of a main router.

[0010] To achieve the above objectives, the technical solution of the present invention is as follows:

[0011] A router alias identification system includes:

[0012] The active detection module integrates multiple active detection protocols to generate an initial candidate set.

[0013] The dynamic scheduling module optimizes the complexity of active probing task allocation;

[0014] The passive data verification module verifies the results of active detection.

[0015] In a preferred embodiment, the active probing module integrates four active probing protocols: ICMP, TCP, UDP, and SYN. ​​It performs cross-verification using multi-protocol probing packets based on a protocol utility function, where the protocol utility function is...

[0016] ,

[0017] in,

[0018] Cp For the agreement P select Historical coverage

[0019] Rp This is the protocol's resistance to jumps.

[0020] In a preferred embodiment, the dynamic scheduling module:

[0021] The geographic scheduling of the framework is optimized based on a quadtree index to reduce cross-regional detection latency, according to node density. p(Q) The recursive partitioning of the network region is a quadtree structure, when When the network region is divided into four sub-regions, the formula for calculating the node density is:

[0022] ,

[0023] in,

[0024] N(Q) For the region Q The number of nodes,

[0025] A(Q) For the region Q The area;

[0026] The dynamic priority of exploration tasks is calculated based on geographic density, connectivity status, and load weight, with higher-priority tasks being allocated preferentially. The formula for calculating the dynamic priority is as follows:

[0027] ,

[0028] in,

[0029] Ld(i) For the region i Geographic density, Geographic density weight,

[0030] Cn(i) For nodes i The connection status parameters, For connection state weights,

[0031] Lt(i) For nodes i Task load parameters, This is the task load weight.

[0032] In a preferred embodiment, the dynamic scheduling module employs a dynamic feedback mechanism to optimize resource utilization and achieve load balancing. Balance As a load balancing metric, when Balance Task redistribution stops when the load balancing score is ≥0.85. The formula for calculating the load balancing score is as follows:

[0033] ,

[0034] in,

[0035] L For node load vectors,

[0036] σ2 Let V be the variance of the node load vector.

[0037] m This represents the mean of the node load vector.

[0038] In a preferred embodiment, the dynamic scheduling module further includes a status monitoring system for collecting network status data. In the dynamic priority calculation, the system executes a parameter weight adjustment strategy based on the collected network status data to adjust the parameter weights.

[0039] The network status data includes at least one of the following: fault node rate, regional density variation coefficient, and load balancing degree.

[0040] When the failure rate is greater than 10%, increase the connection status weight and decrease the geographical density weight.

[0041] When the regional density variation coefficient is greater than 0.5, increase the geographical density weight and decrease the task load weight.

[0042] When the load balancing degree is less than 0.8, increase the task load weight and decrease the connection state weight.

[0043] In a preferred embodiment, after adjusting the parameter weights, the changes in system performance after each adjustment are recorded. Adjustment strategies that improve performance are used more frequently, while those that reduce performance are used less frequently. System performance is quantified through a comprehensive performance score, calculated using the following formula:

[0044] Overall performance score = β 1 ×efficiency factor+ β 2 ×Equilibrium Factor- β 3 × Fault factors,

[0045] in,

[0046] Efficiency factor = e ^(-0.5 × average task time),

[0047] Balance factor = load balancing degree

[0048] Fault factor = number of faulty nodes not detected.

[0049] β 1 , β 2 , β 3 These are the weights corresponding to each factor.

[0050] In a preferred embodiment, the passive data verification module suppresses false positive results from active probing by verifying BGP route prefix aggregation and SNMP device information.

[0051] The formula for calculating route prefix aggregation is:

[0052] ,

[0053] in, P i , P j They are respectively with IP i , IP j The set of associated route prefixes;

[0054] when S bgp When the value is ≥0.7, the two IP addresses are considered to have a strong correlation at the routing level and can be used as candidate alias pairs;

[0055] Query the device's system name using the SNMP protocol. IP i and IP j If the system names match, the match is considered successful.

[0056] In a preferred embodiment, the router alias identification system further includes an anti-interference module, which receives an initial candidate set and performs secondary verification to eliminate noise interference, and outputs the candidate set after interference elimination to the passive data verification module.

[0057] In a preferred embodiment, the anti-interference module suppresses noise interference based on the IPBH anti-interference algorithm, including the following steps:

[0058] S1. Sliding window local smoothing and local similarity matching: Divide the IPID sequence into subsequences of fixed window size and calculate the average rate of change of IPIDs within the window. Perform local smoothing processing, if the two IPs Serial correlation coefficient A value ≥0.9 is considered a potential alias for the IPID sequence {ID} within the sliding window. t ID t+1 ,…,ID t+k-1}, The calculation formula is as follows:

[0059] ,

[0060] in,

[0061] k The sliding window size represents the number of consecutive IPID values ​​contained within the window.

[0062] t This is the starting index of the sliding window, indicating the starting position of the current window in the IPID sequence.

[0063] ID i For the first i The IP identifier value of each data packet;

[0064] S2. Dynamic Threshold Adjustment: The threshold is dynamically adjusted using a Kalman filter model. The threshold is updated based on the observed rate of change of IPID in the current window. The locally smoothed IPID sequence is then filtered based on the adjusted threshold to output a refined alias set.

[0065] The formula used to update the threshold is,

[0066] ,

[0067] in,

[0068] α The dynamic learning rate controls the sensitivity of the threshold to changes in observed values.

[0069] D k,t For the first t The actual rate of change of IPID within a window.

[0070] In a preferred embodiment, in step S2, the threshold filtering rule is: for candidate alias pairs ( IP i ,IP j If satisfied Then the determination is made. IP i and IP j An alias interface for the same router;

[0071] in, for IP i The average rate of change of IPID within the corresponding window.

[0072] After adopting the above technical solution, the router alias identification system provided by the present invention has the following advantages compared with the prior art:

[0073] This invention addresses the problems of dynamic load interference and low efficiency in router alias identification in large-scale networks. It proposes a highly efficient identification method that combines active and passive approaches. By optimizing the quadtree geographical scheduling and using a dynamic task allocation model, the identification efficiency for millions of devices is improved by 10.3 times. The invention also designs an IPBH anti-interference algorithm, which combines sliding window (k=10) local smoothing with Kalman filter dynamic threshold adjustment. Under 25% noise, it achieves an accuracy of 90.1% (7.1% improvement over the best baseline) and a false positive rate of 0.9%. Attached Figure Description

[0074] The accompanying drawings, as part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments and descriptions of the invention are used to explain the invention, but do not constitute an undue limitation of the invention. Obviously, the drawings described below are merely some embodiments, and those skilled in the art can obtain other drawings based on these drawings without creative effort. In the drawings:

[0075] Figure 1 This is a framework diagram of the router alias recognition system provided by the present invention;

[0076] Figure 2 This is a schematic diagram of the quadtree space index of the dynamic scheduling module of the present invention;

[0077] Figure 3 This is a flowchart of the adaptive weight adjustment mechanism based on reinforcement learning in the dynamic scheduling module of this invention;

[0078] Figure 4 This is a flowchart of the IPBH algorithm for the anti-interference module of this invention;

[0079] Figure 5 This is the candidate set generation and filtering process of the router alias recognition system of the present invention.

[0080] It should be noted that these accompanying drawings and textual descriptions are not intended to limit the scope of the invention in any way, but rather to illustrate the concept of the invention to those skilled in the art by referring to specific embodiments. Detailed Implementation

[0081] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments will be clearly and completely described below with reference to the accompanying drawings. The following embodiments are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0082] To achieve efficient router alias recognition, this invention provides a proactive and passive collaborative router alias recognition system, referring to... Figure 1Its core consists of an active detection module, a dynamic scheduling module, and a passive data verification module. The left side is the active detection protocol coordination process, the right side is the BGP / SNMP passive verification module, and the bottom is the interaction interface between dynamic task allocation and the IPBH algorithm. It aims to solve the efficiency bottleneck and insufficient anti-interference problem of traditional methods.

[0083] Referring to Table 1, to address the issues of low coverage of a single protocol (ICMP 76.3%) and sensitivity to path hopping (ECMP false positive rate ≥1.8%), the active probing module integrates four active probing protocols: ICMP (Internet Control Message Protocol), TCP (Transmission Control Protocol), SYN (Synchronize Sequence Numbers), and UDP (User Datagram Protocol). This covers 98.5% of router interfaces (compared to <85% for traditional methods), covers different hash paths, suppresses blind spots in single-protocol probing, and suppresses path hopping interference through a dynamic protocol selection algorithm.

[0084] Table 1 Protocol Complementarity Matrix

[0085]

[0086] Based on the protocol utility function, cross-validation of multi-protocol probe packets enhances collaborative coverage, improves coverage rate, and reduces path hop rate.

[0087] Specifically, the protocol utility function is,

[0088] ,

[0089] in,

[0090] Cp For the agreement P select Historical coverage (the percentage of successful responses per unit of time).

[0091] Rp This refers to the protocol's anti-jump rate (path stability under ECMP interference).

[0092] Traditional methods for task allocation have high complexity (e.g., the MBT algorithm has a complexity of O(n). n2) To address the efficiency bottleneck caused by uneven load distribution, this invention proposes a dynamic task allocation model. Based on a quadtree geographic index and a dynamic load feedback mechanism, it reduces the task scheduling complexity to O(n log n). n) .

[0093] Specifically, the dynamic scheduling module optimizes geographic scheduling based on quadtree index pairs, prioritizing the scheduling of detection tasks for geographically nearby nodes to reduce cross-regional path jump interference. Geographic proximity determination is based on the IP location database, reducing cross-regional latency. Spatial partitioning: The network region is recursively partitioned into a quadtree structure ( Figure 2 The node density of each sub-region is calculated using Moran's I index, with priority given to assigning tasks to high-density regions.

[0094] Spatial division criteria:

[0095] Define node density

[0096] ,

[0097] in,

[0098] N(Q) For the region Q The number of nodes,

[0099] A(Q) For the region Q The area;

[0100] The condition for recursive partitioning is that when At that time, the network region is split into four sub-regions.

[0101] Furthermore, the dynamic scheduling module calculates the dynamic priority of the exploration tasks based on geographical density, connection status, and load weight, and prioritizes the allocation of high-priority tasks.

[0102] The formula for calculating dynamic priority is as follows:

[0103] ,

[0104] in,

[0105] Ld(i) For the region i Geographic density, calculated based on quadtrees for regions i node density, Geographic density weight, with a baseline value of 0.58;

[0106] Cn(i) For nodes i The connection status parameters are determined by heartbeat detection (every 30 seconds). i Availability (response time < 50ms) The connection state weight has a baseline value of 0.30.

[0107] Lt(i) For nodes iTask load parameters, circular buffer records nodes i The time taken for the last 10 tasks was dynamically adjusted to optimize the load ratio. This is the task load weight, with a baseline value of 0.12.

[0108] Reference Figure 2 The top of the diagram shows the initial region partitioning, followed by the quadtree structure after recursive splitting. High-density regions are marked in red. Compared with traditional static partitioning methods, the innovation of quadtree indexing lies in recording the historical load of nodes through a circular buffer and adjusting the granularity of region partitioning in real time. It also combines heartbeat detection (every 30 seconds) to dynamically remove unusable nodes and avoid invalid probes. Geographic proximity scheduling reduces ECMP path jump interference.

[0109] Furthermore, the dynamic scheduling module employs a dynamic feedback mechanism to optimize resource utilization and improve load balancing. Balance As a load balancing metric, when Balance Task reallocation will stop when the value is ≥0.85.

[0110] Specifically, the formula for calculating load balancing is:

[0111] ,

[0112] in,

[0113] L For node load vectors,

[0114] σ2 Let V be the variance of the node load vector.

[0115] m This represents the mean of the node load vector.

[0116] In actual network operation, network status and topology may change dynamically, making fixed weight parameters unsuitable for all scenarios. This invention proposes an adaptive weight adjustment mechanism based on reinforcement learning, which achieves intelligent dynamic optimization of parameters without changing the original task allocation model. Specifically, the dynamic scheduling module also includes a status monitoring system for collecting network status data. During dynamic priority calculation, the parameter weight adjustment strategy is executed based on the collected network status data to adjust the parameter weights.

[0117] The network status data includes at least one of the following:

[0118] Failure Rate (FNR): Number of failed nodes / total number of nodes, reflecting network stability;

[0119] Regional density variation coefficient (RDVC): standard deviation / mean of node distribution, characterizing geographical distribution variation;

[0120] Load Balancing (LBD): Node workload variance, measuring the fairness of task allocation;

[0121] Cross-region delay growth rate (CDGR): (current delay - previous cycle delay) / previous cycle delay, indicating network congestion.

[0122] The parameter weight adjustment strategy is as follows:

[0123] Network status data is collected at regular time intervals (preferably every 10 minutes);

[0124] A weight adjustment scheme is generated based on preset rules.

[0125] Referring to Table 2, the weight adjustment scheme is as follows:

[0126] When the failure rate is greater than 10%, the connection status weight is increased and the geographic density weight is decreased, specifically the connection status weight is increased by 0.05 and the geographic density weight is decreased by 0.05.

[0127] When the regional density variation coefficient is greater than 0.5, the geographic density weight is increased and the task load weight is decreased, specifically, the geographic density weight is increased by 0.05 and the task load weight is decreased by 0.05.

[0128] When the load balancing score is less than 0.8, the task load weight is increased and the connection state weight is decreased. Specifically, the task load weight is increased by 0.05 and the connection state weight is decreased by 0.05.

[0129] Table 2. Correspondence between Weights and Boundary Constraints

[0130]

[0131] In a preferred embodiment, after adjusting the parameter weights, the changes in system performance after each adjustment are recorded. The frequency of use of adjustment strategies that improve performance is increased, and the frequency of use of adjustment strategies that reduce performance is decreased. An optimization strategy report is generated after running for a period of time.

[0132] Specifically, system performance is quantified through a comprehensive performance score, calculated using the following formula:

[0133] Overall performance score = β 1 ×efficiency factor+ β 2 ×Equilibrium Factor- β 3 × Fault factors,

[0134] in,

[0135] Efficiency factor = e^(-0.5 × average task time),

[0136] Balance factor = load balancing degree

[0137] Fault factor = number of faulty nodes not detected.

[0138] β 1 , β 2 , β 3 These are the weights corresponding to each factor.

[0139] The passive data verification module suppresses false positive results from active probes by verifying BGP route prefix aggregation and SNMP device information.

[0140] (1) BGP route prefix similarity verification

[0141] Since different interfaces of the same router typically participate in the same BGP route advertisement, their associated route prefix sets have a high degree of overlap. This invention proposes a route prefix aggregation metric method based on the Jaccard similarity coefficient, calculated using the following formula:

[0142] ,

[0143] in, P i , P j They are respectively with IP i , IP j The set of associated route prefixes;

[0144] when S bgp A similarity score of ≥0.7 indicates a strong routing-level correlation between two IP addresses, making them suitable as candidate alias pairs. This threshold is based on statistics from the CAIDA dataset (the critical similarity score is 0.68 when the true positive rate is ≥95%, but 0.7 is used to improve robustness).

[0145] (2) SNMP device information matching

[0146] For candidate pairs filtered using the above formula, the system name of the device is further queried via the SNMP protocol. IP i and IP j If the system names match, the match is considered successful.

[0147] Specifically, the consistency of the device's MIB objects, such as the system name (sysName) and description information, is verified by querying them via the SNMP protocol.

[0148] ,

[0149] in I(.) This is an indicator function that indicates when a match is successful. =1 otherwise 0. This step can eliminate BGP prefix mismatches caused by ECMP path switching.

[0150] Traditional router alias identification methods (such as the Ally algorithm) suffer from a significant drop in accuracy under noisy environments (such as IPID randomness interference and dynamic load balancing). To suppress noise interference caused by IPID randomization (RFC7739) and ECMP path switching and improve alias identification accuracy, this invention proposes an optimized IPBH algorithm that suppresses IPID randomness interference through a sliding window mechanism. Specifically, the router alias identification system also includes an anti-interference module, which receives the initial candidate set and performs secondary verification. Based on the IPBH anti-interference algorithm, it suppresses noise interference and outputs the interference-free candidate set to the passive data verification module.

[0151] The anti-interference mechanism includes the following steps:

[0152] S1. Sliding window local smoothing and local similarity matching: Divide the IPID sequence into subsequences of fixed window size and calculate the average rate of change of IPIDs within the window. Perform local smoothing processing, if the two IPs Serial correlation coefficient A value ≥0.9 is considered a potential alias for the IPID sequence {ID} within the sliding window. t ID t+1 ,…,ID t+k-1}, The calculation formula is as follows:

[0153] ,in,

[0154] k The sliding window size, k, represents the number of consecutive IID values ​​contained within the window. A window size of k=10 represents a balance between accuracy and efficiency. t This is the starting index of the sliding window, indicating the starting position of the current window in the IPID sequence.

[0155] ID i For the first iThe IP identifier value of each data packet ranges from 0 to 65535 (RFC791 standard). Verification shows that a window size of k=10 is the balance point between accuracy and efficiency. In a network with 1000 nodes, k=10 achieves Pareto optimality between noise suppression and computational efficiency. Absolute values ​​are used in this formula. Instead of the squared difference, it suppresses the amplification effect of sudden noise on the mean.

[0156] S2. Dynamic Threshold Adjustment: The threshold is dynamically adjusted using a Kalman filter model. The threshold is updated based on the observed rate of change of IPID in the current window. The locally smoothed IPID sequence is then filtered based on the adjusted threshold to output a refined alias set.

[0157] Specifically, the Kalman filter model is based on a historical window. The mean and variance are used to predict the next window threshold. To reduce computational complexity and meet real-time requirements, the statistical characteristics of the IPID sequence are combined.

[0158] State equation: process noise suppression, assuming that threshold changes are mainly driven by observation noise, ignoring process noise (Q≈0), that is, the state prediction remains constant.

[0159] ,

[0160] in,

[0161] Let t be the dynamic threshold estimate for the t-th window (unit: IP identifier change / window), representing the upper limit of the allowable rate of change of IPIDs under the current network environment;

[0162] The threshold for the previous window (historical status);

[0163] For process noise, it represents the uncertainty of state prediction.

[0164] Process noise in the above formula The covariance matrix is ​​set to Q≈0: based on observations of the IPID trend, it is assumed that... The changes are very gradual over a short period of time, primarily driven by observation noise. Therefore, the variance Q of the process noise is set to a very small positive number (Q = 1e-6 in the experiment), approximately considered to be Q≈0. This is equivalent to assuming that the state remains constant over a short period of time. ≈ This simplifies the model and reduces computational complexity, while still meeting the expectation of slow threshold changes.

[0165] The formula used to update the threshold is,

[0166] ,

[0167] in,

[0168] α The dynamic learning rate controls the sensitivity of the threshold to changes in observed values.

[0169] D k,t For the first t The actual rate of change of IPID within a window.

[0170] The dynamic learning rate *c* in the above formula is essentially a simplified representation of the Kalman gain. It controls the system's response to observations. D k,t The degree of trust in the data is determined by α. A larger α indicates greater trust in new observations, resulting in a faster response but poorer noise resistance; a smaller α relies more on historical states, leading to a smoother but slower response. This is equivalent to assuming that the observation noise covariance Q is approximately four times the state uncertainty, consistent with the characteristic of significant network noise. Preferably, α = 0.2, determined through grid search, balances noise suppression (too small a value leads to lag) with response speed (too large a value leads to overfitting), determining that α = 0.2 achieves the optimal balance between noise suppression and response speed. D k,t > When this occurs, it indicates that the current network noise is increasing, and the threshold is [value missing]. It needs to be adjusted upwards (tolerating greater differences); when D k,t < When the threshold is reached, it indicates that the noise is reduced. Lower (increase the strictness of the judgment).

[0171] In a preferred embodiment, the threshold filtering rule in step S2 is as follows:

[0172] For candidate alias pairs ( IP i ,IP j If satisfied Then the determination is made. IP i and IP j An alias interface for the same router;

[0173] in, for IP i The average rate of change of IPID within the corresponding window.

[0174] The filtering logic is as follows: for the same router interface, due to the shared clock source, its... The difference in values ​​is less affected by noise (experimental statistics show that the difference between 99% of true positive pairs is <). For different router interfaces, the impact of ECMP path transitions or device clock differences may occur. Significant difference (> The probability is >85%. When network noise increases ( D k,t > ) hour, Automatic upscaling, tolerating greater differences; when noise decreases ( D k,t < ) hour, The strictness of the judgment has been lowered.

[0175] After adopting the above technical solution, the router alias identification system provided by the present invention has the following advantages compared with the prior art:

[0176] This invention addresses the problems of dynamic load interference and low efficiency in router alias identification in large-scale networks. It proposes a highly efficient identification method that combines active and passive approaches. By optimizing the quadtree geographical scheduling and using a dynamic task allocation model, the identification efficiency for millions of devices is improved by 10.3 times. The invention also designs an IPBH anti-interference algorithm, which combines sliding window (k=10) local smoothing with Kalman filter dynamic threshold adjustment. Under 25% noise, it achieves an accuracy of 90.1% (7.1% improvement over the best baseline) and a false positive rate of 0.9%.

[0177] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0178] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-described technical content to create equivalent embodiments without departing from the scope of the present invention. The implementation schemes in the above embodiments can also be further combined or replaced. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A router alias identification system, characterized in that, include: The active detection module integrates multiple active detection protocols to generate an initial candidate set. The dynamic scheduling module is used to optimize the allocation complexity of active probing tasks. It optimizes the geographic scheduling of the framework based on quadtree index to reduce cross-regional probing latency. It calculates the dynamic priority of probing tasks based on geographic density, connection status, and load weight, and prioritizes the allocation of high-priority tasks. The passive data verification module is used to verify the results of active probes. It suppresses false positive results of active probes by verifying BGP route prefix aggregation and SNMP device information. An anti-interference module is used to receive the initial candidate set and perform secondary verification to remove noise interference, and output the candidate set after interference removal to the passive data verification module. The anti-interference module suppresses noise interference based on the IPBH anti-interference algorithm. Includes the following steps, S1. Sliding window local smoothing and local similarity matching: Divide the IPID sequence into subsequences of fixed window size and calculate the average rate of change of IPIDs within the window. Perform local smoothing processing, if the two IPs A sequence with a correlation coefficient ≥ 0.9 is considered a potential alias. For an IPID sequence {ID} within a sliding window... t ID t+1 ,…,ID t+k-1 }, The calculation formula is as follows: ， in, k The sliding window size represents the number of consecutive IID values ​​contained within the window. t This is the starting index of the sliding window, indicating the starting position of the current window in the IPID sequence. ID i For the first i The IP identifier value of each data packet; S2. Dynamic Threshold Adjustment: The threshold is dynamically adjusted using a Kalman filter model. The threshold is updated based on the observed rate of change of IPID in the current window. The locally smoothed IPID sequence is then filtered based on the adjusted threshold to output a refined alias set. The formula used to update the threshold is, ， in, α The dynamic learning rate controls the sensitivity of the threshold to changes in observed values. Δ k,t For the first t The actual rate of change of IPID within a window.

2. The router alias identification system as described in claim 1, characterized in that: The active probing module integrates four active probing protocols: ICMP, TCP, UDP, and SYN. ​​It performs cross-verification using multi-protocol probing packets based on a protocol utility function, where the protocol utility function is... ， in, Cp For the agreement P select Historical coverage Rp This is the protocol's resistance to jumps.

3. The router alias identification system as described in claim 1, characterized in that: The dynamic scheduling module is based on node density. ρ(Q) The recursive partitioning of the network region is a quadtree structure, when When the network region is divided into four sub-regions, the formula for calculating the node density is: ， in, N(Q) For the region Q The number of nodes, A(Q) For the region Q The area; The formula for calculating the dynamic priority is as follows: ， in, Ld(i) For the region i Geographic density, Geographic density weight, Cn(i) For nodes i The connection status parameters, For connection state weights, Lt(i) For nodes i Task load parameters, This is the task load weight.

4. The router alias identification system as described in claim 3, characterized in that: The dynamic scheduling module employs a dynamic feedback mechanism to optimize resource utilization and load balancing. Balance As a load balancing metric, when Balance Task redistribution stops when the load balancing score is ≥0.

85. The formula for calculating the load balancing score is as follows: ， in, L For node load vectors, σ2 Let V be the variance of the node load vector. μ This represents the mean of the node load vector.

5. The router alias identification system as described in claim 3, characterized in that: The dynamic scheduling module also includes a status monitoring system, which is used to collect network status data and, in the dynamic priority calculation, executes a parameter weight adjustment strategy based on the collected network status data to adjust the parameter weights. The network status data includes at least one of the following: failure node rate, regional density variation coefficient, and load balancing degree. When the failure rate is greater than 10%, increase the weight of connection status and decrease the weight of geographical density. When the regional density variation coefficient is greater than 0.5, increase the geographical density weight and decrease the task load weight. When the load balancing degree is less than 0.8, increase the task load weight and decrease the connection state weight.

6. The router alias identification system as described in claim 5, characterized in that: After adjusting the parameter weights, the changes in system performance after each adjustment are recorded. Adjustment strategies that improve performance are used more frequently, while those that reduce performance are used less frequently. System performance is quantified through a comprehensive performance score, calculated using the following formula: Overall performance score = β 1 ×efficiency factor+ β 2 ×Equilibrium Factor- β 3 × Fault factors, in, Efficiency factor = e ^(-0.5 × average task time), Balance factor = load balancing degree Fault factor = number of faulty nodes not detected. β 1 , β 2 , β 3 These are the weights corresponding to each factor.

7. The router alias identification system as described in claim 1, characterized in that, The passive data verification module verifies BGP route prefix aggregation and SNMP device information, specifically including: The formula for calculating route prefix aggregation is: ， in, P i , P j They are respectively with IP i , IP j The associated set of route prefixes; when S bgp When the value is ≥0.7, the two IP addresses are considered to have a strong correlation at the routing level and can be used as candidate alias pairs; Query the device's system name using the SNMP protocol. IP i and IP j If the system names match, the match is considered successful.

8. The router alias identification system as described in claim 1, characterized in that, In step S2, the threshold filtering rule is as follows: For candidate alias pairs ( IP i IP j If satisfied Then the determination is made. IP i and IP j An alias interface for the same router; in, for IP i The average rate of change of IPID within the corresponding window.

Images