A BGP anomaly detection method based on embedded vectors

Abstract

The application provides a BGP anomaly detection method based on embedded vectors, including the following steps: collecting BGP routing data, including BGP routing table data and BGP routing update data; constructing a dynamic BGP routing topology graph according to the collected routing data, including node attributes and edge attributes; performing direction-aware graph embedded learning; updating when the topology graph changes are perceived; and performing anomaly detection by calculating the deviation score between the original routing and the newly appeared routing. The method provided by the application is an unsupervised method, does not require labeled data, and can dynamically perceive topology changes, thereby overcoming the negative effects of BGP dynamic changes and the need for a large number of labels.

Description

Technical Field

[0001] This invention relates to the field of inter-domain anomaly detection in inter-domain routing security, specifically a BGP anomaly detection method based on embedded vectors. Background Technology

[0002] Border Gateway Protocol (BGP) is a fundamental guarantee for the interconnection of global autonomous systems. However, its initial design lacked security features, leading to frequent BGP anomalies. BGP anomalies are characterized by rapid propagation and wide-ranging impact, posing a significant threat to global inter-domain routing security. BGP anomaly detection detects anomalies through actively and passively acquired routing data and further locates suspicious routing information (prefixes, ASs, etc.), enabling operations personnel to quickly trace the source and mitigate the anomalies. However, existing methods have performance limitations in real-world deployment environments, especially supervised detection methods, primarily due to the time-varying nature of BGP traffic and the lack of accurate and effective annotation. Therefore, research is needed on BGP anomaly detection and tracing mechanisms to monitor the global BGP operational status in real time and perform source analysis to ensure inter-domain network security.

[0003] These methods typically utilize massive amounts of historical BGP routing data to analyze historical BGP routing behavior rules and patterns as prior knowledge, detecting BGP routing messages sent by the AS to effectively identify and trace BGP anomalies. However, existing anomaly detection methods still have significant room for improvement in terms of real-time performance, accuracy, and intelligence. Fundamentally, this stems from three main issues: the dynamic changes in BGP routing behavior; and the lack of annotations available for supervised learning in BGP anomaly detection tasks. Summary of the Invention

[0004] This invention proposes a BGP anomaly detection method based on embedded vectors. This method is unsupervised, requires no labeled data, and can dynamically perceive topological changes, thus overcoming the negative impacts of dynamic changes in BGP and the need for extensive labeling, thereby solving the problems mentioned in the background art. The technical solution provided by this invention is as follows:

[0005] A BGP anomaly detection method based on embedded vectors includes the following steps:

[0006] S1 collects BGP routing data, including BGP routing table data and BGP route update data;

[0007] S2, construct a dynamic BGP routing topology map based on the collected routing data, including node attributes and edge attributes;

[0008] S3 performs orientation-aware graph-embedded learning;

[0009] S4, update when a change in the topology graph is detected;

[0010] S5 performs anomaly detection by calculating the deviation score between the original route and the newly appeared route.

[0011] Preferably, S2 constructs a global routing topology based on the routing table and the business relationships between autonomous systems (AS), including node attributes and edge attributes, where the node attributes are the AS's ranking information and geographical coordinates, and the edge attributes are the business relationships between ASs.

[0012] Preferably, the specific process of S3 is as follows:

[0013] S31, Regularize the input, including node attribute X(t), edge attribute A(t), and business relationship R(t) connecting the edges;

[0014] S32 performs both vertical and horizontal encoding simultaneously. The encoder uses a graph attention network, and the network's attention score is calculated using the following formula:

[0015]

[0016] Where sRd represents the business relationship between the source node s and the destination node d, a value of 1 or -1 indicates a supplier relationship, and a value of 0 indicates an equal relationship; H s and H d W represents the input vectors of the source node and the destination node, respectively; v and W h represents the vertical and horizontal weight vectors respectively; 'a' represents the learnable attention vector; '||' represents matrix concatenation. This represents the number of neighbors k of node s in the vertical direction. This represents the number of horizontal neighbors k of node s; LeakyReLU is the activation function, and exp is the natural exponential function.

[0017] S33, the attention scores are input into the multilayer perceptron and concatenated to form the embedded vector Z of each AS:

[0018]

[0019] Among them, MLP v (·) and MLP h (·) represent multilayer perceptrons in the vertical and horizontal directions, respectively. and The vertical and horizontal outputs of the graph attention network are represented as follows:

[0020]

[0021]

[0022] In the formula, i represents the source node s, and j represents the destination node d. Represents the vertical component of the input vector. Represents the horizontal component of the input vector. For activation functions;

[0023] S34, training a direction-aware graph learning model, where the loss function L consists of two parts: the Manhattan distance loss function L0. man and triplet loss function L triplet .

[0024] Preferably, the Manhattan distance loss function L man As shown below:

[0025]

[0026]

[0027]

[0028]

[0029] In the formula, Z v Z represents the vertical component of the embedded vector; h The horizontal component of the embedded vector is represented by E, which represents the set of all edges in the graph, and margin represents the distance from the boundary.

[0030] Triple loss function L triplet As shown below: the node samples are divided into positive samples P, negative samples N, and anchor points A;

[0031]

[0032] in Indicates the boundary distance.

[0033] Preferably, the specific process of S4 is as follows:

[0034] S41, calculate S c When S c If the value exceeds a preset threshold, it is determined that the topology has changed, and S42 is executed:

[0035]

[0036] Where D represents the degree matrix of the graph, and L represents the Laplacian matrix of the graph;

[0037] S42, Use a graph attention network to infer the business relationships of AS:

[0038]

[0039] In the formula, GAT is the graph attention mechanism of S3, X represents the node attribute, N represents the number of nodes, b represents the number of hidden layer attributes of the graph attention network, and O represents the final inference for edge (s,d).

[0040] Preferably, the deviation score d(r1,r2) between the original route r1 and the newly appeared route r2 is expressed as follows:

[0041]

[0042] i is the i-th AS node on the r1 and r2 routes. When the deviation score is greater than the preset threshold, it is judged as abnormal; otherwise, it is normal.

[0043] Compared with the prior art, the beneficial effects achieved by the present invention are:

[0044] First, this method does not require tag data; it only requires business relationships between ASs during initialization.

[0045] Second, this method is applicable to the entire BGP network and can perceive the horizontal and vertical positions of each AS based on routing business relationships and geographical location information such as country.

[0046] Third, this method can sense dynamically changing topology and retrain after the changes exceed a certain threshold. Attached Figure Description

[0047] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0048] Figure 1 This is the main flowchart of the anomaly detection method proposed in this invention;

[0049] Figure 2 This is a flowchart of the orientation-aware graph-embedded learning method proposed in this invention;

[0050] Figure 3 This is the AS distribution diagram of the simulation results in this embodiment of the invention. Detailed Implementation

[0051] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0052] To make the above-mentioned objectives, features and effects of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0053] Example 1: A BGP anomaly detection method based on embedded vectors, comprising the following steps:

[0054] S1 collects BGP routing data based on global collection points, which includes BGP routing table data and BGP route update data.

[0055] S2 constructs a dynamic BGP routing topology based on the collected routing data. Specifically, it constructs a global routing topology based on the routing table and the business relationships between Autonomous Systems (AS), including node attributes and edge attributes. The node attributes are the AS's ranking information and geographical coordinates, while the edge attributes are the business relationships between ASs.

[0056] S3 performs orientation-aware graph-embedded learning, the specific process of which is as follows:

[0057] S31. Regularize the input, which includes node attribute X(t), edge attribute A(t), and business relationship R(t) connecting the edges.

[0058] S32 performs both vertical and horizontal encoding simultaneously. The encoder uses a graph attention network, and the network's attention score is calculated using the following formula:

[0059]

[0060] Where sRd represents the business relationship between the source node s and the destination node d, a value of 1 or -1 indicates a supplier relationship, and a value of 0 indicates an equal relationship; H s and H d W represents the input vectors of the source node and the destination node, respectively; v and W h represents the vertical and horizontal weight vectors respectively; 'a' represents the learnable attention vector; '||' represents matrix concatenation. This represents the number of neighbors k of node s in the vertical direction. This represents the number of horizontal neighbors k of node s; LeakyReLU is the activation function, and exp is the natural exponential function.

[0061] S33, the attention scores are input into the multilayer perceptron and concatenated to form the embedded vector Z of each AS:

[0062]

[0063] Among them, MLP v (·) and MLP h(·) represent multilayer perceptrons in the vertical and horizontal directions, respectively. and This represents the vertical and horizontal outputs of the graph attention network, i.e.:

[0064]

[0065]

[0066] In the formula, i represents the source node s, and j represents the destination node d. Represents the vertical component of the input vector. Represents the horizontal component of the input vector. This is the activation function.

[0067] S34, training a direction-aware graph learning model, where the loss function L consists of two parts: the Manhattan distance loss function L0. man and triplet loss function L triplet .

[0068] Manhattan distance loss function L man As shown below:

[0069]

[0070]

[0071]

[0072]

[0073] In the formula, Z v Z represents the vertical component of the embedded vector; h The horizontal component of the embedded vector is represented by E, which represents the set of all edges in the graph, and margin represents the distance from the boundary.

[0074] Triple loss function L triplet As shown below: the node samples are divided into positive samples P, negative samples N, and anchor points A;

[0075]

[0076] in Indicates the boundary distance.

[0077] S4, Model Update, the specific process is as follows:

[0078] S41, by calculating S c To sense changes in graph topology, once the topology changes significantly (i.e., S... c If the value is greater than a certain threshold, then proceed to step S42:

[0079]

[0080] Where D represents the degree matrix of the graph, and L represents the Laplacian matrix of the graph.

[0081] S42, changes in topology introduce new AS connection edges, thus requiring the determination of business relationships between these ASs. A graph attention network is used to infer these business relationships.

[0082]

[0083] In the formula, GAT is the graph attention mechanism of S3, X represents the node attribute, N represents the number of nodes, b represents the number of hidden layer attributes of the graph attention network, and O represents the final inference for edge (s,d).

[0084] S5, Anomaly Detection. Anomalies are detected by calculating the deviation score d(r1,r2) between the original route r1 and the newly appeared route r2.

[0085]

[0086] i is the i-th AS node on the r1 and r2 routes. When the deviation score is greater than the preset threshold, it is judged as abnormal; otherwise, it is normal.

[0087] To evaluate the effectiveness of the BGP anomaly detection method based on embedded vectors on real-world global data, this invention visualizes the embedded vectors of each node and analyzes whether the AS (Anomaly Detector) positions meet expectations. The simulation platform is Python 3.10 software under Linux (the analysis results of this invention are not affected by the operating system or Python software version). Furthermore, the geographical location and ranking information of the ASs are obtained from authoritative official data from Caida.

[0088] Figure 2 The diagram illustrates the framework of the proposed method. The inputs to the method are X(t), A(t), and R(t), representing the node attribute X(t), adjacency matrix A(t), and business relationship matrix R(t) at time t, respectively. The order of matrix X(t) is n×m, matrix A(t) is n×n, matrix R(t) is n×n, and matrix R(t) is n×2h, where n represents the number of nodes, m represents the dimension of the node attributes, and h represents the dimension of the hidden layer.

[0089] from Figure 3 As can be seen, the embedded vectors of each AS are projected into two-dimensional space. Among them, the red triangles represent the embedded vector positions of Tier-1 AS, which are at the highest vertical position, as expected.

[0090] Example 2: The computer-readable storage medium of this example stores a computer program that, when executed by a processor, implements the steps of the BGP anomaly detection method based on embedded vectors in Example 1.

[0091] The computer-readable storage medium in this embodiment can be an internal storage unit of the terminal, such as the terminal's hard disk or memory; the computer-readable storage medium in this embodiment can also be an external storage device of the terminal, such as a plug-in hard disk, smart memory card, secure digital card, flash memory card, etc. equipped on the terminal; furthermore, the computer-readable storage medium can include both the terminal's internal storage unit and external storage devices.

[0092] The computer-readable storage medium of this embodiment is used to store computer programs and other programs and data required by the terminal. The computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0093] Example 3: The computer device of this example includes a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps of the BGP anomaly detection method based on embedded vectors in Example 1.

[0094] In this embodiment, the processor can be a central processing unit, or other general-purpose processors, digital signal processors, application-specific integrated circuits, off-the-shelf programmable gate arrays or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc. The memory can include read-only memory and random access memory, and provides instructions and data to the processor. A portion of the memory can also include non-volatile random access memory. For example, the memory can also store device type information.

[0095] Those skilled in the art will clearly understand that each implementation can be achieved using software plus the necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0096] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A BGP anomaly detection method based on embedded vectors, characterized in that, Includes the following steps: S1 collects BGP routing data, including BGP routing table data and BGP route update data; S2, construct a dynamic BGP routing topology map based on the collected routing data, including node attributes and edge attributes; S3 performs orientation-aware graph-embedded learning, the specific process of which is as follows: S31, Regularize the input, including node attribute X(t), edge attribute A(t), and business relationship R(t) connecting the edges; S32 performs both vertical and horizontal encoding simultaneously. The encoder uses a graph attention network, and the network's attention score is calculated using the following formula: ； Where sRd represents the business relationship between the source node s and the destination node d, a value of 1 or -1 indicates a supplier relationship, and a value of 0 indicates an equal relationship; H s and H d W represents the input vectors of the source node and the destination node, respectively; v and W h represents the vertical and horizontal weight vectors respectively; 'a' represents the learnable attention vector; '||' represents matrix concatenation. This represents the number of neighbors k of node s in the vertical direction; This represents the number of horizontal neighbors k of node s; LeakyReLU is the activation function, and exp is the natural exponential function. S33, the attention scores are input into the multilayer perceptron and concatenated to form the embedded vector Z of each AS: ； Among them, MLP v (·) and MLP h (·) represent multilayer perceptrons in the vertical and horizontal directions, respectively. and The vertical and horizontal outputs of the graph attention network are represented as follows: ； ； In the formula, i represents the source node s, and j represents the destination node d. Represents the vertical component of the input vector. Represents the horizontal component of the input vector. For activation functions; S34, training a direction-aware graph learning model, where the loss function L consists of two parts: the Manhattan distance loss function L0. man and triplet loss function L triplet ; S4, update when a change in the topology graph is detected; S5 performs anomaly detection by calculating the deviation score between the original route and the newly appeared route.

2. The BGP anomaly detection method based on embedded vectors according to claim 1, characterized in that, S2 constructs a global routing topology based on the routing table and the business relationships between Autonomous Systems (AS), which includes node attributes and edge attributes. The node attributes are the AS's ranking information and geographical coordinates, while the edge attributes are the business relationships between ASs.

3. The BGP anomaly detection method based on embedded vectors according to claim 2, characterized in that, Manhattan distance loss function L man As shown below: ； ； ； ； In the formula, Z v Z represents the vertical component of the embedded vector; h The horizontal component of the embedded vector is represented by E, which represents the set of all edges in the graph, and margin represents the distance from the boundary. Triple loss function L triplet As shown below: the node samples are divided into positive samples P, negative samples N, and anchor points A; ； in Indicates the boundary distance.

4. The BGP anomaly detection method based on embedded vectors according to claim 2, characterized in that, The specific process of S4 is as follows: S41, calculate S c When S c If the value exceeds a preset threshold, it is determined that the topology has changed, and S42 is executed: ； Where D represents the degree matrix of the graph, and L represents the Laplacian matrix of the graph; S42, Use a graph attention network to infer the business relationships of AS: ； In the formula, GAT is the graph attention mechanism of S3, X represents the node attribute, N represents the number of nodes, b represents the number of hidden layer attributes of the graph attention network, and O represents the final inference for edge (s,d).

5. The BGP anomaly detection method based on embedded vectors according to claim 4, characterized in that, The deviation score d(r1,r2) between the original route r1 and the newly appeared route r2 is expressed as follows: ； i is the i-th AS node on the r1 and r2 routes. When the deviation score is greater than the preset threshold, it is judged as abnormal; otherwise, it is normal.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the BGP anomaly detection method based on embedded vectors as described in any one of claims 1-5.

7. A computer device comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the BGP anomaly detection method based on embedded vectors as described in any one of claims 1-5.

Images