Inter-domain routing message data feature extraction method and device

Abstract

The invention discloses an inter-domain routing message data feature extraction method and device, and the method comprises the steps: loading a routing snapshot, updating a dump file, and constructing a global real-time routing table, an autonomous system routing prefix table and a routing prefix autonomous system mapping table; establishing and updating an autonomous system country mapping table based on AS number distribution data and IP prefix country affiliation information, and excluding ASs of which registration places are inconsistent with operation places; processing route update data in a bucket manner according to a fixed time interval, and extracting route change characteristics of a prefix level and an autonomous system level; and aggregating to generate national granularity features, constructing a national routing topological graph, and extracting graph structure features such as node number and diameter. Through a three-level granularity feature extraction and hierarchical convergence strategy, cross-domain noise is effectively isolated, feature stability and interpretability are improved, accurate and hierarchical input features are provided for machine learning detection of BGP abnormal events, and the method is suitable for routing anomaly monitoring and analysis in the network space security field.

Description

Technical Field

[0001] This invention belongs to the field of cyberspace security technology, specifically relating to a method and apparatus for extracting features from inter-domain routing message data. Background Technology

[0002] Border Gateway Protocol (BGP), as the core protocol for inter-domain routing on the Internet, is responsible for exchanging route reachability information between Autonomous Systems (AS). However, its design lacks built-in security verification mechanisms, leading to frequent occurrences of abnormal events such as route hijacking, route leakage, and route interruption.

[0003] Current BGP anomaly detection relies heavily on feature engineering, but existing methods have significant drawbacks:

[0004] Limited granularity and insufficient localization capability: Most methods rely on converged features of observation points (VPs), which can only identify wide-area anomalies but cannot pinpoint specific anomaly sources or affected areas. For example, when local routing fluctuations occur simultaneously in multiple countries, global features can mask regional differences, leading to misjudgments.

[0005] Severe noise interference: There are a large number of Action Servers (AS) on the Internet, and some ASs are registered in a location different from their actual operating location. Traditional methods do not distinguish the actual operating location of ASs, including ASs with inconsistent registration and operating locations in the same country feature calculation, introducing a large amount of cross-domain noise and reducing the accuracy of the detection model.

[0006] Topology features are missing: Existing technologies focus primarily on traffic statistics and path length, lacking characterization of national-level routing topology. For example, they fail to extract key indicators such as the number of interconnected borders between countries, the diameter of AS connection graphs within a country, and connectivity, making it difficult to reflect the dynamic changes in network structure. Summary of the Invention

[0007] In view of this, the purpose of this invention is to provide a method and apparatus for extracting features from inter-domain routing message data, so as to solve or partially solve the problems mentioned in the background art.

[0008] To achieve the above objectives, in a first aspect, the present invention provides a method for extracting features from inter-domain routing message data, comprising the following steps:

[0009] Data layer construction: Load route snapshot dump files and route update dump files, and construct the global real-time routing table, autonomous system route prefix table, and route prefix autonomous system mapping table;

[0010] Mapping layer calibration: Based on autonomous system number allocation data and IP prefix country affiliation information, establish an autonomous system country mapping table to exclude autonomous systems whose registration location and operation location are inconsistent;

[0011] Feature layer extraction: Construct a routing feature dictionary at three levels of routing prefix, autonomous system, and country. Bucket the routing update data at a fixed time interval T, and extract the routing change features at the routing prefix level and autonomous system level;

[0012] Aggregation layer modeling: Based on the autonomous system-country mapping table, aggregate and generate routing change features at the country level, construct a national-level routing topology graph and extract the topology graph features. The topology graph features include the number of nodes, diameter, and natural connectivity.

[0013] As an optimal solution for the method of extracting inter-domain routing message data features, the steps of constructing the data layer specifically include:

[0014] Parse the message records in the routing snapshot dump file. The message record format is <protocol type, timestamp, peer IP address, VPAS number, routing prefix, AS path, message origin, next hop>, and extract the routing prefix, VPAS number, and AS path;

[0015] Establish a two-dimensional dictionary of the global real-time routing table: Use the routing prefix as the first-dimensional key, the VPAS number as the second-dimensional key, and the corresponding value as the AS path. The AS path is the list of ASs from the AS of the VP observation point to the target prefix;

[0016] Establish a one-dimensional dictionary of the autonomous system routing prefix table: Extract the last AS in the AS path as the source AS, and use the source AS as the key, and the value is the set of routing prefixes announced by the source AS;

[0017] Establish a one-dimensional dictionary of the routing prefix-autonomous system mapping table: Use the routing prefix as the key, and the value is the source AS that announces this prefix.

[0018] As an optimal solution for the method of extracting inter-domain routing message data features, the steps of mapping layer calibration specifically include:

[0019] Obtain the initial allocation relationship of <AS number, country> and the allocation relationship of <IP prefix, country> from the public Internet number allocation database;

[0020] Traverse each AS number in the autonomous system routing prefix table. If there is a set of routing prefixes announced by this AS, then for each routing prefix:

[0021] Randomly select an IP address from this routing prefix, query the IP prefix-country mapping table, and obtain the country to which this IP belongs as the country where the operation location of the routing prefix is located;

[0022] Count the country that appears most frequently in the set of countries where the operation locations corresponding to all routing prefixes of this AS are located, and update the country corresponding to this AS in the autonomous system-country mapping table to this country where the operation location is located.

[0023] As a preferred method for feature extraction of inter-domain routing message data, the specific steps of feature layer extraction include:

[0024] Construct a route prefix feature dictionary: the route prefix is ​​the first dimension key, the timestamp is the second dimension key, and the route feature is the third dimension key, including the number of announcement messages and the number of rollback messages;

[0025] Construct an autonomous system routing feature dictionary: the autonomous system number is the first dimension key, the timestamp is the second dimension key, and the autonomous system routing feature is the third dimension key, including the number of all prefix announcement messages and the number of all prefix rollback messages;

[0026] The message records in the route update dump file are time-divided into buckets at fixed intervals T, and the current route feature timestamp is calculated. In the formula, t0 is the time when the first route update dump file was generated, and t1 is the timestamp of the current packet;

[0027] If it is a route advertisement message:

[0028] Update the AS path corresponding to the route prefix and VPAS number in the global real-time routing table;

[0029] The number of announcement messages for the corresponding route prefix in the route prefix feature dictionary is increased by 1;

[0030] The source AS is obtained based on the routing prefix autonomous system mapping table, and the number of advertisement messages for the corresponding AS in the autonomous system routing feature dictionary is increased by 1;

[0031] If it is a route rollback message:

[0032] Delete the record containing the corresponding route prefix and VPAS number from the global real-time routing table;

[0033] If the VPAS number record corresponding to the route prefix is ​​empty, then delete the VPAS record;

[0034] The number of rollback packets corresponding to the route prefix in the route prefix feature dictionary is increased by 1;

[0035] The source AS is obtained based on the autonomous system mapping table of the routing prefix, and the number of rollback packets corresponding to the AS in the autonomous system routing feature dictionary is increased by 1.

[0036] As a preferred method for extracting features from inter-domain routing message data, the specific steps of aggregation layer modeling include:

[0037] Construct a national routing feature dictionary: the first key is the country name, the second key is the timestamp, and the third key is the national routing feature. The national routing features include the number of national prefix announcement messages, the number of national prefix rollback messages, the number of external peers of the country, the number of national border paths, the number of ASs, the diameter of the graph, and natural connectivity.

[0038] Traverse the AS path P = [AS1, AS2, ..., ASn] in the global real-time routing table, and for adjacent AS pairs (AS... i AS i+1 ):

[0039] Query the country mapping table of the autonomous system to obtain the corresponding country C. i and C i+1 ;

[0040] If C i ≠C i+1 This is considered a cross-border BGP path, and C is added. i With C i+1 The number of interconnected boundaries, and recorded as external peers to each other;

[0041] If C i =C i+1 Then store the AS pair into C. i A set of internal AS connections within a country, used to construct the country's internal topology graph;

[0042] Based on the set of AS connections within a country, a topological graph is constructed with ASs as nodes and the number of paths as edge weights. The number of ASs, the diameter of the graph, and the natural connectivity are calculated.

[0043] Secondly, the present invention provides an inter-domain routing message data feature extraction device, comprising:

[0044] The data loading module is used to load route snapshot dump files and route update dump files, and to build a global real-time routing table, an autonomous system route prefix table, and a route prefix autonomous system mapping table.

[0045] The mapping table construction module is used to build an autonomous system country mapping table based on autonomous system number allocation data and IP prefix country affiliation information, excluding autonomous systems whose registration location and operation location are inconsistent;

[0046] The feature extraction module is used to construct a routing feature dictionary with three levels of granularity: routing prefix, autonomous system, and country. It divides the routing update data into buckets at fixed time intervals T and extracts routing change features at the routing prefix level and autonomous system level.

[0047] The feature aggregation module is used to aggregate routing change features at the national level based on the autonomous system's national mapping table, construct a national-level routing topology map, and extract topology map features, including the number of nodes, diameter, and natural connectivity.

[0048] As a preferred embodiment of the inter-domain routing message data feature extraction device, the data loading module includes:

[0049] A routing snapshot parsing unit, which is used to parse the message records of the routing snapshot dump file. The message record format is <protocol type, timestamp, peer IP address, VPAS number, routing prefix, AS path, message origin, next hop>, and extract the routing prefix, VPAS number, and AS path;

[0050] A two-dimensional dictionary building unit, which is used to build a two-dimensional dictionary of the global real-time routing table: using the routing prefix as the first-dimensional key, the VPAS number as the second-dimensional key, the corresponding value as the AS path, and the AS path as the AS list from the AS of the VP observation point to the target prefix;

[0051] A one-dimensional dictionary building unit for the prefix table, which is used to build a one-dimensional dictionary of the autonomous system routing prefix table: extract the last AS in the AS path as the source AS, and use the source AS as the key, and the value is the set of routing prefixes announced by the source AS;

[0052] A one-dimensional dictionary building unit for the mapping table, which builds a one-dimensional dictionary of the routing prefix-autonomous system mapping table: using the routing prefix as the key, and the value is the source AS that announces the prefix.

[0053] As a preferred solution of the inter-domain routing message data feature extraction device, the mapping table building module includes:

[0054] An initial data acquisition unit, which is used to obtain the initial allocation relationship of <AS number, country> and the allocation relationship of <IP prefix, country> from the public Internet number assignment database;

[0055] An operating location statistics unit, which is used to randomly select an IP address from each routing prefix, query the IP prefix-country mapping table, and obtain the country to which the IP belongs as the country where the operating location of the routing prefix is located;

[0056] A mapping table update unit, which is used to count the country that appears most frequently in the set of countries where the operating locations corresponding to all routing prefixes of the specified AS are located, and update the country corresponding to the specified AS in the autonomous system-country mapping table to this operating location country.

[0057] As a preferred solution of the inter-domain routing message data feature extraction device, the feature extraction module includes:

[0058] A feature dictionary maintenance unit:

[0059] It is used to build a routing prefix feature dictionary: the routing prefix is the first-dimensional key, the timestamp is the second-dimensional key, and the routing feature is the third-dimensional key, including the number of announcement messages and the number of withdrawal messages;

[0060] It is also used to build an autonomous system routing feature dictionary: the autonomous system number is the first-dimensional key, the timestamp is the second-dimensional key, and the autonomous system routing feature is the third-dimensional key, including the number of all prefix announcement messages and the number of all prefix withdrawal messages;

[0061] The time-bucketing calculation unit is used to perform time-bucketing on the message records in the route update dump file at fixed intervals T, and calculate the current route feature timestamp. In the formula, t0 is the time when the first route update dump file was generated, and t1 is the timestamp of the current packet;

[0062] If it is a route advertisement message:

[0063] Update the AS path corresponding to the route prefix and VPAS number in the global real-time routing table;

[0064] The number of announcement messages for the corresponding route prefix in the route prefix feature dictionary is increased by 1;

[0065] The source AS is obtained based on the routing prefix autonomous system mapping table, and the number of advertisement messages for the corresponding AS in the autonomous system routing feature dictionary is increased by 1;

[0066] If it is a route rollback message:

[0067] Delete the record containing the corresponding route prefix and VPAS number from the global real-time routing table;

[0068] If the VPAS number record corresponding to the route prefix is ​​empty, then delete the VPAS record;

[0069] The number of rollback packets corresponding to the route prefix in the route prefix feature dictionary is increased by 1;

[0070] The source AS is obtained based on the autonomous system mapping table of the routing prefix, and the number of rollback packets corresponding to the AS in the autonomous system routing feature dictionary is increased by 1.

[0071] As a preferred embodiment of the inter-domain routing message data feature extraction device, the feature aggregation module includes:

[0072] A cross-border feature statistics unit is used to construct a national routing feature dictionary: the first key is the country name, the second key is the timestamp, and the third key is the national routing feature. The national routing feature includes the number of national prefix declaration messages, the number of national prefix withdrawal messages, the number of external peers of the country, the number of national border paths, the number of ASs, the diameter of the graph, and natural connectivity.

[0073] The graph feature analysis unit is used to traverse the AS path P = [AS1, AS2, ..., ASn] in the global real-time routing table and analyze adjacent AS pairs (AS... i AS i+1 ):

[0074] Query the country mapping table of the autonomous system to obtain the corresponding country C. i and C i+1 ;

[0075] If C i ≠C i+1 This is considered a cross-border BGP path, and C is added. i With C i+1 The number of interconnected boundaries, and recorded as external peers to each other;

[0076] If C i =C i+1 Then store the AS pair into C. i A set of internal AS connections within a country, used to construct the country's internal topology graph;

[0077] Based on the set of AS connections within a country, a topological graph is constructed with ASs as nodes and the number of paths as edge weights. The number of ASs, the diameter of the graph, and the natural connectivity are calculated.

[0078] Thirdly, the present invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the inter-domain routing message data feature extraction method of the first aspect or any possible implementation thereof.

[0079] Fourthly, the present invention provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to perform steps in the inter-domain routing message data feature extraction method of the first aspect or any possible implementation thereof.

[0080] The beneficial effects of the technical solution provided by this invention are as follows:

[0081] First, we construct three-level granular features: routing prefixes, autonomous systems, and countries. These features converge layer by layer from micro-level routing changes to macro-level national network structures. This approach preserves fine-grained details of routing dynamics (such as the frequency of declarations / withdrawals of individual prefixes) while capturing national-level network behavior trends (such as the overall routing stability of a country). This provides a more comprehensive input dimension for machine learning models and significantly improves the accuracy and robustness of anomaly detection.

[0082] Second, by using IP prefix attribution statistics to determine the actual operating country of the AS, ASs with inconsistent registration and operating locations are eliminated. This ensures that the country-level features only include network entity data that truly belongs to that country, effectively isolating cross-domain noise, avoiding feature bias caused by misjudgment of AS attribution, and improving feature stability.

[0083] Third, a national-level BGP topology map is constructed based on real-time routing tables, and graph structure features are extracted. This makes up for the shortcomings of existing technologies that rely solely on traffic statistics and path length. It can reveal the potential patterns of abnormal events from the perspective of network topology evolution and enhance the interpretability of the detection model.

[0084] Fourth, a "divide and conquer" hierarchical aggregation strategy is adopted, dividing the global internet into management units with national boundaries to achieve distributed computation and aggregation of features. Compared with traditional global feature computation methods, this strategy can significantly reduce computational complexity, while supporting rapid location for national-level cybersecurity management. For example, when anomalies occur, the country or region with sudden feature mutations can be directly identified, improving emergency response efficiency.

[0085] Fifth, the generated multi-granularity features are not only applicable to BGP anomaly detection, but also support scenarios such as network topology visualization, analysis of inter-country interconnection relationships, and regional network stability assessment. For example, the national routing feature dictionary can monitor the network health status of various countries in real time, providing data support for internet governance and cross-border network collaborative defense. Attached Figure Description

[0086] To more clearly illustrate the technical solutions in this invention or related technologies, the drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are only embodiments of this invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0087] Figure 1 This is a flowchart of the method for extracting features from inter-domain routing message data provided in an embodiment of the present invention;

[0088] Figure 2 This invention provides a technical roadmap for obtaining the actual operating location of an AS (Automatic System).

[0089] Figure 3 A flowchart illustrating the construction of routing time feature sequences provided in an embodiment of the present invention;

[0090] Figure 4 This is an architecture diagram of the inter-domain routing message data feature extraction device provided in an embodiment of the present invention;

[0091] Figure 5 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0092] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

[0093] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this invention should have the ordinary meaning understood by those skilled in the art to which this invention pertains. The terms "comprising" or "including," or similar words used in the embodiments of this invention, mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects.

[0094] As is well known, the Internet consists of thousands of independent and autonomous systems. Each Autonomous System (AS) is a collection of Internet Protocol (IP) routing prefixes connected under the control of one or more organizations representing a single administrative entity or domain that provides a common, well-defined routing policy. Each AS is assigned a globally unique number called its Autonomous System Number (ASN).

[0095] The Internet Assigned Numbers Authority (IANA) is a standards organization responsible for overseeing the global allocation of IP addresses and Autonomous System Numbers (ASNs). The Internet Corporation for Assigned Names and Numbers (ICANN) is a non-profit international organization that performs the functions of IANA. Regional Internet Registries (RIRs) are organizations that manage the allocation and registration of Internet number resources within a specific region of the world. ICANN allocates a large amount of Internet number resources (IPv4, IPv6, ASNs) to five regional Internet Registries (RIRs) across five continents: AFRINIC (Africa), APNIC (Asia Pacific), ARIN (North America), LACNIC (Latin America), and RIPE NCC (Europe).

[0096] ASNs are allocated by ICANN to RIRs in blocks. The appropriate RIR then distributes the ASN from the allocated blocks to entities within its designated area. This area can be a country or a regional political alliance. Network entities wishing to obtain an ASN must complete an application process with their RIR, LIR (Local Internet Registry), or upstream service provider. Autonomous System Number (ASN) resources reflect, to some extent, the network structure and interconnectivity capabilities of a region or even an organization. Each RIR manages detailed information about ASN resources within its respective service area. Each ASN belongs to a specific organization and is uniquely associated with a specific country.

[0097] In related technologies, the Border Gateway Protocol (BGP) is a standard inter-domain routing protocol used for exchanging routing information between Autonomous Systems (AS). This protocol employs a path vector mechanism, guiding the transmission paths of data packets on the Internet by exchanging route reachability information between edge routers. BGP executes routing decisions based on path information, network policies, and the routing rule set set by network administrators, and is widely used for interconnecting autonomous systems.

[0098] Once network entities (such as Internet service providers, content delivery network providers, large technology companies, educational or government agencies) obtain Autonomous System Numbers (ASNs) and corresponding IP address resources, they can deploy edge routing devices that support the BGP protocol to publish and receive route reachability information, thereby guiding data forwarding on the Internet. BGP route advertisements contain path information through which to the target network passes through the corresponding Autonomous Systems, enabling other networks to identify feasible paths to that target network.

[0099] In actual operation, some network entities, due to cross-border business or other reasons, have discrepancies between their ASN registration location and the actual network deployment and operation location. This article defines this phenomenon as "inconsistency between the registration location and operation location of the Autonomous System Number".

[0100] In related technologies, the BGP protocol, due to its initial design not adequately considering security, has exposed a series of security vulnerabilities in actual operation, and some key issues remain unresolved. For example, the BGP protocol lacks a mechanism to verify the authenticity of routing information advertised by neighbors. The content of route advertisements cannot be verified, leading to the unconditional acceptance and propagation of erroneous or malicious routing information in the network. Once an erroneous route is adopted, it can cause serious consequences such as packets being forwarded along incorrect paths, network service interruptions, and path redirections, significantly impacting upper-layer applications and potentially triggering serious network security incidents.

[0101] Routing outage events refer to routing anomalies caused by unforeseen circumstances such as power outages, equipment overloads, or natural disasters affecting BGP backbone routing equipment, resulting in BGP session disconnections, or by network attacks, manual configuration errors, or intentional human intervention, causing the source autonomous system prefix to be pulled back, leading to unreachable routes to the destination prefix. Based on the changing patterns of routing prefixes and their path attributes in routing messages, current research typically categorizes inter-domain routing anomalies into the following three main types:

[0102] Route hijacking refers to an Autonomous System (AS) maliciously declaring an IP prefix that it does not own, or forging path information that can reach that prefix. Because BGP lacks a path authenticity verification mechanism, this erroneous path may be trusted and accepted by other ASs, leading to global routing convergence to the incorrect path. Hijacked traffic may ultimately be received by an incorrect AS and used for activities such as traffic eavesdropping, traffic dropping (black holes), or illegal relaying, exhibiting significant stealth and harmfulness.

[0103] Route leakage refers to the forwarding of route advertisements that should have been propagated within a limited scope to unsuspecting third-party ASs, resulting in route propagation beyond the expected range. This behavior typically violates BGP's "valley-free" rule and can lead to various security risks, such as abnormal data return paths, path loops, and the formation of unexpected forwarding paths, which can result in traffic hijacking, forwarding failures, or passive eavesdropping.

[0104] Route Outage: This refers to an abnormal event where the target prefix becomes unreachable due to a sudden rollback of the route prefix. Outages can be caused by physical layer reasons (such as equipment failure, power outage, natural disasters), network attacks (such as BGP Flood, reflection attacks), configuration errors, or malicious human actions, resulting in the breakage of BGP adjacency sessions or the removal of prefixes, which seriously affects the reachability and stability of upper-layer services.

[0105] In related technologies, BGP packets contain rich path information and routing state information, which are crucial for constructing the global internet routing topology, monitoring routing state changes, and implementing routing anomaly detection and analysis. Currently, the mainstream method for collecting BGP routing packets is primarily passive collection, that is, obtaining BGP routing data from the actual operating network by deploying routing packet collectors.

[0106] Passive routing packet collection methods typically involve constructing a simulated router (e.g., based on routing protocol simulation software like Quagga) and establishing peering connections with one or more actual running BGP routers, known as Vantage Points (VPs). Each collector can simultaneously establish BGP peering sessions with multiple VPs, thereby receiving routing advertisement information from different network locations and performing unified parsing and archiving. The BGP route update process is essentially a path adjustment process triggered by the protocol's operation, through which the collector can obtain path information to globally reachable prefixes via each VP.

[0107] During the data collection process, the collector maintains the session state and routing data structure for each VPN, and dumps the collected information in the form of periodic snapshots (Bviews) and incremental updates (Updates). Route snapshot dumps record the complete BGP routing table state at each point in time, typically stored at a granularity of 2 to 8 hours, used to analyze the phased changes in the overall network routing state. Route update dumps record BGP update interactions between the VPN and the collector at a higher frequency (e.g., every 5 minutes), including prefix advertisements and withdrawal information, thus providing a continuous observation view of dynamic routing changes.

[0108] Each record in a route snapshot dump typically contains the following fields: protocol type, timestamp, entry type, peer IP address, peer AS number (i.e., the VP's AS number), destination route prefix, AS path, message origin type, and next-hop information. The AS path represents the sequence of AS numbers traversed from the VP to the destination prefix. The message origin field is generally IGP or EGP, indicating whether the advertisement originated from within or outside the AS, respectively.

[0109] The update dump file consists of message records, which are of two types: route rollback messages, with a record format of <protocol type, timestamp, entry type, peer IP address, VP AS number, route prefix>, and route advertisement messages, with a record format of <protocol type, timestamp, entry type, peer IP address, VP AS number, route prefix, AS path, message origin, and next hop>. The VP AS number is the AS number of the VP observation point, the prefix is ​​the target route prefix, and the AS path is a list of ASs traversed from the VP observation point AS to the target prefix. These messages collectively constitute the dynamic behavioral data of the BGP routing system during operation, supporting near real-time network status monitoring, anomaly detection, and topology change analysis, among other application scenarios.

[0110] In related technologies, the Border Gateway Protocol (BGP), as the backbone inter-domain routing protocol of the current Internet, primarily functions to exchange network reachability information between different autonomous systems, thereby enabling network-wide routing decisions and data forwarding. The BGP routing system continuously receives route announcements and withdrawals from around the world. Under normal operating conditions, the frequency and number of these route updates remain relatively stable. However, when abnormal events occur in the network (such as link failures, configuration errors, or attacks), it may trigger large-scale path recalculation and cascading path exploration, causing drastic fluctuations in path information within the routing system. This, in turn, leads to a sharp increase in the number of route update and withdrawal messages, resulting in routing instability.

[0111] To address the aforementioned issues, various BGP anomaly detection methods have been proposed in existing technologies. These methods primarily identify deviations from normal behavior by analyzing the time-series characteristics of routing messages. Existing research indicates that extractable features from BGP messages can be broadly categorized into three types: First, traffic-related features, which mainly statistically analyze changes in the quantity of various BGP messages (such as announcements, withdrawals, and duplicate announcements), directly reflecting network state fluctuations; second, AS path-related features, which reveal abnormal path behavior by analyzing indicators such as changes in path length and the frequency of rare ASes within a path; and third, graph structure features, which characterize network structure changes from the perspective of topology formed between autonomous systems, such as concentration, connectivity, and edge stability.

[0112] However, existing technologies still have several limitations in routing feature extraction. On the one hand, most methods rely on BGP observation points for convergent analysis of routing behavior. While this approach is suitable for identifying large-scale anomalies over a wide area, it struggles to effectively pinpoint specific anomaly sources or affected areas. On the other hand, given the vast number and complex structure of autonomous systems on the Internet, and the fact that multiple local events may occur simultaneously in different geographical regions, traditional feature extraction methods, without distinguishing between geographical affiliation and actual AS operational relationships, easily introduce a large amount of irrelevant noise, leading to a decline in detection model performance and affecting the accuracy and real-time performance of anomaly detection.

[0113] In view of this, and to address the aforementioned problems, this invention proposes a method and apparatus for extracting features from inter-domain routing message data. By constructing a global real-time routing table, routing change features at different levels are systematically extracted and aggregated, providing accurate and hierarchical input features for the BGP anomaly detection model. Specifically, firstly, based on BGP routing message data collected from routing observation points, a global real-time routing table is constructed to record the path changes from each routing observation point (Vantage Point, VP) to the target routing prefix, extracting routing dynamic features at the routing prefix granularity. Subsequently, based on the Autonomous System (AS) information to which the routing prefix belongs, the routing prefix-level features are aggregated to generate routing change features at the AS granularity. Further, combining the AS registration information and the geographical location of its declared prefix, after eliminating ASs whose registration location and actual operating location are inconsistent, the AS features are aggregated according to the country granularity to construct country-level routing change features. Simultaneously, based on the real-time routing table, a cross-border BGP connection topology map is constructed at the country level, extracting network topology features related to the graph structure. Ultimately, this method outputs routing features at multiple granularities, including prefix-level, autonomous system-level, and nation-level features, which serve as input to a machine learning model for efficient and accurate BGP anomaly detection. The following are the specific details of an embodiment of this invention.

[0114] See Figure 1This invention provides a method for extracting features from inter-domain routing message data, comprising the following steps:

[0115] S1. Data Layer Construction: Load route snapshot dump files and route update dump files, and construct the global real-time routing table, autonomous system route prefix table, and route prefix autonomous system mapping table;

[0116] S2. Mapping Layer Calibration: Based on the autonomous system number allocation data and IP prefix country affiliation information, establish an autonomous system country mapping table to exclude autonomous systems whose registration location and operation location are inconsistent;

[0117] S3. Feature layer extraction: Construct a routing feature dictionary with three levels of granularity: routing prefix, autonomous system, and country. Divide the routing update data into buckets at fixed time intervals T and extract routing change features at the routing prefix level and autonomous system level.

[0118] S4. Aggregation Layer Modeling: Based on the autonomous system country mapping table, aggregate and generate country-level routing change features, construct a country-level routing topology map and extract topology map features, including the number of nodes, diameter, and natural connectivity.

[0119] In this embodiment, step S1 of constructing the data layer specifically includes:

[0120] S11. Load the latest route snapshot dump file collected from the route packet collector. This file consists of packet records. Each packet record has the following format: <protocol type, timestamp, entry type, peer IP address, VP AS number, route prefix, AS path, message origin and next hop, etc.>. The VP AS number is the AS number of the VP observation point, the prefix is ​​the route prefix, and the AS path is the list of ASs traversed from the VP observation point AS to the target prefix.

[0121] S12. Establish the global real-time routing table dictionary, the autonomous system routing prefix table dictionary, and the routing prefix autonomous system mapping table dictionary. The global real-time routing table dictionary is a two-dimensional dictionary, where the routing prefix is ​​the key of the first dimension, the VPAS number is the key of the second dimension, and the value corresponding to the key of the second dimension is the AS path. The autonomous system routing prefix table is a one-dimensional dictionary, where the source AS is the key of the dictionary, and the value is the set of routing prefixes advertised by the autonomous system. The routing prefix autonomous system mapping table is a one-dimensional dictionary, where the routing prefix is ​​the key of the dictionary, and the value is the autonomous system that advertises the routing prefix.

[0122] S13. Read each packet record in the routing snapshot dump file, extract the routing prefix, VP AS number, and AS path from the packet record; store the routing prefix, VP AS number, and AS path into a two-dimensional dictionary of the global real-time routing table, where the routing prefix is the key of the first dimension of the two-dimensional dictionary, the VP AS number is the key of the second dimension of the two-dimensional dictionary, and the value corresponding to the key of the second dimension is the AS path; extract the last AS in the AS path, and this AS is the source AS of the routing prefix. Store the source AS and the routing prefix into a dictionary of the autonomous system routing prefix table, where the source AS is the key of the dictionary and the value is a set of routing prefixes, and add the routing prefix to this set; store the routing prefix and the source AS into a dictionary of the routing prefix-autonomous system mapping table, where the routing prefix is the key of the dictionary and the value is the source AS; if the processing of the packet records in the routing snapshot dump file is completed, the construction of the global real-time routing table and the autonomous system routing prefix table is completed. The global real-time routing table records the routing paths from the VP to all routing prefixes, the autonomous system routing prefix table records the routing prefixes announced by the autonomous system, and the routing prefix-autonomous system mapping table records the source AS corresponding to the routing prefix.

[0123] See Figure 2 , in this embodiment, step S2 of the mapping layer calibration specifically includes:

[0124] S21. Extract the autonomous system number and IP address prefix allocation data from the publicly available Internet number allocation database, and establish an autonomous system-country mapping table and an IP prefix-country mapping table. The record allocation relationship in the autonomous system-country mapping table is represented in the form of <AS number, country>, and the record allocation relationship in the IP prefix-country mapping table is represented in the form of <IP prefix, country>;

[0125] S22. Read the current record in the autonomous system-country mapping table, extract the AS number, and query the autonomous system routing prefix table; if the AS number does not exist in the autonomous system routing prefix table, maintain the current <AS number, country> mapping relationship. If the AS number exists, query the routing prefix-autonomous system mapping table to obtain the set of all routing prefixes announced by the AS.

[0126] S23. Traverse the above set of routing prefixes. For each routing prefix, randomly select an IP address from it, query the IP prefix-country mapping table, and obtain the country to which this IP belongs as the country where the routing prefix operates; after the traversal, obtain the set of countries where the AS routing prefix operates.

[0127] S24. Calculate the number of occurrences of each country in the set of countries where the AS routing prefix operates, and take the country with the most occurrences as the country mapped by this AS, and modify the corresponding <AS number, country> mapping relationship in the autonomous system-country mapping table;

[0128] S25. Read the next record in the Autonomous System Country Mapping Table and proceed to step S22. If each record in the Autonomous System Country Mapping Table has been processed, a new Autonomous System Country Mapping Table is generated, in which the countries corresponding to AS are the countries that are actually in operation.

[0129] In this embodiment, step S3 of feature layer extraction specifically includes:

[0130] S31. Construct a route prefix feature dictionary, an autonomous system (AS) route feature dictionary, and a country route feature dictionary. The route prefix feature dictionary is a three-dimensional dictionary: the first key is the route prefix, the second key is the timestamp, and the third key is the route feature. The value corresponding to the third key is the value of the route feature, which includes the number of advertisement messages and the number of rollback messages related to the route prefix. The AS feature dictionary is also a three-dimensional dictionary: the first key is the AS number, the second key is the timestamp, and the third key is the AS route feature. The value corresponding to the third key is the value of the AS route feature, which includes the number of all AS prefix advertisement messages and the number of rollback messages. The country route feature dictionary is also a three-dimensional dictionary: the first key is the country name, the second key is the timestamp, and the third key is the country route feature. The value corresponding to the third key is the value of the country route feature, which includes the number of all AS prefix advertisement messages, the number of rollback messages, the number of external peers, the number of country boundary paths, the number of ASs, the diameter, and the natural connectivity. Set a fixed interval T.

[0131] S32. Load the latest route update dump file collected from the route packet collector. The timestamp of the initial route feature is the time when the first route update dump file was generated.

[0132] S33. Sequentially read the current packet records in the route update dump file, and obtain the timestamps and current route feature timestamps from the packet records. Where t0 is the timestamp of the initial route feature and t1 is the timestamp in the message record, that is, the packets are divided according to time T; if the current message is a route rollback message, then proceed to S331; if it is a route advertisement message, then proceed to S332.

[0133] S331. Obtain the VP AS number and routing prefix from the packet record. Search the global real-time routing table dictionary based on the routing prefix and VP AS number, delete the VP AS number key and its corresponding value, and update the global real-time routing table. Update the routing prefix feature dictionary. If the routing prefix does not exist in the dictionary, insert it into the dictionary with timestamp t, announcing packet count of 0, and withdrawn packet count of 1. If the routing prefix exists in the dictionary, increment the withdrawn packet count by 1. Search the routing prefix autonomous system mapping table based on the routing prefix to obtain the source AS of the routing prefix. Update the autonomous system routing prefix feature dictionary. If the AS does not exist in the dictionary, insert it into the dictionary with timestamp t, announcing packet count of 0, and withdrawn packet count of 1. If the autonomous system exists in the dictionary, increment the withdrawn packet count by 1. If the routing feature timestamp t changes, proceed to step S4 to calculate the national routing feature for the current time interval.

[0134] S332. Obtain the VP AS number, routing prefix, and AS path from the packet. Search the global real-time routing table dictionary based on the routing prefix and VP AS number, and update the value corresponding to the VP AS number key to the new AS path. Obtain the last AS in the AS path, update the Autonomous System routing prefix table, and add the routing prefix to the AS's prefix set. Update the Autonomous System mapping table for routing prefixes, indicating that this AS is the source AS of the routing prefix. Update the routing prefix feature dictionary. If the dictionary does not contain the routing prefix, insert it into the dictionary with timestamp t, announcing message count of 1, and withdrawn message count of 0. If the dictionary contains the routing prefix, increment the announcing message count by 1. Search the Autonomous System mapping table for routing prefixes to obtain the source AS of the routing prefix. Update the Autonomous System routing prefix feature dictionary. If the dictionary does not contain the AS, insert it into the dictionary with timestamp t, announcing message count of 1, and withdrawn message count of 0. If the dictionary contains the Autonomous System, increment the announcing message count by 1. Calculate the national routing characteristics for the current time interval, then proceed to step S4 to calculate the national routing characteristics.

[0135] See Figure 3 In this embodiment, step S4 of the convergence layer modeling specifically includes:

[0136] S41. Query the Autonomous System Country Mapping Table to obtain the Autonomous System set for each country. The country prefix declaration message quantity feature is the sum of the number of declaration messages of all Autonomous Systems in that country within the current time period. The country prefix withdrawal message quantity feature is the sum of the number of withdrawal messages of all Autonomous Systems in that country within the current time period. Store the routing features of each country into the country routing feature dictionary.

[0137] S42. Based on the global real-time routing table for the current time period, extract the BGP path connection routing characteristics between and within countries. The specific method is as follows:

[0138] S421. Extraction of routing features for the number of connection paths between countries: Traverse the global real-time routing table at the current moment, obtain the AS path P = [AS1, AS2, ..., ASn] corresponding to each prefix VP AS number, and sequentially traverse all adjacent AS pairs (AS...) in this path. i AS i+1 ), query the Autonomous System Country Mapping Table, find the country corresponding to each AS, and denot them as (C i C i+1 If C i ≠C i+1 If two adjacent ASs belong to different countries, it is considered that there is a cross-border BGP path between the countries. Furthermore, if the AS pair is not in the "interconnection boundary set" of the country pair, the AS pair is recorded, the number of interconnection boundaries between the two countries is incremented by 1, and the AS is... i AS i+1 Let it be C i+1 C i The number of peers is calculated. Based on the above statistical results, a national-level BGP connectivity graph is constructed, where nodes represent countries, edges represent interconnected BGP paths, and the weight of the edge represents the number of paths.

[0139] S422. Extraction of Intra-Country Connectivity: This step aims to construct a connectivity graph between Autonomous Systems (AS) within a single country based on the global real-time routing table, thereby characterizing the BGP internal topology of that country. Based on the set of actually operating ASes identified in step S2, select any country A and its corresponding AS set. Traverse each path record P = [AS1, AS2, ..., ASn] in the global real-time routing table, and perform the following judgment and analysis on each path: If its starting point and ending point are both AS numbers within country A, or if the path passes through consecutive ASs in country A, it is considered an intra-country BGP connection path. If the path contains only an isolated single AS in A, but cannot form a continuous connection, it is ignored. Based on these path entries, construct an AS-level topology graph for country A, where the nodes of the graph represent ASs within that country, and the edges represent AS pairs connected by BGP paths; the edge weights are measured according to the number of paths.

[0140] S43. This step aims to analyze the constructed intra-country BGP topology using graph mining techniques to extract the structural behavior characteristics of each AS node within the national topology. For the intra-country routing topology G=(V,E) constructed in S422, calculate the number of ASs Size(V); the diameter of the graph; and the natural connectivity of the graph.

[0141] S44. Combine the national-level routing change features extracted in step S42 with the graph structure features extracted in step S43 to form a complete national-level multidimensional feature vector, record the timestamp t, and store it in the national routing feature dictionary. If the current packet record is the last record in the routing update dump file, proceed to step S32; otherwise, proceed to step S33. If the update dump file is the last file, terminate the program.

[0142] In summary, this invention loads route snapshot dump files and route update dump files to construct a global real-time routing table, an autonomous system (AS) route prefix table, and a route prefix AS mapping table. Based on AS number allocation data and IP prefix country affiliation information, an AS country mapping table is established to exclude ASs whose registration location and operating location are inconsistent. A three-level granularity routing feature dictionary of route prefix, AS, and country is constructed. Route update data is bucketed at fixed time intervals T to extract route change features at the route prefix level and AS level. Based on the AS country mapping table, country-level route change features are aggregated to construct a country-level routing topology map and extract topology map features, including the number of nodes, diameter, and natural connectivity. Specifically, the three-level granularity features of route prefix, AS, and country are constructed, aggregating from micro-level routing changes to macro-level national network structure. This preserves fine-grained routing dynamic details (such as the announcement / withdrawal frequency of individual prefixes) while capturing national-level network behavior trends (such as the overall routing stability of a country), providing a more comprehensive input dimension for machine learning models and significantly improving the accuracy and robustness of anomaly detection. By statistically analyzing the actual operating country of an AS (Application Service) using IP prefix attribution, ASs with inconsistent registration and operating locations are eliminated. This ensures that country-level features only include network entity data truly belonging to that country, effectively isolating cross-domain noise, avoiding feature bias caused by misjudgment of AS attribution, and improving feature stability. A national-level BGP topology map is constructed based on real-time routing tables, extracting graph structure features. This overcomes the shortcomings of existing technologies that rely solely on traffic statistics and path length, revealing potential patterns of anomalies from the perspective of network topology evolution and enhancing the interpretability of the detection model. A "divide and conquer" hierarchical aggregation strategy is adopted, dividing the global internet into management units with national boundaries, enabling distributed feature computation and aggregation. Compared to traditional global feature computation methods, this strategy significantly reduces computational complexity while supporting rapid location for national-level network security management. For example, when anomalies occur, the country or region of feature mutation can be directly identified, improving emergency response efficiency. The generated multi-granular features are not only applicable to BGP anomaly detection but also support scenarios such as network topology visualization, analysis of inter-country interconnection relationships, and regional network stability assessment. For example, the national routing feature dictionary can be used to monitor the network health status of various countries in real time, providing data support for internet governance and cross-border network collaborative defense.

[0143] It should be noted that the method of this embodiment can be executed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the method of this embodiment, and the multiple devices will interact with each other to complete the method described.

[0144] It should be noted that the above description describes some embodiments of the present invention. In some cases, the described actions or steps can be performed in a different order than that shown in the above embodiments and the desired result can still be achieved. Furthermore, the processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0145] See Figure 4 Based on the same inventive concept, and corresponding to the methods of any of the above embodiments, this embodiment of the invention also provides an inter-domain routing message data feature extraction device, comprising:

[0146] The data loading module 100 is used to load route snapshot dump files and route update dump files, and to build a global real-time routing table, an autonomous system route prefix table, and a route prefix autonomous system mapping table.

[0147] The mapping table construction module 200 is used to build an autonomous system country mapping table based on autonomous system number allocation data and IP prefix country affiliation information, excluding autonomous systems whose registration location and operation location are inconsistent.

[0148] The feature extraction module 300 is used to construct a routing feature dictionary with three levels of granularity: routing prefix, autonomous system, and country. It divides the routing update data into buckets at fixed time intervals T and extracts routing change features at the routing prefix level and autonomous system level.

[0149] The feature aggregation module 400 is used to aggregate routing change features at the national level based on the autonomous system's national mapping table, construct a national-level routing topology map, and extract topology map features, including the number of nodes, diameter, and natural connectivity.

[0150] In this embodiment, the data loading module 100 includes:

[0151] The route snapshot parsing unit 101 is used to parse the message records of the route snapshot dump file. The message record format is <protocol type, timestamp, peer IP address, VPAS number, route prefix, AS path, message origin, next hop>, and extracts the route prefix, VPAS number, and AS path.

[0152] The two-dimensional dictionary construction unit 102 is used to build a two-dimensional dictionary of the global real-time routing table: taking the routing prefix as the first-dimensional key, the VPAS number as the second-dimensional key, the corresponding value as the AS path, and the AS path as the list of ASs from the AS of the VP observation point to the target prefix;

[0153] The one-dimensional dictionary construction unit 103 of the prefix table is used to build a one-dimensional dictionary of the autonomous system routing prefix table: extract the last AS in the AS path as the source AS, take the source AS as the key, and the value as the set of routing prefixes announced by the source AS;

[0154] The one-dimensional dictionary construction unit 104 of the mapping table builds a one-dimensional dictionary of the routing prefix-autonomous system mapping table: taking the routing prefix as the key and the value as the source AS that announces the prefix.

[0155] In this embodiment, the mapping table construction module 200 includes:

[0156] The initial data acquisition unit 201 is used to obtain the initial allocation relationship of <AS number, country> and the allocation relationship of <IP prefix, country> from the public Internet number allocation database;

[0157] The operation location statistics unit 202 is used to randomly select an IP address from each routing prefix, query the IP prefix-country mapping table, and obtain the country to which the IP belongs as the country where the operation location of the routing prefix is located;

[0158] The mapping table update unit 203 is used to count the country that appears most frequently in the set of countries where the operation locations corresponding to all routing prefixes of the specified AS are located, and update the country corresponding to the specified AS in the autonomous system-country mapping table to this operation location country.

[0159] In this embodiment, the feature extraction module 300 includes:

[0160] The feature dictionary maintenance unit 301:

[0161] It is used to build a routing prefix feature dictionary: the routing prefix is the first-dimensional key, the timestamp is the second-dimensional key, and the routing feature is the third-dimensional key, including the number of announcement messages and the number of withdrawal messages;

[0162] It is also used to build an autonomous system routing feature dictionary: the autonomous system number is the first-dimensional key, the timestamp is the second-dimensional key, and the autonomous system routing feature is the third-dimensional key, including the number of all prefix announcement messages and the number of all prefix withdrawal messages;

[0163] The time bucket calculation unit 302 is used to perform time bucketing on the message records in the routing update dump file at a fixed interval T and calculate the current routing feature timestamp [[ID=3

[0164] If it is a route advertisement message:

[0165] Update the AS path corresponding to the route prefix and VPAS number in the global real-time routing table;

[0166] The number of announcement messages for the corresponding route prefix in the route prefix feature dictionary is increased by 1;

[0167] The source AS is obtained based on the routing prefix autonomous system mapping table, and the number of advertisement messages for the corresponding AS in the autonomous system routing feature dictionary is increased by 1;

[0168] If it is a route rollback message:

[0169] Delete the record containing the corresponding route prefix and VPAS number from the global real-time routing table;

[0170] If the VPAS number record corresponding to the route prefix is ​​empty, then delete the VPAS record;

[0171] The number of rollback packets corresponding to the route prefix in the route prefix feature dictionary is increased by 1;

[0172] The source AS is obtained based on the autonomous system mapping table of the routing prefix, and the number of rollback packets corresponding to the AS in the autonomous system routing feature dictionary is increased by 1.

[0173] In this embodiment, the feature aggregation module 400 includes:

[0174] Cross-border feature statistics unit 401 is used to construct a national routing feature dictionary: the first key is the country name, the second key is the timestamp, and the third key is the national routing feature. The national routing feature includes the number of national prefix declaration messages, the number of national prefix withdrawal messages, the number of external peers of the country, the number of national border paths, the number of ASs, the diameter of the graph, and natural connectivity.

[0175] Graph feature analysis unit 402 is used to traverse the AS path P = [AS1, AS2, ..., ASn] in the global real-time routing table and analyze adjacent AS pairs (AS... i AS i+1 ):

[0176] Query the country mapping table of the autonomous system to obtain the corresponding country C. i and C i+1 ;

[0177] If C i ≠C i+1 This is considered a cross-border BGP path, and C is added. i With C i+1 The number of interconnected boundaries, and recorded as external peers to each other;

[0178] If C i =C i+1 Then store the AS pair into C. i A set of internal AS connections within a country, used to construct the country's internal topology graph;

[0179] Based on the set of AS connections within a country, a topological graph is constructed with ASs as nodes and the number of paths as edge weights. The number of ASs, the diameter of the graph, and the natural connectivity are calculated.

[0180] The apparatus described above is used to implement a corresponding inter-domain routing message data feature extraction method in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0181] Based on the same inventive concept, corresponding to any of the above embodiments, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements a method for extracting inter-domain routing message data features as described in any of the above embodiments.

[0182] Figure 5 This diagram illustrates a specific hardware structure of an electronic device provided in this embodiment. The device may include: a processor 510, a memory 520, an input / output interface 530, a communication interface 540, and a bus 550. The processor 510, memory 520, input / output interface 530, and communication interface 540 are interconnected internally via the bus 550.

[0183] The processor 510 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0184] The memory 520 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 520 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program code is stored in the memory 520 and is called and executed by the processor 510.

[0185] Input / output interface 530 is used to connect input / output modules to realize information input and output. Input / output modules can be configured as components in the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touch screens, microphones, various sensors, etc., and output devices may include displays, speakers, vibrators, indicator lights, etc.

[0186] The communication interface 540 is used to connect a communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (e.g., USB, Ethernet cable) or wireless means (e.g., mobile network, Wi-Fi, Bluetooth).

[0187] Bus 550 includes a pathway for transmitting information between various components of the device, such as processor 510, memory 520, input / output interface 530, and communication interface 540.

[0188] It should be noted that although the above-described device only shows the processor 510, memory 520, input / output interface 530, communication interface 540, and bus 550, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures.

[0189] The electronic device described above is used to implement a method for extracting inter-domain routing message data features in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be elaborated here.

[0190] Based on the same inventive concept, corresponding to any of the above embodiments, the present invention also provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute an inter-domain routing message data feature extraction method as described in any of the above embodiments.

[0191] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, read-only optical disc (CD-ROM), digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0192] The computer instructions stored in the storage medium of the above embodiments are used to cause the computer to execute a method for extracting inter-domain routing message data features as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0193] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of the invention is limited to these examples; within the framework of the invention, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of the different aspects of the embodiments of the invention as described above, which are not provided in detail for the sake of brevity.

[0194] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of the invention, the well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided drawings. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of the invention, and this also takes into account the fact that the details of implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of the invention will be implemented (i.e., these details should be fully understood by those skilled in the art). While specific details (e.g., circuits) have been set forth to describe exemplary embodiments of the invention, it will be apparent to those skilled in the art that the embodiments of the invention may be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0195] Although the invention has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM, DRAM) may be used with the embodiments discussed.

[0196] The embodiments of this invention are intended to cover all such substitutions, modifications, and variations falling within the scope of the claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the embodiments of this invention should be included within the scope of protection of this invention.

Claims

1. A method for extracting features from inter-domain routing message data, characterized in that, It includes the following steps: Data layer construction: Load the routing snapshot dump file and the routing update dump file, and construct the global real-time routing table, the autonomous system routing prefix table, and the routing prefix - autonomous system mapping table; Mapping layer calibration: Based on the autonomous system number allocation data and the IP prefix country attribution information, establish the autonomous system - country mapping table, and exclude the autonomous systems with inconsistent registration and operation locations; Feature layer extraction: Construct a routing feature dictionary at three levels of routing prefix, autonomous system, and country. Bucket the routing update data at a fixed time interval T, and extract the routing change features at the routing prefix level and the autonomous system level; Aggregation layer modeling: Based on the autonomous system - country mapping table, aggregate and generate the routing change features at the country level, construct the national - level routing topology graph and extract the topology graph features, where the topology graph features include the number of nodes, diameter, and natural connectivity.

2. The method for extracting features from inter-domain routing message data according to claim 1, characterized in that, The steps of data layer construction specifically include: Parse the packet records in the routing snapshot dump file. The packet record format is <protocol type, timestamp, peer IP address, VPAS number, routing prefix, AS path, message origin, next hop>, and extract the routing prefix, VPAS number, and AS path; Establish a two - dimensional dictionary for the global real - time routing table: Use the routing prefix as the first - dimension key, the VPAS number as the second - dimension key, and the corresponding value as the AS path. The AS path is the list of ASs from the AS at the VP observation point to the target prefix; Establish a one - dimensional dictionary for the autonomous system routing prefix table: Extract the last AS in the AS path as the source AS, and use the source AS as the key, and the value is the set of routing prefixes announced by the source AS; Establish a one - dimensional dictionary for the routing prefix - autonomous system mapping table: Use the routing prefix as the key, and the value is the source AS that announces this prefix.

3. The method for extracting features from inter-domain routing message data according to claim 1, characterized in that, The steps of mapping layer calibration specifically include: Obtain the initial allocation relationship of <AS number, country> and the allocation relationship of <IP prefix, country> from the public Internet number allocation database; Traverse each AS number in the autonomous system routing prefix table. If there is a set of routing prefixes announced by this AS, then for each routing prefix: Select an IP address from this routing prefix, query the IP prefix - country mapping table, and obtain the country to which this IP belongs, as the country where the operation location of the routing prefix is located; Count the country that appears most frequently in the set of countries where the operation locations corresponding to all routing prefixes of this AS are located, and update the country corresponding to this AS in the autonomous system - country mapping table to this operation location country.

4. The method for extracting features from inter-domain routing message data according to claim 1, characterized in that, The steps of feature layer extraction specifically include: Construct a routing prefix feature dictionary: The routing prefix is the first - dimension key, the timestamp is the second - dimension key, and the routing feature is the third - dimension key, including the number of announcement packets and the number of withdrawal packets; Construct an autonomous system routing feature dictionary: The autonomous system number is the first - dimension key, the timestamp is the second - dimension key, and the autonomous system routing feature is the third - dimension key, including the number of all prefix announcement packets and the number of all prefix withdrawal packets; Perform time bucketing on the packet records in the routing update dump file at a fixed interval T, and calculate the current routing feature timestamp t = t0+(t1 - t0) % T, where t0 is the generation time of the first routing update dump file and t1 is the current packet timestamp; If it is a routing announcement packet: Update the AS path corresponding to the route prefix and VPAS number in the global real-time routing table; The number of announcement messages for the corresponding route prefix in the route prefix feature dictionary is increased by 1; The source AS is obtained based on the routing prefix autonomous system mapping table, and the number of advertisement messages for the corresponding AS in the autonomous system routing feature dictionary is increased by 1; If it is a route rollback message: Delete the record containing the corresponding route prefix and VPAS number from the global real-time routing table; If the VPAS number record corresponding to the route prefix is ​​empty, then delete the VPAS record; The number of rollback packets corresponding to the route prefix in the route prefix feature dictionary is increased by 1; The source AS is obtained based on the autonomous system mapping table of the routing prefix, and the number of rollback packets corresponding to the AS in the autonomous system routing feature dictionary is increased by 1.

5. The method for extracting features from inter-domain routing message data according to claim 1, characterized in that, The specific steps in modeling the convergence layer include: Construct a national routing feature dictionary: the first key is the country name, the second key is the timestamp, and the third key is the national routing feature. The national routing features include the number of national prefix announcement messages, the number of national prefix rollback messages, the number of external peers of the country, the number of national border paths, the number of ASs, the diameter of the graph, and natural connectivity. Traverse the AS path P = [AS1, AS2, ..., ASn] in the global real-time routing table, and for adjacent AS pairs (AS... i AS i+1 ): Query the country mapping table of the autonomous system to obtain the corresponding country C. i and C i+1 ; If C i ≠C i+1 This is considered a cross-border BGP path, and C is added. i With C i+1 The number of interconnected boundaries, and recorded as external peers to each other; If C i =C i+1 Then store the AS pair into C. i A set of internal AS connections within a country, used to construct the country's internal topology graph; Based on the set of AS connections within a country, a topological graph is constructed with ASs as nodes and the number of paths as edge weights. The number of ASs, the diameter of the graph, and the natural connectivity are calculated.

6. A device for extracting features from inter-domain routing message data, characterized in that, include: The data loading module is used to load route snapshot dump files and route update dump files, and to build a global real-time routing table, an autonomous system route prefix table, and a route prefix autonomous system mapping table. The mapping table construction module is used to build an autonomous system country mapping table based on autonomous system number allocation data and IP prefix country affiliation information, excluding autonomous systems whose registration location and operation location are inconsistent; The feature extraction module is used to construct a routing feature dictionary with three levels of granularity: routing prefix, autonomous system, and country. It divides the routing update data into buckets at fixed time intervals T and extracts routing change features at the routing prefix level and autonomous system level. The feature aggregation module is used to aggregate routing change features at the national level based on the autonomous system's national mapping table, construct a national-level routing topology map, and extract topology map features, including the number of nodes, diameter, and natural connectivity.

7. The inter-domain routing message data feature extraction device according to claim 6, characterized in that, The data loading module includes: The route snapshot parsing unit is used to parse the message records in the route snapshot dump file. The message record format is <protocol type, timestamp, peer IP address, VPAS number, route prefix, AS path, message origin, next hop>, and extracts the route prefix, VPAS number, and AS path. Two-dimensional dictionary construction unit, used to build a two-dimensional dictionary of global real-time routing table: the routing prefix is ​​the first dimension key, the VPAS number is the second dimension key, and the corresponding value is the AS path. The AS path is a list of ASs from the VP observation point AS to the target prefix; The prefix table one-dimensional dictionary construction unit is used to build an autonomous system routing prefix table one-dimensional dictionary: extract the last AS in the AS path as the source AS, use the source AS as the key, and the value is the set of routing prefixes advertised by the source AS. The mapping table is a one-dimensional dictionary construction unit. It establishes a one-dimensional dictionary of routing prefix autonomous system mapping tables: the routing prefix is ​​the key and the value is the source AS that declares the prefix.

8. The inter-domain routing message data feature extraction device according to claim 6, characterized in that, The mapping table construction module includes: An initial data acquisition unit, configured to acquire the initial allocation relationship of <AS number, country> and the allocation relationship of <IP prefix, country> from a public Internet number allocation database; An operation location statistics unit, configured to randomly select an IP address from each route prefix, query the IP prefix-country mapping table, and obtain the country to which the IP belongs as the country where the operation location of the route prefix is located; A mapping table update unit, configured to count the country that appears most frequently in the set of operation location countries corresponding to all route prefixes of a specified AS, and update the country corresponding to the specified AS in the autonomous system-country mapping table to this operation location country.

9. The inter-domain routing message data feature extraction device according to claim 6, characterized in that, The feature extraction module includes: A feature dictionary maintenance unit: Configured to construct a route prefix feature dictionary: the route prefix is the first-dimensional key, the timestamp is the second-dimensional key, and the route feature is the third-dimensional key, including the number of announcement messages and the number of withdrawal messages; It is also configured to construct an autonomous system route feature dictionary: the autonomous system number is the first-dimensional key, the timestamp is the second-dimensional key, and the autonomous system route feature is the third-dimensional key, including the number of announcement messages for all prefixes and the number of withdrawal messages for all prefixes; A time bucketing calculation unit, configured to perform time bucketing on the message records in the route update dump file at a fixed interval T, and calculate the current route feature timestamp t = t0 + (t1 - t0) %? T, where t0 is the generation time of the first route update dump file and t1 is the current message timestamp; If it is a route announcement message: Update the AS path corresponding to the route prefix and VPAS number in the global real-time routing table; Increment the number of announcement messages corresponding to the route prefix in the route prefix feature dictionary by 1; Obtain the source AS according to the route prefix-autonomous system mapping table, and increment the number of announcement messages corresponding to the AS in the autonomous system route feature dictionary by 1; If it is a route withdrawal message: Delete the record corresponding to the route prefix and VPAS number from the global real-time routing table; If the VPAS number record corresponding to this route prefix is empty, delete the VPAS record; Increment the number of withdrawal messages corresponding to the route prefix in the route prefix feature dictionary by 1; Obtain the source AS according to the route prefix-autonomous system mapping table, and increment the number of withdrawal messages corresponding to the AS in the autonomous system route feature dictionary by 1.

10. The inter-domain routing message data feature extraction device according to claim 6, characterized in that, The feature aggregation module includes: A cross-country feature statistics unit, configured to construct a country route feature dictionary: the first-dimensional key is the country name, the second-dimensional key is the timestamp, and the third-dimensional key is the country route feature, and the country route feature includes the number of announcement messages for country prefixes, the number of withdrawal messages for country prefixes, the number of country external peers, the number of country border paths, the number of ASes, the diameter of the graph, and the natural connectivity; The graph feature analysis unit is used to traverse the AS path P = [AS1, AS2, ..., ASn] in the global real-time routing table and analyze adjacent AS pairs (AS... i AS i+1 ): Query the country mapping table of the autonomous system to obtain the corresponding country C. i and C i+1 ; If C i ≠C i+1 This is considered a cross-border BGP path, and C is added. i With C i+1 The number of interconnected boundaries, and recorded as external peers to each other; If C i =C i+1 Then store the AS pair into C. i A set of internal AS connections within a country, used to construct the country's internal topology graph; Based on the set of AS connections within the country, construct a topology graph with AS as nodes and the number of paths as edge weights, and calculate the number of ASes, the diameter of the graph, and the natural connectivity.

Images