Interrupt event detection method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides an interrupt event detection method and device, electronic equipment and a storage medium, and aims to improve the accuracy of interrupt event detection. Comprising the following steps of: on the basis of a valley-free principle, constructing a state transition table among all AS (Autonomous Area System) by traversing all the AS in acquired autonomous AS business relation topology; according to the obtained routing data, determining an abnormal AS set with interruption in a target space-time range; on the basis of the state transition table, in the AS business relation topology, determining a second legal path between any two abnormal AS in the abnormal AS set, and obtaining an abnormal AS sub-graph corresponding to the abnormal AS set on the basis of each second legal path; determining an abnormal parameter of each abnormal AS based on the interruption frequency of each abnormal AS and the upstream and downstream relationship between the abnormal AS in the abnormal AS sub-graph, and performing interruption event tracing according to the abnormal parameter; the abnormal parameters are used for reflecting the probability that the corresponding abnormal AS is an interruption event source.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a method and device for detecting an interruption event, an electronic device and a storage medium. BACKGROUND

[0002] Border Gateway Protocol (BGP) is a kind of dynamic routing protocol between autonomous systems of the Internet. Although BGP plays a key role in the Internet, its security is very fragile. The fragility of BGP in security makes BGP an easy target for attacks, and when facing various malicious attacks, configuration errors and the like, direct or indirect influences, large-scale routing fluctuations are prone to occur. Using a rule matching method to analyze routing updates, thousands of routing interruptions can be found every day.

[0003] Traditional methods usually screen interruption events according to the number of interrupted Internet Protocol (IP) or the duration, but do not consider the importance of the location of different autonomous systems (AS) in the network. For example, an interruption of a first-tier (Tier 1) AS can cascade to affect hundreds of downstream ASs through customer-provider relationships, so when it fails, although the number of directly interrupted IPs is small, the impact is great. At this time, when screening the interruption event by the number of interrupted IPs, the interruption of the Tier 1 AS may not be screened out. In addition, since routing interruptions will propagate between ASs, the traditional method can know that multiple ASs are interrupted at the same time, but it is difficult to find the source of the routing interruption. Thus, the operation and maintenance personnel need to consume a lot of time to locate the source of the interruption, and the use experience of customers is affected.

[0004] Therefore, how to improve the accuracy of interruption event detection is urgent to be solved. SUMMARY

[0005] Embodiments of the present application provide a method and device for detecting an interruption event, an electronic device and a storage medium, to improve the accuracy of interruption event detection.

[0006] In a first aspect, the embodiments of the present application provide a method for detecting an interruption event, comprising:

[0007] Based on the principle of no valley, a state transition table between all ASs in an acquired AS business relationship topology is constructed by traversing the all ASs; the state transition table is used to describe a first legal path between the all ASs; the all ASs include abnormal ASs and normal ASs;

[0008] determine, according to the obtained routing data, a set of abnormal ASs in which interruption occurs in a target time-space range;

[0009] determine, based on the state transition table, a second legal path between any two abnormal ASs in the AS business relationship topology, and obtain an abnormal AS subgraph corresponding to the set of abnormal ASs based on each second legal path;

[0010] determine an abnormal parameter of each abnormal AS based on the number of interruptions of each abnormal AS in the abnormal AS subgraph and the upstream and downstream relationships between each abnormal AS, and perform traceability of the interruption event according to the abnormal parameter; the abnormal parameter is used to reflect the probability that the corresponding abnormal AS is the source of the interruption event.

[0011] In a second aspect, an embodiment of the present application provides a detection device for an interruption event, comprising:

[0012] The construction unit is configured to construct a state transition table between all ASs in the AS business relationship topology based on the no-valley principle by traversing the all ASs; the state transition table is used to describe a first legal path between the all ASs; the all ASs include abnormal ASs and normal ASs.

[0013] The first determination unit is configured to determine a set of abnormal ASs in which interruption occurs in a target time-space range according to the obtained routing data.

[0014] The second determination unit is configured to determine a second legal path between any two abnormal ASs in the set of abnormal ASs in the AS business relationship topology based on the state transition table, and obtain an abnormal AS subgraph corresponding to the set of abnormal ASs based on each second legal path.

[0015] The traceability unit is configured to determine an abnormal parameter of each abnormal AS based on the number of interruptions of each abnormal AS in the abnormal AS subgraph and the upstream and downstream relationships between each abnormal AS, and perform traceability of the interruption event according to the abnormal parameter; the abnormal parameter is used to reflect the probability that the corresponding abnormal AS is the source of the interruption event.

[0016] In some embodiments, the construction unit is specifically configured to:

[0017] construct a standard path meeting the no-valley principle as a state transition graph;

[0018] For each AS in the all ASs, the following operations are performed:

[0019] the AS is taken as a current AS;

[0020] searching for a next hop AS of the current AS in the AS business relationship topology based on the state transition graph;

[0021] if the next hop AS is searched, pairing an AS-path state of a business state of the current AS and a business state of the next hop AS with the next hop AS, and taking the next hop AS as the current AS;

[0022] if the next hop AS is not searched, connecting at least one AS-path state pair into a state transition line according to an upstream and downstream relationship between all the ASs;

[0023] combining each of the state transition lines into the state transition table.

[0024] In some embodiments, the path state includes a first path state, a second path state and a third path state; the state transition graph is composed of at least one of the first path state, the second path state and the third path state in sequence; the first path state represents state transition from an AS with a business state of a client to an AS with a business state of a provider; the second path state represents state transition from an AS with a business state of a peer to an AS with a business state of a peer; and the third path state represents state transition from an AS with a business state of a provider to an AS with a business state of a client.

[0025] In some embodiments, the second determining unit is specifically configured to:

[0026] taking each of the abnormal ASs as a path starting point respectively, and performing the following iteration operation on each of the abnormal ASs respectively:

[0027] taking the abnormal AS as the current AS;

[0028] searching for a next hop AS in the state transition table along the first legal path;

[0029] if the next hop AS is a normal AS, recording a path state corresponding to a business relationship between the current AS and the next hop AS; taking the current AS as a predecessor AS, and updating the next hop AS as the current AS;

[0030] if the next hop AS is an abnormal AS, recording a path state of the current AS corresponding to a business relationship of the current AS and a business relationship of the next hop AS; taking the current AS as a predecessor AS, and constructing a second legal path based on at least one of the predecessor ASs.

[0031] In some embodiments, the second determining unit is specifically configured to:

[0032] divide each normal AS and each abnormal AS in each of the second legal paths into a node set of the abnormal AS subgraph, divide a path state of each normal node and a path state of each abnormal node in each of the second legal paths into an edge set of the abnormal AS subgraph;

[0033] construct the abnormal AS subgraph based on the node combination and the edge set.

[0034] In some embodiments, the tracing unit is specifically configured to:

[0035] For each of the abnormal ASs, perform the following operations:

[0036] multiply the number of interruptions of each abnormal AS downstream of the abnormal AS in the abnormal AS subgraph by a corresponding attenuation factor to obtain an interruption propagation parameter;

[0037] add the number of interruptions of the abnormal AS and the interruption propagation parameter to obtain the abnormal parameter.

[0038] In some embodiments, the constructing unit is specifically configured to:

[0039] determine whether the state transition table is stored in a cache;

[0040] if the state transition table is not stored in the cache, determine whether the state transition table is stored in a local file;

[0041] if the state transition table is stored in the local file, add the state transition table in the cache, and delete old cache files in the cache from far to near according to cache time, so that the number of cache files in the cache does not exceed a preset number threshold;

[0042] if the state transition table is not stored in the local file, construct a state transition table among all ASs in an AS business relationship topology obtained by traversal based on a valley-free principle, and add the state transition table in the cache, and delete old cache files in the cache from far to near according to cache time, so that the number of cache files in the cache does not exceed a preset number threshold.

[0043] In a third aspect, an embodiment of the present application provides an electronic device, comprising:

[0044] a memory configured to store program instructions;

[0045] a processor configured to invoke the program instructions stored in the memory, and execute the detection method of the interruption event according to the obtained program instructions.

[0046] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, which stores a computer program. When the computer program is executed by a processor, the detection method of the interrupt event is implemented.

[0047] In a fifth aspect, an embodiment of the present application provides a computer program product, which comprises a computer program stored in a computer readable storage medium. When a processor of an electronic device reads the computer program from the computer readable storage medium, the processor executes the computer program, so that the electronic device executes the detection method of the interrupt event.

[0048] The embodiment of the present application provides a detection method and device of an interrupt event, an electronic device and a storage medium. First, the embodiment of the present application constructs a state transition table for all ASs based on the no valley principle, and when searching for subsequent ASs, the state transition condition in the state transition table can be used to force the search path to comply with the business rules. The illegal path interference problem is fundamentally solved, the physical authenticity of the abnormal AS subgraph generated subsequently is ensured, and a foundation is laid for interrupt tracing.

[0049] Then, the embodiment of the present application proposes an abnormal AS subgraph focusing strategy, which only traverses the second legal path between ASs to generate an abnormal AS subgraph, and eliminates irrelevant ASs. Compared with the overall traversal of all ASs, the computational complexity is reduced from O(N 2 ) to O(k·E) (N is the number of all ASs, k is the number of abnormal ASs, and E is the number of edges of the abnormal AS subgraph), efficient pruning is realized, and the analysis efficiency is greatly improved.

[0050] Finally, based on the routing propagation direction in the business scenario, the upstream abnormal parameters are calculated by accumulating the number of downstream interrupts, so that the “upstream influence range” is quantified, the core AS with greater global influence is quickly located, the key problem of fuzzy responsibility transfer in the multi-hop AS network is solved, and the accuracy of the interrupt event detection is improved. BRIEF DESCRIPTION OF DRAWINGS

[0051] Figure 1 A structural schematic diagram of a detection method of an interrupt event provided by the embodiment of the present application;

[0052] Figure 2 A flowchart of a detection method of an interrupt event provided by the embodiment of the present application;

[0053] Figure 3 A structural schematic diagram of a state transition graph provided by the embodiment of the present application;

[0054] Figure 4 A schematic diagram of a state transition table provided by the embodiment of the present application;

[0055] Figure 5 A cache flowchart of a state transition table provided for an embodiment of the present application;

[0056] Figure 6 A visual abnormal AS subgraph provided for an embodiment of the present application;

[0057] Figure 7 A structural schematic diagram of another method for detecting an interrupt event provided for an embodiment of the present application;

[0058] Figure 8 A structural schematic diagram of an electronic device for a method for detecting an interrupt event in an embodiment of the present application;

[0059] Figure 9 A hardware component structural schematic diagram of an electronic device applying an embodiment of the present application. DETAILED DESCRIPTION

[0060] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings. Obviously, the described embodiments are only part of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0061] Some concepts involved in the embodiments of the present application will be introduced below.

[0062] AS: In the Internet, the combination of all IP networks and routers under the jurisdiction of one or more entities, which perform common routing policies for the Internet.

[0063] BGP: A decentralized dynamic routing protocol between Internet autonomous systems. It allows different ASes on the Internet to automatically exchange IP routing information and reachable information.

[0064] Breadth First Search (BFS): An algorithm for traversing or searching a tree or graph. In level-order traversal, starting from a root node, first access the root node, then access all adjacent nodes in turn, and then access their adjacent nodes, and so on, until all reachable nodes are accessed. This method is usually implemented using a queue. In the embodiments of the present application, each AS can be regarded as a node.

[0065] The design idea of the embodiments of the present application will be briefly introduced below:

[0066] Border Gateway Protocol (BGP) is a decentralized dynamic routing protocol between autonomous systems of the Internet. It allows different ASes on the Internet to automatically exchange IP routing information and reachability information. Although BGP plays a key role in the Internet, its security is very fragile. The ASes connected by BGP lack an effective authentication mechanism for the received prefix routes, resulting in unconditional reception or propagation of the routes of the neighbor AS, which poses a security risk. The vulnerability of BGP in security makes BGP an easy target for attacks, and when facing various malicious attacks, configuration errors, etc. directly or indirectly, it is easy to cause large-scale route fluctuations. Using rule matching to analyze route updates, thousands of route interruptions can be found every day. However, only a small part of the route interruptions represent abnormal or malicious behavior. How to find the interruption events worth attention from a large number of interruption events based on the data at the route control level has become a problem to be solved.

[0067] Therefore, the embodiments of the present application provide a method and device for detecting interruption events, an electronic device and a storage medium. First, the embodiments of the present application construct a state transition table for all ASes based on the no valley principle, and when searching for subsequent ASes, the state transition conditions in the state transition table can be used to force the search path to comply with the business rules. This fundamentally solves the problem of illegal path interference and ensures the physical authenticity of the abnormal AS subgraph generated subsequently, laying a foundation for interruption tracing.

[0068] Then, the embodiments of the present application propose an abnormal AS subgraph focusing strategy, which only traverses the second legal path between ASes to generate an abnormal AS subgraph and eliminates irrelevant ASes. Compared with the overall traversal of all ASes, the computational complexity is reduced from O (N 2 ) to O (k·E) (N is the number of all ASes, k is the number of abnormal ASes, and E is the number of edges of the abnormal AS subgraph), which realizes efficient pruning and greatly improves the analysis efficiency.

[0069] Finally, based on the route propagation direction in the business scenario, the embodiments of the present application calculate the upstream abnormal parameters by accumulating the number of downstream interruptions, thereby quantifying the "upstream influence range", quickly locating the core AS with a greater global impact, solving the key problem of fuzzy responsibility transfer in a multi-hop AS network, and improving the accuracy of interruption event detection.

[0070] The method for detecting interruption events provided by the embodiments of the present application can be applied to the following network security scenarios:

[0071] 1. Detect and analyze BGP interruption and other routing security threats.

[0072] The embodiments of the present application can realize automatic high real-time detection of routing interruption events based on BGP routing control plane data. By selecting different routing observation points, routing interruption detection models with different perspectives can be constructed, for example, based on the operator's existing network data, the AS dimension routing interruption can be detected from the perspective of China, which helps to further study the causes of routing interruption and give event analysis report.

[0073] 2. Constructing a state transition table based on the no valley principle to realize fast routing path search and routing leakage detection.

[0074] The embodiments of the present application can efficiently search for legal AS paths based on AS business relationship topology by converting the no valley principle into a state transition graph. In addition to being used to construct abnormal AS subgraphs of target AS sets, it can also be used to quickly give all paths from a given starting AS and ending AS, or to verify whether a path conforms to the no valley principle. If it does not conform, routing leakage may have occurred.

[0075] 3. Provide auxiliary research and judgment for other routing abnormalities with graph association.

[0076] In addition to being able to perform correlation analysis on routing interruption abnormalities, the embodiments of the present application can also be used to study other types of routing abnormalities by changing the way abnormal AS sets are obtained. For example, using hijacked or leaked AS sets as target sets to construct abnormal AS subgraphs can realize connection relationship analysis of hijacked or leaked AS, which helps to find the main target of routing attacks or the core nodes of network fluctuations, and provides research and judgment basis for related field analysis.

[0077] As shown in Figure 1 In the detection method of the present application, the following modules are involved:

[0078] Data input and business relationship analysis module, state transition table pre-computation module, abnormal AS acquisition module, abnormal AS subgraph construction module and interruption event tracing module.

[0079] Data input and business relationship analysis module: based on AS business relationship data, analyze the business relationship of all AS, construct an AS adjacency table representing the AS business relationship topology, and store different business relationship types at the same time.

[0080] State transition table pre-computation module: based on the inter-AS business relationship topology of all AS, each AS has three business states. Based on the no valley principle, traverse all AS to obtain a state transition table composed entirely of first legal paths.

[0081] Abnormal AS acquisition module: based on routing data, calculate the abnormal AS set that has occurred in the target time and space range.

[0082] Abnormal AS subgraph construction module: for any two ASs in the abnormal AS set, all second legal paths of the two ASs are constructed based on the state transition table, and the smallest abnormal AS subgraph containing all feasible paths is obtained based on each second legal path.

[0083] Interrupt event tracing module: visualizing the abnormal AS subgraph and tracing the interrupt based on attributes such as in-degree and out-degree.

[0084] The following will be described in combination with Figure 2 The interrupt event detection method provided by the application will be introduced.

[0085] Figure 2 A flowchart of an interrupt event detection method provided by an embodiment of the application is shown, as shown in Figure 1 The method can include the following steps S201-S204:

[0086] S201: based on the no valley principle, a state transition table between all ASs in the acquired autonomous domain AS business relationship topology is constructed by traversing all ASs.

[0087] The state transition table is used to describe the first legal path between all ASs. The first legal path refers to the AS path that meets the no valley principle. All ASs include abnormal ASs and normal ASs.

[0088] Specifically, before constructing the state transition table, the application embodiment can analyze the business relationship of all ASs based on the AS business relationship data published by the Center for Applied Internet Data Analysis (CAIDA) through data input and business relationship analysis module, construct the AS adjacency list, and store different business relationship types at the same time.

[0089] Specifically, the application embodiment can obtain AS business relationship data from CAIDA and store it in the database in the form of a timing task every month (or every week, every day, etc.). The original business relationship data obtained from CAIDA includes (AS1, AS2, rel), where rel only contains 0 and -1, rel is 0 when AS1 and AS2 are peers, and rel is -1 when AS1 is a provider of AS2 and AS2 is a customer of AS1.

[0090] After the AS business relationship data is acquired and stored in the database, data analysis is triggered automatically, and the AS business relationship data is reconstructed using a method similar to the adjacency list of a directed graph. For each AS in the AS business relationship data, all neighbor AS nodes are stored using a dictionary method. Since there are three types of edges (business relationships) between two AS nodes: peer-peer (p2p), provider-customer (p2c), and customer-provider (c2p), the three types of edges are represented by the numbers 0, -1, and 1, respectively, and are added to the adjacency list. In the embodiments of the present application, the AS business relationship topology can be represented by the adjacency list.

[0091] In the embodiments of the present application, the type "1" indicates that the business relationship between the one-hop AS and the current AS is customer-provider, i.e., the previous-hop AS is the customer of the current AS, and the current AS is the provider of the previous-hop AS.

[0092] In an optional implementation, the state transition table can be constructed by a state transition table pre-computation module.

[0093] (A1) The standard path that meets the valley-free principle is constructed as a state transition graph.

[0094] In the embodiments of the present application, the path state can refer to the type of business relationship between two ASes. Since the type of business relationship is divided into three types: 0 (p2p), -1 (p2c), and 1 (c2p), the path state in the embodiments of the present application is also divided into three types: 0, -1, and 1.

[0095] In the embodiments of the present application, the path state can refer to the type of business relationship between two ASes. Since the type of business relationship is divided into three types: 0 (p2p), -1 (p2c), and 1 (c2p), the path state in the embodiments of the present application is also divided into three types: 0, -1, and 1.

[0096] In the embodiments of the present application, when the first legal path between any two ASs is based on the AS business relationship topology, the first legal path needs to satisfy the valley-free principle of the AS business relationship, and the business relationship between the adjacent two ASs should satisfy the following in turn: 0 or more customer-provider+0 or 1 peer-peer+0 or more provider-customer. Therefore, the state transition diagram is composed of at least one of the first path state, the second path state and the third path state in turn.

[0097] As shown in Figure 3 , it is a structural schematic diagram of a state transition diagram provided by the embodiments of the present application. When the business relationship between the previous hop AS and the current AS in the path is 1, 0 or -1 respectively, the business relationship between the current AS and the next hop AS can only be state transitioned in the direction shown in Figure 3 . If the current AS is the first AS in the path, the state transition condition is equivalent to the business relationship being "1". Figure 3 "1" in the "1" means that the business relationship between the previous hop AS and the current AS is customer-provider, that is, the previous hop AS is the customer of the current AS, and the current AS is the provider of the previous hop AS; Figure 3 "0" in the "0" means that the business relationship between the previous hop AS and the current AS is peer-peer, that is, the previous hop AS is the peer of the current AS, and the current AS is the peer of the previous hop AS; Figure 3 "1" means that the business relationship between the previous hop AS and the current AS is provider-customer, that is, the previous hop AS is the provider of the current AS, and the current AS is the customer of the previous hop AS.

[0098] Therefore, as can be seen from Figure 3 , the business relationship between the ASs in the first legal path corresponding to the state transition diagram satisfying the valley-free principle can be:

[0099] 1 or more 1→1 0→1 or more -1, 1 or more 1→1 0, 1 0→1 or more -1, 1 or more 1→1 or more -1, 1 or more 1, 1 0, 1 or more -1.

[0100] (A2) For each AS in the entire AS, the following operation is performed:

[0101] Take the AS as the current AS; search for the next hop AS of the current AS in the AS business relationship topology based on the state transition diagram;

[0102] If the next-hop AS is searched, the business state of the current AS and the path state corresponding to the business state of the next-hop AS are paired with the next-hop AS to form an AS-path state pair, and the next-hop AS is taken as the current AS; if the next-hop AS is not searched, at least one AS-path state pair is connected as a state transition row according to the upstream and downstream relationships among all ASs.

[0103] Specifically, the embodiment of the present application considers that a large number of illegal paths are additionally traversed when searching for an AS path directly in the AS business relationship topology, in order to improve the time efficiency of subsequent construction of an abnormal AS subgraph, a state transition table among all AS nodes is constructed based on the state transition graph and the AS business relationship topology directly according to the no valley principle, the state transition table is updated synchronously with the AS business relationship data, and therefore the read efficiency can be further improved in a pre-computation manner.

[0104] Similar to the node state transition graph, when a path state s is used to search for a next-hop AS, the type of the business relationship between the next-hop AS and the current AS, and therefore, in the embodiment of the present application, the state transition table can be composed of AS-path state pairs of "ASn, s", where ASn refers to an AS with a serial number n.

[0105] Specifically, when each state transition row in the state transition graph is constructed, one AS is selected from all ASs as a first current AS, a next-hop AS is searched in the AS business relationship topology, and the type of the business relationship between the current AS and the next-hop AS should meet the state transition graph. If the next-hop AS is searched, the type of the business relationship between the current AS and the next-hop AS, that is, the corresponding path state, is recorded, and the path state and the next-hop AS form an AS-path state pair. When the next-hop AS is not searched, at least one AS-path state pair is combined into a state transition row according to the upstream and downstream relationships among the ASs.

[0106] (A3) Each state transition row is combined into a state transition table.

[0107] Specifically, since there can be multiple next-hop ASs that meet the state transition graph for the current AS, one AS can have multiple state transition rows.

[0108] Each state transition row is combined into Figure 4 a state transition table as shown in the figure.

[0109] As Figure 4 shown, it is a schematic diagram of a state transition table provided by the embodiment of the present application. As Figure 4As shown, in the first state transition row, starting from AS1, the current node is AS1, the path state is 1, the next hop AS conforming to the first legal path contains AS11537, and the path state (i.e., the business relationship between AS1 and AS11537 is peer-peer) becomes 0. AS11537 and 0 are recorded as an AS-path state pair, and AS11537 is taken as the current AS. At this time, the next hop AS conforming to the first legal path contains AS25139, and the path state becomes -1 (i.e., the business relationship between AS11537 and AS25139 is provider-customer). In this way, all ASs are traversed to obtain a state transition table composed of only legal states.

[0110] Embodiments of the present application consider that the pre-computed state transition table needs to traverse all ASs, and the update frequency of AS business relationship data is relatively low. Therefore, embodiments of the present application can save the pre-computed state transition table in the form of a file locally, and maintain the upper limit of the number of cache files through the least recently used (LRU) cache mechanism to retain recently accessed file caches. Each time there is a new abnormal AS subgraph construction request, the date version corresponding to the request is first obtained, and then the state transition table reading and cache updating are performed according to the following process, and then the abnormal AS obtaining module is entered.

[0111] In an optional implementation, embodiments of the present application perform state transition table reading and cache updating, and the specific implementation is as follows Figure 5 As shown:

[0112] S501: Obtain the date version of the request;

[0113] S502: Determine whether the state transition table is stored in the cache;

[0114] If the state transition table is not stored in the cache, S504 is performed; otherwise, S503 is performed.

[0115] S503: Obtain the state transition table;

[0116] S504: Determine whether the state transition table is stored in the local file;

[0117] If the state transition table is stored in the local file, S505 is performed; otherwise, S508 is performed.

[0118] S505: Obtain the state transition table and add the state transition table in the cache;

[0119] S506: Determine whether the number of cache files exceeds a preset threshold;

[0120] If the number of cache files exceeds the preset threshold, S507 is performed.

[0121] S507: deleting the oldest cache file;

[0122] Specifically, the oldest cache file in the cache is deleted from far to near according to the cache time, so that the number of cache files in the cache does not exceed the preset number threshold;

[0123] S508: judging whether the AS business relationship data exists or not;

[0124] If the AS business relationship data exists, S509 is executed; otherwise, S510 is executed;

[0125] S509: based on the no valley principle, all ASs in the autonomous domain AS business relationship topology obtained by traversal are used to construct a state transition table between all ASs, and the state transition table is added in the cache;

[0126] S510: error reporting.

[0127] S202: determining an abnormal AS set in which an interruption occurs in a target time-space range according to the obtained routing data.

[0128] Specifically, the embodiments of the present application can detect the route interruption event of the whole network AS level based on the routing information base (RIB) and the routing update message (BGP Update Message) file in the routing data by monitoring the IP number in each AS declaration and setting the interruption threshold. For the selected time range and space range (such as a country), the abnormal AS set of abnormal ASs in which the interruption occurs, and the parameters such as the number of interruption events, the interruption duration, and the influence range can be screened out.

[0129] S203: based on the state transition table, determining a second legal path between any two abnormal ASs in the abnormal AS set in the AS business relationship topology, and obtaining an abnormal AS subgraph corresponding to the abnormal AS set based on each second legal path.

[0130] The second legal path refers to the AS path between the abnormal ASs which meets the no valley principle.

[0131] In the embodiments of the present application, for an abnormal AS set, the present application needs to acquire as comprehensive network topology architecture as possible related to the abnormal AS, i.e. an abnormal AS subgraph of the AS business relationship topology, while needs to reduce its resource occupation as much as possible, i.e. maintain the size of the abnormal AS subgraph to be minimum. The basic principle of the method adopted in the embodiments of the present application is that, for an abnormal AS set containing n abnormal ASes, any two abnormal ASes can form a departure-arrival AS pair, based on the no valley principle, find all the second legal paths between the two abnormal ASes in the AS business relationship topology, form a path set P, then for all the departure-arrival AS pairs, the union of all the path sets P is the minimum abnormal AS subgraph to be found. Since the no valley principle has symmetry, the path set obtained by interchanging the departure-arrival AS pair is the same as the original one, so the departure-arrival AS pair can be unordered, i.e. there are n(n-1) / 2 departure-arrival AS pairs in total.

[0132] Specifically, in order to further improve the time efficiency, the embodiments of the present application perform AS path search on the pre-computed state transition table. For each abnormal AS in the abnormal AS set, take it as the path starting point in turn, search all the second legal paths on the state transition table, since the state transition table only stores the state transition of the first legal path (complying with the no valley principle), the time efficiency is greatly improved.

[0133] In an alternative embodiment, the embodiments of the present application can determine the second legal path through an abnormal AS subgraph construction module:

[0134] Take each abnormal AS as the path starting point respectively, and perform the following iteration operation for each abnormal AS respectively:

[0135] Take the abnormal AS as the current AS; search the next hop AS along the first legal path in the state transition table;

[0136] If the next hop AS is a normal AS, record the path state corresponding to the business relationship between the current AS and the next hop AS; take the current AS as the predecessor AS, and update the next hop AS as the current AS; if the next hop AS is an abnormal AS, record the path state of the current AS corresponding to the business relationship between the current AS and the next hop AS; take the current AS as the predecessor AS, and construct the second legal path based on at least one predecessor AS.

[0137] Specifically, the embodiment of the present application can search the first legal path in a BFS manner, first taking an abnormal AS as a path starting point, then searching the next-hop AS along the first legal path, adding the next-hop AS to a queue and recording the path state of the current AS corresponding to the commercial relationship of the current AS and the commercial relationship of the next-hop AS each time the next-hop AS is reached, and taking the current AS as a predecessor AS. If the next-hop AS reached in the traversal exists in the abnormal AS set at the same time, it is considered that a second legal path is found, and then the predecessor AS is used to reconstruct the complete second legal path in a backtracking manner.

[0138] It should be noted that the abnormal AS set used to construct the abnormal AS subgraph in the embodiment of the present application can be an abnormal AS sub-set for a certain abnormality from among the total abnormal AS set composed of all abnormal ASs.

[0139] For example, the abnormal AS can be an AS corresponding to a leakage abnormal event, can also be an AS corresponding to a hijacking abnormal event, and can also be an AS corresponding to an interruption abnormal event. Therefore, when the total abnormal AS set contains abnormal ASs of the above three abnormal events, an abnormal AS subgraph can be constructed only for abnormal ASs of a leakage abnormal event, in which case only abnormal ASs of the leakage abnormal event are taken as path starting points, and the above-mentioned related steps of determining a second legal path and subsequently constructing an abnormal AS subgraph are executed.

[0140] In an alternative embodiment, the embodiment of the present application specifically adopts the following implementation when constructing an abnormal AS subgraph:

[0141] Each normal AS and each abnormal AS in each second legal path is divided into a node set of the abnormal AS subgraph, and the path state of each normal node and the path state of each abnormal node in each second legal path are divided into an edge set of the abnormal AS subgraph; and the abnormal AS subgraph is constructed based on the node set and the edge set.

[0142] Specifically, the AS on the second legal path and the second legal path are added to the node set V and the edge set E respectively. After all abnormal ASs in the abnormal AS set are accessed, all related second legal paths and abnormal ASs in the abnormal AS set have been added, and the abnormal AS subgraph can be constructed using the node set V and the edge set E at this time.

[0143] In the embodiment of the present application, the abnormal AS subgraph can be visualized using a force-directed graph tool based on the node set V and the edge set E. Since the ASs upstream in the network often establish peer relationships with multiple tier-1 ASs, the number of edges involved is large, and the connection relationship is complex, therefore, the ASs that exist in peer relationships with each other are separately drawn, which is more helpful to reflect the AS hierarchical relationship.

[0144] like Figure 6 As shown, it is a visualized abnormal AS subgraph provided in an embodiment of this application. Figure 6 Dark nodes represent normal AS nodes, while light nodes represent abnormal AS nodes. Edges between any two AS nodes point from the customer to the provider, and two peer AS nodes are connected by dashed lines.

[0145] S204: Based on the number of interruptions of each abnormal AS and the upstream and downstream relationships between each abnormal AS in the abnormal AS subgraph, determine the abnormal parameters of each abnormal AS, and trace the source of the interruption event according to the abnormal parameters.

[0146] The abnormal parameter is used to reflect the probability that the corresponding abnormal AS is the source of the interruption event. In this embodiment, the larger the abnormal parameter, the more interruptions the downstream abnormal AS has, and the greater the probability that the abnormal AS is the source of the interruption event.

[0147] In an optional implementation, embodiments of this application can determine abnormal parameters through an interrupt event tracing module:

[0148] For each abnormal AS, perform the following operation:

[0149] In the abnormal AS subgraph, the product of the number of interruptions of each abnormal AS downstream of the abnormal AS and the corresponding attenuation factor is used as the interruption propagation parameter; the sum of the number of interruptions of the abnormal AS and the interruption propagation parameter is used as the abnormal parameter.

[0150] Specifically, in this embodiment, abnormal ASs that have experienced outages are marked in the constructed abnormal AS subgraph, which allows for a direct visual observation of whether multiple abnormal ASs have a business relationship correlation. Simultaneously, the edge pointing relationship is defined as from an AS with a business state of "customer" to an AS with a business state of "provider," while edges between peers do not have a pointing relationship. The in-degree of each AS node represents the number of directly connected downstream ASs in its business relationship, and the out-degree represents the number of directly connected upstream ASs. For all abnormal ASs that have experienced outages, an abnormal parameter x is assigned equal to the number of times the AS experienced an outage. Then, all abnormal ASs are propagated one hop to their upstream provider ASs. For example, if the current AS's abnormal parameter is x, then the abnormal parameters of all its one-hop upstream nodes are increased by c*x, where c is a decay factor. Finally, the magnitude of the abnormal parameters of all ASs in the abnormal AS subgraph is statistically analyzed, which allows for a preliminary determination of the suspected source of the routing outage. The larger the abnormal parameter, the more outages have occurred in the AS itself or its directly connected downstream ASs, making it more worthy of attention.

[0151] like Figure 7As shown, it is another structure diagram of the method for detecting an interrupt event provided by the embodiment of the application. Figure 7 In the method, after the commercial relationship data is updated, AS commercial relationship data is collected, an adjacency list reflecting the topology of AS commercial relationship is constructed, a state transition table is pre-calculated based on the adjacency list and the no valley principle, and a cache acceleration mechanism is set. After the state transition table is stored locally, the state transition table is cached. An abnormal AS subgraph is constructed based on the abnormal AS set, the abnormal AS subgraph is visualized, and graph index analysis and tracing are performed.

[0152] The method for detecting an interrupt event in the application will be described below in combination with embodiments:

[0153] Step one: Collect AS commercial relationship data, parse and store in the database. Collect AS commercial relationship data from the CAIDA website, and update the latest commercial relationship data at the beginning of each month. Use a timing task to automatically collect the AS commercial relationship data file on the data storage server, and store the AS commercial relationship data with the update time in the database after parsing.

[0154] Step two: State transition table pre-calculation. After the AS commercial relationship data file is stored, the state transition table pre-calculation process is automatically started. For all ASs contained in the AS commercial relationship data file, three state transition nodes are established for each AS. The three states correspond to the state transition graph of the no valley principle, which are 1, 0, and -1, corresponding to c2p, p2p, and p2c relationships. Only the first legal path that meets the no valley principle is stored in the state transition table. The state transition table is stored in the form of an adjacency list, each node contains two pieces of information: the current AS number and the current path state, which is then converted into a json file and saved locally.

[0155] Step three: Obtain the abnormal AS set of the target time and space range. Obtain the abnormal AS set used to construct the AS subgraph. In this example, the AS that interrupts the abnormality constructs the abnormal AS subgraph, and the range is the AS that has experienced routing interruption in the country in the last month. Other types of abnormal AS sets such as hijacking and leakage can also be used to study other types of abnormal events.

[0156] Step four: Read the state transition table. Determine the AS commercial relationship and state transition table version to be used according to the time range of the given abnormal AS set. First, check whether the calculated state transition table exists in the cache. If not, check the local json file. If it exists, load the file and save it to the cache. At the same time, the number of cached files should not exceed the set upper limit, such as 10. If it exceeds, release the oldest cached file.

[0157] Step five: Building abnormal AS subgraph. Based on state transition table and BFS, the minimum abnormal AS subgraph is built. Take each abnormal AS in abnormal AS set as the start point of path, search the state transition table, and use BFS to search the first legal path starting from the AS. If the next hop AS is also abnormal, it is considered as a second legal path. Then use the predecessor node to reconstruct the complete path, and add the AS and edge on the path to the node set V and edge set E respectively. When all nodes in abnormal AS set are visited, all second legal paths and AS in abnormal AS set have been added. At this time, the abnormal AS subgraph can be built based on node set V and edge set E.

[0158] Step six: Relationship graph visualization. Based on node set V and edge set E, the returned abnormal AS subgraph can be visualized using force-directed relationship graph tools. For AS connected by p2p and interconnected with each other, it is considered to constitute a peer layer, and the coordinates of these nodes are calculated separately and fixed in the position of force-directed graph. In the visualization graph, abnormal AS in abnormal AS set is marked separately, and the c2p relationship of edge is indicated by arrow. The connection correlation of abnormal AS set can be obtained intuitively.

[0159] Step seven: Graph index analysis and interruption tracing. Based on node set V and edge set E, related properties can be calculated based on graph structure and AS clustering or tracing can be realized, for example:

[0160] (1) AS node in-degree: The in-degree of each AS in the graph (i.e. the number of customers when acting as a provider) and the proportion of abnormal AS are counted, and the connectivity and downstream abnormality index of AS can be obtained.

[0161] (2) AS node abnormal parameter: an abnormal parameter x is initially assigned to all abnormal AS in the subgraph, and the value of x is the number of routing interruption of the AS in the specified time range. The abnormal parameter of normal AS is 0. For all AS in abnormal AS subgraph, one-hop propagation of abnormal parameter is carried out, and the propagation direction is from customer AS to provider AS. For abnormal AS, multiply the abnormal parameter x corresponding to the terminal number by the propagation attenuation factor c and add it to its provider AS. Therefore, the abnormal parameter of AS in an abnormal AS subgraph is the sum of the propagation result of all one-hop downstream AS and the abnormal parameter corresponding to the terminal number of the AS, as shown in formula 1 below:

[0162]

[0163] Wherein, m is the number of abnormal ASs downstream of the AS as a provider, x0 is an abnormal parameter corresponding to the number of interruptions of the AS, x i is a terminal number of abnormal ASs downstream of the AS i as a provider.

[0164] Finally, the size of the abnormal parameter of all ASs in the abnormal AS subgraph is counted, that is, the suspected source AS of the routing interruption can be preliminarily judged. The larger the abnormal parameter is, the more interruptions occur in the AS itself or the directly connected downstream AS, and the AS is more worthy of attention.

[0165] (3) AS node layering and clustering: for ASs with peer relationships, the ASs involved and the p2p edges can be separately formed into a peer layer. According to whether all ASs in the peer layer are connected, the peer layer can be divided into multiple internally connected sub-peer layers. Taking the sub-peer layer as a reference, the customer AS of the current AS node is regarded as a downstream AS, and the provider AS is regarded as an upstream AS, so that the hierarchical division of the abnormal AS subgraph can be realized, which is helpful for analyzing the difference in the influence of ASs at different levels on the overall abnormal event. At the same time, with the aid of the hierarchy, the ASs in the abnormal AS subgraph can be clustered according to their network positions, and further analysis of whether the abnormal event has a clustering feature can be performed to provide a basis for abnormal reason analysis.

[0166] In the above embodiments, the embodiments of the application construct an abnormal AS subgraph in combination with the AS business relationship topology, which can cluster and trace the large-scale routing interruption event from the macro visual level, and can more effectively locate the main position of the abnormal occurrence in combination with the AS hierarchy to determine the event subject.

[0167] The embodiments of the application use the AS business relationship data to construct the AS business relationship topology, simplify the complex network path, avoid data distortion caused by single observation point when analyzing the complex routing path, and save huge spatial and temporal resource overhead when extracting the business relationship between ASs by means of routing data, thereby greatly improving the timeliness of the interruption tracing method and providing a data basis for its application in routing data real-time monitoring platforms.

[0168] The number of existing ASs in the whole network is about 100,000. For a route interruption event occurring in a period of time, the number of related interruption ASs is dozens to hundreds. In order to quickly locate all AS nodes possibly involved in the interruption, an abnormal AS subgraph containing all the interruption ASs needs to be extracted from the AS commercial relationship topology of the whole network. Meanwhile, in order to trace the interruption, the common upstream ASs of the ASs and the intermediate ASs on the second legal path need to be included in the abnormal AS subgraph. Embodiments of the present application can efficiently find the second legal path between all abnormal ASs in compliance with the no valley principle by using an abnormal AS subgraph construction method based on BFS and state transition graph, and comprehensively display the connection relationship between the AS nodes through a visual component in the front end, so as to intuitively locate the source of the route anomaly.

[0169] In view of the problem that the source of a large-scale route interruption event is difficult to identify, embodiments of the present application propose a BGP interruption tracing method based on a graph network, an AS commercial relationship topology of the whole network is constructed using AS commercial relationship data, and all second legal paths between abnormal AS node sets are searched based on BFS, and an abnormal AS subgraph is constructed. Meanwhile, the search process uses the no valley principle to individually establish all possible state transition graphs for each AS, and the search process of BFS is based on the state transition graph, so that the first legal path found complies with the no valley principle of AS commercial relationship. In the abnormal AS subgraph obtained, the direction of the edge is defined as from customer to provider, that is, the abnormal parameters of all AS nodes in the subgraph can be calculated by propagation, and then the upstream ASs that may have caused more ASs to be interrupted are determined, and the tracing of the large-scale route interruption event is realized.

[0170] Based on the same inventive concept, embodiments of the present application also provide a detection device for an interruption event, as shown in Figure 8 The detection device 8000 for the interruption event includes:

[0171] A construction unit 8001 is configured to construct a state transition table between all ASs based on the no valley principle by traversing all ASs in an acquired autonomous domain AS commercial relationship topology; the state transition table is used to describe first legal paths between all ASs; all ASs include abnormal ASs and normal ASs;

[0172] A first determination unit 8002 is configured to determine an abnormal AS set in which an interruption occurs in a target time-space range according to acquired route data;

[0173] A second determination unit 8003 is configured to determine second legal paths between any two abnormal ASs in the abnormal AS set in the AS commercial relationship topology based on the state transition table, and obtain an abnormal AS subgraph corresponding to the abnormal AS set based on each second legal path;

[0174] The tracing unit 8004 is configured to determine an abnormal parameter of each abnormal AS based on the number of interruptions of each abnormal AS in the abnormal AS subgraph and the upstream and downstream relationships between the abnormal ASs, and perform interruption event tracing according to the abnormal parameter; the abnormal parameter is used to reflect a probability that the corresponding abnormal AS is a source of the interruption event.

[0175] In some embodiments, the constructing unit 8001 is specifically configured to:

[0176] construct the standard path meeting the valley-free principle as a state transition graph;

[0177] for each AS in the set of ASs, perform the following operations:

[0178] take the AS as a current AS;

[0179] search for a next-hop AS of the current AS in the AS business relationship topology based on the state transition graph;

[0180] if the next-hop AS is searched, form an AS-path state pair by using a path state corresponding to a business state of the current AS and a business state of the next-hop AS, and take the next-hop AS as the current AS;

[0181] if the next-hop AS is not searched, connect at least one AS-path state pair to a state transition row according to the upstream and downstream relationships between the set of ASs;

[0182] combine the state transition rows into a state transition table.

[0183] In some embodiments, the path state includes a first path state, a second path state, and a third path state; the state transition graph is sequentially composed of at least one of the first path state, the second path state, and the third path state; the first path state indicates that a state transition is performed from an AS with a business state of a customer to an AS with a business state of a provider; the second path state indicates that a state transition is performed from an AS with a business state of a peer to an AS with a business state of a peer; and the third path state indicates that a state transition is performed from an AS with a business state of a provider to an AS with a business state of a customer.

[0184] In some embodiments, the second determining unit 8003 is specifically configured to:

[0185] take each abnormal AS as a path starting point respectively, and perform the following iteration operations on each abnormal AS respectively:

[0186] take the abnormal AS as a current AS;

[0187] search for a next-hop AS along a first legal path in the state transition table;

[0188] If the next-hop AS is a normal AS, record the path state corresponding to the business relationship of the current AS and the next-hop AS; take the current AS as a predecessor AS, and update the next-hop AS as the current AS;

[0189] If the next-hop AS is an abnormal AS, record the path state of the current AS corresponding to the business relationship of the current AS and the business relationship of the next-hop AS; take the current AS as a predecessor AS, and construct a second legal path based on at least one predecessor AS.

[0190] In some embodiments, the second determining unit 8003 is specifically configured to:

[0191] divide each normal AS and each abnormal AS in each second legal path into a node set of an abnormal AS subgraph, and divide the path state of each normal node and the path state of each abnormal node in each second legal path into an edge set of the abnormal AS subgraph;

[0192] construct the abnormal AS subgraph based on the node set and the edge set.

[0193] In some embodiments, the tracing unit 8004 is specifically configured to:

[0194] For each abnormal AS, perform the following operations:

[0195] take the product of the number of interruptions of each abnormal AS located downstream of the abnormal AS in the abnormal AS subgraph and the corresponding attenuation factor as an interruption propagation parameter;

[0196] take the sum of the number of interruptions of the abnormal AS and the interruption propagation parameter as an abnormal parameter.

[0197] In some embodiments, the constructing unit 8001 is specifically configured to:

[0198] determine whether the state transition table is stored in the cache;

[0199] If the state transition table is not stored in the cache, determine whether the state transition table is stored in the local file;

[0200] If the state transition table is stored in the local file, add the state transition table in the cache, and delete old cache files in the cache from far to near according to cache time, so that the number of cache files in the cache does not exceed a preset number threshold;

[0201] If the state transition table is not stored in the local file, the state transition table between all ASs is constructed by traversing all ASs in the AS business relationship topology of the autonomous domain AS obtained based on the no valley principle, and the state transition table is added in the cache, and old cache files in the cache are deleted from far to near according to the cache time, so that the number of cache files in the cache does not exceed the preset number threshold.

[0202] Based on the same inventive concept, the embodiment of the present application also provides an electronic device. In this embodiment, the structure of the electronic device can be as shown in the figure Figure 9 .

[0203] The memory 901 is used to store the computer programs executed by the processor 902. The memory 901 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system and programs required for running instant messaging functions, etc.; and the data storage area can store various instant messaging information and operation instruction sets, etc.

[0204] The memory 901 can be a volatile memory such as a random-access memory (RAM); the memory 901 can also be a non-volatile memory such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or the memory 901 can be any other medium capable of carrying or storing desired computer programs in the form of instructions or data structures and capable of being accessed by a computer, but is not limited to this. The memory 901 can be a combination of the above memories.

[0205] The processor 902 can include one or more central processing units (CPUs) or digital processing units, etc. The processor 902 is used to call the computer programs stored in the memory 901 to realize the detection method of the above-mentioned interrupt event.

[0206] The communication module 903 is used to communicate with terminal devices and other servers.

[0207] The specific connection medium between the above-mentioned memory 901, communication module 903 and processor 902 is not limited in the embodiment of the present application. In the embodiment of the present application, the memory 901 and the processor 902 are connected through a bus 904, and the bus 904 is connected to the memory 901 and the processor 902 through a bus interface 905. Figure 9 Figure 9 ​The connections between the other components are described by thick lines, which are merely illustrative and not limiting. The bus 904 can be divided into an address bus, a data bus, a control bus, etc. For the sake of description, Figure 9 Only one thick line is described, but only one bus or only one type of bus is not described.

[0208] The memory 901 stores a computer storage medium, and the computer storage medium stores computer executable instructions. The computer executable instructions are used to implement the interrupt event detection method in the embodiments of the present application. The processor 902 is used to execute the interrupt event detection method. Based on the same inventive concept, the embodiments of the present application provide a computer readable storage medium, and a computer program product includes computer program codes. When the computer program codes run on a computer, the computer program codes make the computer execute the interrupt event detection method as any one of the foregoing. Since the principle of solving problems of the computer readable storage medium is similar to that of the interrupt event detection method, the implementation of the computer readable storage medium can be referred to the implementation of the method, and the repeated parts will not be described herein.

[0209] The embodiments of the present application also provide a computer program product. The method in the present application can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, the method can be implemented in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer programs or instructions are loaded and executed on a computer, the flow or function described in the present application is executed in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user equipment, a core network device, an OAM or other programmable devices.

[0210] The computer readable storage medium can be an implementation of the computer program product. That is, the embodiments of the present application also provide a computer readable storage medium, which includes a computer program. When the computer program is executed by a processor, the interrupt event detection method as any one of the foregoing is implemented.

[0211] The computer program or instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another, e.g., from a website, computer, server, or datacenter to another website, computer, server, or datacenter via a wired or wireless arrangement. The computer readable storage medium can be any available medium or data storage device that can be accessed by a computer. By way of example, and not limitation, such computer readable storage media can comprise a random access memory (RAM), a read-only memory (ROM), an optical disc, a hard disk, a solid state drive, etc. The computer readable storage medium can be a computer readable storage medium that is external to the computer or a data storage device, such as a server, datacenter, etc., that includes one or more of the computer readable storage media.

[0212] Those skilled in the art will appreciate that embodiments of the present application can be readily used as a method, apparatus, or computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer readable storage media (including, but not limited to, disk memory, CD-ROMs, optical storage devices, etc.) embodying computer readable program code.

[0213] The present application is described in reference to the flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processing system or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams block or blocks. Figure 1 The flowchart illustrations and / or block diagrams of the methods, apparatus (systems) and computer program products according to embodiments of the application can also be implemented by computer readable program instructions stored on a computer readable storage medium (disk memory, CD-ROM, optical storage device, etc.) that are executed by a data processing apparatus (e.g., a programmable computer, a computer processor or other processing device). Figure 1 The flowchart illustrations and / or block diagrams of the methods, apparatus (systems) and computer program products according to embodiments of the application can also be implemented by computer readable program instructions stored on a computer readable storage medium (disk memory, CD-ROM, optical storage device, etc.) that are executed by a data processing apparatus (e.g., a programmable computer, a computer processor or other processing device).

[0214] The computer program instructions can also be loaded into a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 The flowchart illustrations and / or block diagrams of the methods, apparatus (systems) and computer program products according to embodiments of the application can also be implemented by computer readable program instructions stored on a computer readable storage medium (disk memory, CD-ROM, optical storage device, etc.) that are executed by a data processing apparatus (e.g., a programmable computer, a computer processor or other processing device). Figure 1 The flowchart illustrations and / or block diagrams of the methods, apparatus (systems) and computer program products according to embodiments of the application can also be implemented by computer readable program instructions stored on a computer readable storage medium (disk memory, CD-ROM, optical storage device, etc.) that are executed by a data processing apparatus (e.g., a programmable computer, a computer processor or other processing device).

[0215] These computer program instructions can also be loaded into a computer or other programmable data processing devices, so that a series of operational steps are performed on the computer or other programmable data processing devices to generate computer-implemented processes, thus the instructions executed on the computer or other programmable data processing devices provide processes for implementing the functions specified in the flowchart Figure 1 one or more flows and / or blocks Figure 1 one or more blocks or steps of the functions specified in the flowchart

[0216] Obviously, those skilled in the art can make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application belong to the scope of the claims of the present application and their equivalent technologies, the present application also intends to include these modifications and variations.

Claims

1. A method of detecting an interrupt event, characterized by, The method comprises: Based on the valley-free principle, the state transition table between all ASs in the obtained autonomous domain AS business relationship topology is constructed by traversing the all ASs; the state transition table is used to describe the first legal path between the all ASs; the all ASs include abnormal ASs and normal ASs; According to the obtained routing data, an abnormal AS set in which interruption occurs in a target time-space range is determined; Based on the state transition table, a second legal path between any two abnormal ASs in the abnormal AS set is determined in the AS business relationship topology, and an abnormal AS subgraph corresponding to the abnormal AS set is obtained based on each second legal path; Based on the number of interruptions of each abnormal AS in the abnormal AS subgraph and the upstream and downstream relationships between each abnormal AS, an abnormal parameter of each abnormal AS is determined, and the abnormal parameter is used for event traceability of the interruption event.

2. The method of claim 1, wherein, The method comprises: The standard path meeting the valley-free principle is constructed as a state transition graph; For each AS in the all ASs, the following operations are performed: The AS is taken as a current AS; Based on the state transition graph, a next-hop AS of the current AS is searched in the AS business relationship topology; If the next-hop AS is searched, an AS-path state pair is formed by a business state of the current AS and a path state corresponding to a business state of the next-hop AS, and the next-hop AS is taken as the current AS; If the next-hop AS is not searched, at least one AS-path state pair is connected as a state transition row according to the upstream and downstream relationships between the all ASs; Each state transition row is combined as the state transition table.

3. The method of claim 2, wherein, The path state comprises a first path state, a second path state, and a third path state; the state transition graph is sequentially composed of at least one of the first path state, the second path state, and the third path state; the first path state indicates that state transition is performed from an AS with a business state of a customer to an AS with a business state of a provider; the second path state indicates that state transition is performed from an AS with a business state of a peer to an AS with a business state of a peer; and the third path state indicates that state transition is performed from an AS with a business state of a provider to an AS with a business state of a customer.

4. The method of claim 1, wherein, The method comprises: Each abnormal AS is taken as a path starting point, and the following iteration operations are performed on each abnormal AS: The abnormal AS is taken as a current AS; In the state transition table, a next-hop AS is searched along the first legal path; If the next-hop AS is a normal AS, record a path state corresponding to a business relationship of the current AS and the next-hop AS; take the current AS as a predecessor AS, and update the next-hop AS as the current AS; If the next-hop AS is an abnormal AS, record a path state of the current AS corresponding to a business relationship of the current AS and a business relationship of the next-hop AS; take the current AS as a predecessor AS, and construct a second legal path based on at least one of the predecessor AS.

5. The method of claim 3, wherein, The abnormal AS subgraph corresponding to the abnormal AS set is obtained based on each of the second legal paths, and the abnormal AS subgraph comprises: each normal AS and each abnormal AS in each of the second legal paths are divided into a node set of the abnormal AS subgraph, and a path state of each normal node and a path state of each abnormal node in each of the second legal paths are divided into an edge set of the abnormal AS subgraph; the abnormal AS subgraph is constructed based on the node combination and the edge set.

6. The method of claim 1, wherein, The abnormal parameter of each abnormal AS is determined based on the abnormal AS subgraph, and the abnormal parameter of each abnormal AS comprises: for each abnormal AS, the following operations are performed: a product of the number of interruptions of each abnormal AS located downstream of the abnormal AS in the abnormal AS subgraph and a corresponding attenuation factor is taken as an interruption propagation parameter; a sum of the number of interruptions of the abnormal AS and the interruption propagation parameter is taken as the abnormal parameter.

7. The method according to any one of claims 1 to 5, characterized in that The state transition table between all ASs in the autonomous domain AS business relationship topology is constructed by traversing all ASs in the autonomous domain AS business relationship topology based on the no-valley principle, and the state transition table between all ASs comprises: determine whether the state transition table is stored in the cache; if the state transition table is not stored in the cache, determine whether the state transition table is stored in the local file; if the state transition table is stored in the local file, add the state transition table in the cache, and delete old cache files in the cache from far to near according to cache time, so that the number of cache files in the cache does not exceed a preset number threshold; if the state transition table is not stored in the local file, the state transition table between all ASs is constructed based on the no-valley principle by traversing all ASs in the autonomous domain AS business relationship topology, and the state transition table is added in the cache, and old cache files in the cache are deleted from far to near according to cache time, so that the number of cache files in the cache does not exceed a preset number threshold.

8. An apparatus for detecting an interruption event, characterized by comprise: a construction unit configured to construct a state transition table between all ASs in the autonomous domain AS business relationship topology based on the no-valley principle by traversing all ASs in the autonomous domain AS business relationship topology; the state transition table is used to describe a first legal path between the all ASs; the all ASs comprise: abnormal ASs and normal ASs; a first determination unit configured to determine an abnormal AS set in which an interruption occurs in a target time-space range according to obtained routing data; A second determining unit, configured to determine, based on the state transition table, a second legal path between any two of the abnormal ASs in the AS business relationship topology, and obtain an abnormal AS subgraph corresponding to the abnormal AS set based on each of the second legal paths; A tracing unit, configured to determine an abnormal parameter of each of the abnormal ASs based on the number of interruptions of each of the abnormal ASs in the abnormal AS subgraph and the upstream and downstream relationships between the abnormal ASs, and perform interruption event tracing according to the abnormal parameter; the abnormal parameter is used to reflect a probability that the corresponding abnormal AS is a source of an interruption event.

9. An electronic device, comprising: The method comprises the following steps: a memory, configured to store program instructions; a processor, configured to invoke the program instructions stored in the memory, and execute the steps of the method according to the obtained program instructions.

10. A computer readable storage medium having stored therein a computer program, characterized in that: The computer program is executed by the processor to implement the method in any one of claims 1-7.

Images