BGP route origin authentication diagnosis method based on feature analysis

Abstract

The application provides a BGP route origin authentication diagnosis method based on feature analysis, comprising the following steps: constructing a BGP route feature data set, training a route origin diagnosis model based on the BGP route feature data set, and adopting a three-level cascade gradient boosting tree algorithm to construct the route origin diagnosis model; wherein, when the first-level tree fuses basic features and historical behavior features, an attention mechanism is introduced, the basic features and the historical behavior features are fused and calculated based on dynamic weights, and a preliminary compliance probability is output; in the second-level tree, an improved gated recurrent unit (GRU) is adopted to process topology features, correlation analysis is performed based on the first-level output result and the processed topology features, and the determination threshold of abnormal routes is corrected; and a regularization term is introduced in the third-level tree to suppress overfitting. The application diagnoses the BGP route announcement to be diagnosed by using the trained diagnosis model. The application significantly improves the accuracy of BGP route origin authentication.

Description

Technical Field

[0001] This application belongs to the field of Internet inter-domain routing security technology, and more specifically, it relates to a BGP route origin authentication diagnosis method based on feature analysis. Background Technology

[0002] In the current network architecture, Border Gateway Protocol (BGP), as an inter-domain routing protocol, is a crucial foundation for achieving interconnectivity. The Internet consists of numerous Autonomous Systems (AS). These ASs rely on BGP to transmit routing update information and exchange AS-level route reachability information through border routers to complete inter-domain routing, thereby enabling network information reachability between different ASs.

[0003] However, the BGP protocol lacked sufficient consideration of security mechanisms in its initial design, and in actual operation, the corresponding protection mechanisms have not been fully utilized. This has resulted in the current internet facing numerous potential or existing security threats, among which route hijacking and other security issues are particularly prominent, seriously affecting network stability and security.

[0004] To address BGP routing security issues, existing technical solutions primarily rely on matching ROA (Route Origin Declaration) data with BGP route advertisements based on feature analysis. However, the high false positive rate of route origin verification leads to negative impacts such as network service quality interruptions, reducing its efficiency and accuracy. This has resulted in a decline in the adoption rate of setting up ROAs (Route Origin Declarations) for Internet routing table entries, hindering the promotion of RP-based feature analysis-based feature analysis KI (Internet Key Infrastructure) and ROV (Route Origin View) application deployments. Summary of the Invention

[0005] The purpose of this application is to provide a BGP route origin authentication diagnosis method based on feature analysis, which aims to solve the technical problems mentioned in the background art.

[0006] To achieve the above objectives, the embodiments of this application provide the following technical solutions.

[0007] According to one embodiment of this application, a BGP route origin authentication diagnosis method based on feature analysis is provided;

[0008] Includes the following steps:

[0009] Construct a BGP routing feature dataset, which contains multiple sets of sample data, each set of sample data corresponding to a BGP route advertisement, and each set of sample data includes at least basic features, topology features, and historical behavior features.

[0010] A route origin diagnostic model is trained based on the BGP route feature dataset. The route origin diagnostic model is constructed using a three-layer cascaded gradient boosting tree algorithm. In the first-level tree, when fusing basic features and historical behavior features, an attention mechanism is introduced to perform fusion calculations on basic features and historical behavior features based on dynamic weights, outputting an initial compliance probability. In the second-level tree, an improved gated recurrent unit (GRU) is used to process the topology features. Correlation analysis is performed based on the output of the first level and the processed topology features to correct the judgment threshold of abnormal routes. The third-level tree introduces a regularization term to suppress overfitting.

[0011] In the training of the diagnostic model, the basic features, topological features and historical behavioral features in the sample data are used as inputs, and the corresponding route origin compliance labels are used as outputs for training. The route origin compliance labels include valid, invalid and correction labels. The correction labels are used to mark false positive invalid samples that have been confirmed by manual review.

[0012] Obtain the BGP route advertisement to be diagnosed, extract the basic features, topological features and historical behavior features of the BGP route advertisement, input them into the trained route origin diagnosis model, and obtain the diagnosis results. The diagnosis results include legitimate routes, abnormal routes and routes to be verified, wherein the routes to be verified are routes that the model determines may have false positives.

[0013] Preferably, the basic features are the IP prefix, origin AS number, and prefix length contained in the BGP route advertisement; wherein, the IP prefix is ​​extracted using binary bitwise operations; and for the origin AS number, a trend feature value is calculated by combining the advertisement frequency change trend of the origin AS number within a certain period.

[0014] The topological features are the AS path attributes and the association relationships between adjacent ASs formed during the propagation of BGP route advertisements.

[0015] The historical behavior characteristics are the historical route announcement records associated with the IP prefix and the corresponding ROA verification results.

[0016] Preferably, the step of introducing an attention mechanism when fusing basic features and historical behavioral features in the first-level tree includes:

[0017] The basic features and historical behavior features are preprocessed to obtain the basic feature matrix and the historical behavior feature matrix;

[0018] In the constructed attention weight calculation layer, a dual-path neural network structure is adopted. In the first path, a weight bias module based on AS trust is constructed, an AS-level trust score library is introduced, and the trust score of the origin AS number matching is linearly mapped to generate the initial weight bias vector of the basic features. In the second path, an abnormal decay mechanism is introduced to assign a decay coefficient to the feature dimension that has invalid records within a time period.

[0019] The outputs from both paths are input into a single-hidden-layer neural network, and after fusion calculation, a basic feature attention weight vector is generated. Attention weight vector of historical behavioral features ;

[0020] A feature interaction enhancement strategy is adopted, utilizing weight vectors. and The basic feature matrix and historical behavior feature matrix are enhanced and fused. The fused feature matrix is ​​used as the input to the gradient boosting tree model of the first-level tree. A split priority mechanism based on feature security sensitivity is adopted, in which features with high route hijacking risk coefficient participate in node splitting first, and the initial compliance probability is output.

[0021] Preferably, in the second path, an abnormal attenuation mechanism is introduced, assigning an attenuation coefficient to the feature dimensions of invalid records occurring within the time period, expressed as:

[0022]

[0023] In the formula, c represents the number of records whose ROA validation result is invalid in the historical behavioral features corresponding to the feature dimension in the past month. This represents the preset maximum threshold for the number of invalid records; k represents the base decay factor.

[0024] Preferably, a feature interaction enhancement strategy is adopted, utilizing weight vectors. and The steps to enhance the basic feature matrix and historical behavior feature matrix include:

[0025] After element-wise multiplication of the basic feature matrix F1 and the weight vector W1, the cross features based on the binding relationship between the IP prefix and the AS number are superimposed to obtain the enhanced basic feature matrix; among which, the cross features are obtained by calculating the binding relationship between the IP prefix and the AS number through hash similarity.

[0026] After multiplying the historical behavior feature matrix F2 element by element with the vector weight W2, the time decay correlation features between historical invalid records and the current route are embedded to obtain the enhanced historical behavior feature matrix; where the correlation features are calculated using an exponential function based on the time difference.

[0027] Preferably, in the second-level tree, an improved gated recurrent unit (GRU) is used to process the topology features, and a correlation analysis is performed based on the first-level output results and the processed topology features to correct the threshold for determining abnormal routes. This includes the following steps:

[0028] The topological features are preprocessed in a structured manner, and the AS path attributes are converted into a triple sequence containing the AS hop count, the type of relationship between adjacent ASs, and the path stability score. The path stability score is calculated by the change frequency of the AS path. In the association relationship between adjacent ASs, the AS connection strength feature is introduced to construct the topological feature sequence matrix T.

[0029] An improved gated recurrent unit (GRU) is constructed, incorporating path safety factor adjustment terms into the GRU's update and reset gates. Specifically, the update gate calculation integrates the historical weights of routing anomalies of the current AS node, while the reset gate calculation incorporates the proportion of trusted paths within the AS. Simultaneously, a topology feature importance filtering mechanism is added to the GRU's hidden layer output. By calculating the mutual information value between each feature and the routing anomaly determination, the feature dimensions are retained based on the ranking of mutual information values, resulting in the processed topology feature matrix. ;

[0030] The initial compliance probability output from the first-level tree is converted into a probability feature vector P, which is then compared with the processed topological feature matrix. The association analysis matrix M is formed by concatenating rows; an association rule mining algorithm based on decision trees is used to extract the association patterns between preliminary compliance probabilities and topological features from matrix M.

[0031] A dynamic threshold correction model is constructed based on the discovered association patterns. When a preset association pattern is triggered, the threshold is adjusted according to the misjudgment rate corresponding to the pattern, and the corrected abnormal route judgment threshold is output.

[0032] Preferably, the step of constructing an improved gated recurrent unit (GRU) and adding a path safety factor adjustment term to the update gate and reset gate of the GRU includes:

[0033] Calculate the path security coefficient S, where each node in the AS path is assigned a corresponding security score based on the number of route hijacking events, ROA compliance rate, and connection ratio with trusted AS, and the average security score of each AS node is taken as the path security coefficient S.

[0034] Improved GRU update gate calculation, update gate Represented as:

[0035]

[0036] In the formula, This indicates updating the gate weight matrix. This indicates the hidden state at the previous moment. This represents the topological feature input at the current time. This indicates that the gate bias term is being updated. This represents the activation function. This indicates the update gate adjustment coefficient, and S represents the path safety factor adjustment term;

[0037] The improved GRU reset gate is represented as:

[0038]

[0039] In the formula, This represents the reset gate weight matrix. This indicates resetting the door bias term. This indicates the reset gate adjustment coefficient, and S indicates the path safety factor adjustment item.

[0040] Preferably, the step of extracting the association patterns between preliminary compliance probabilities and topological features from matrix M using a decision tree-based association rule mining algorithm includes:

[0041] The correlation analysis matrix M is preprocessed by discretization, and the initial compliance probability P is divided into 5 discrete levels according to intervals. The topological feature matrix is ​​then processed. The continuous features in the model are divided into three discrete intervals using the equal-frequency binning method. The discrete features are numerically encoded to obtain the discretization matrix M'.

[0042] An improved decision tree model is constructed, using the discrete levels of the initial compliance probability as the objective variable and the discretized results of the topological features as the input features. When splitting decision tree nodes, the information gain ratio, which incorporates route security weights, is used to assign weight coefficients to features highly correlated with route anomaly risk. The information gain ratio... The calculation formula is expressed as follows:

[0043]

[0044] In the formula, This represents the information gain of feature A. This represents the routing security weight coefficient for feature A. This represents the splitting information of feature A;

[0045] Extract association rules from the generated decision tree, and convert each path from the root node to the leaf node of the decision tree into an association rule; calculate the confidence and support of the rules;

[0046] A routing anomaly risk filtering mechanism is introduced to filter out association patterns that meet preset conditions; the filtered association patterns are stored in the pattern library for subsequent correction of the abnormal route judgment threshold.

[0047] Preferably, the BGP route origin authentication diagnosis method based on feature analysis further includes the following steps:

[0048] ROA data is stored using a preset hash index structure. This hash index structure uses the network address range with the IP prefix as the hash key to aggregate and store ROA data with the same network address range.

[0049] When the diagnostic result is a route to be verified, a targeted ROA matching query is performed on the IP prefix and origin AS number of the route to be verified based on the above hash index structure, and the diagnostic result is updated according to the query result.

[0050] Compared with existing technologies, the technical advantages of the BGP route origin authentication diagnosis method based on feature analysis in this application are as follows:

[0051] This application constructs a multi-dimensional dataset containing basic features, topological features, and historical behavior features, and achieves deep feature fusion through a three-level cascaded gradient boosting tree model. Specifically, an attention mechanism is introduced in the first-level tree, which adapts the correlation between basic features and historical behavior features based on dynamic weights, solving the problem of insufficient adaptation of different feature importance by traditional fixed-weight models. In the second-level tree, an improved GRU is used to process topological features, and the abnormal route judgment threshold is corrected in combination with the output of the first level, overcoming the misjudgment problem caused by insufficient utilization of the temporal correlation of topological features in existing technologies. In the third-level tree, a regularization term is introduced to suppress overfitting, improve the stability of the model in complex network environments, and has stronger generalization ability compared with single-structure models.

[0052] In summary, this application overcomes the problems of existing technologies, such as reliance on a single feature for route origin verification, weak model generalization ability, high false positive error tolerance mechanism, and poor adaptability, by using multi-dimensional feature fusion, intelligent model architecture innovation, false positive error tolerance mechanism, and dynamic threshold adjustment. It significantly improves the accuracy, robustness, and network adaptability of BGP route origin authentication. Attached Figure Description

[0053] The accompanying drawings, which form part of this application, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0054] In the attached diagram:

[0055] Figure 1 This is a flow chart illustrating the implementation of the BGP route origin authentication diagnosis method based on feature analysis in this application.

[0056] Figure 2 This is a sub-flowchart of the BGP route origin authentication diagnosis method based on feature analysis according to an embodiment of this application;

[0057] Figure 3 This is another sub-flowchart of the BGP route origin authentication diagnosis method based on feature analysis in this application embodiment. Detailed Implementation

[0058] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0059] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0060] According to the embodiments of this application, a method embodiment of a BGP route origin authentication diagnosis method based on feature analysis is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Also, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0061] Please refer to Figure 1 In one embodiment of this application, a BGP route origin authentication diagnosis method based on feature analysis is provided, including the following steps:

[0062] S101: Construct a BGP routing feature dataset, which contains multiple sets of sample data, each set of sample data corresponds to a BGP route advertisement, and each set of sample data includes at least basic features, topology features and historical behavior features.

[0063] In this embodiment, BGP route announcement messages of ships on the Internet are captured in real time using a BGP route acquisition tool, with each message serving as a sample data. The basic features are the IP prefix, origin AS number, and prefix length contained in the BGP route announcement. The IP prefix is ​​extracted using binary bitwise operations. For the origin AS number, a trend feature value is calculated by combining the announcement frequency trend of the origin AS number within a certain period.

[0064] The topological features are the AS path attributes and the association relationships between adjacent ASs formed during the propagation of BGP route advertisements.

[0065] The historical behavior characteristics are the historical route announcement records associated with the IP prefix and the corresponding ROA verification results.

[0066] S102: Train a route origin diagnostic model based on the BGP route feature dataset. The route origin diagnostic model is constructed using a three-level cascaded gradient boosting tree algorithm. In this application, a multi-dimensional dataset containing basic features, topological features, and historical behavior features is constructed, and feature deep fusion is achieved through a three-level cascaded gradient boosting tree model.

[0067] Specifically, in the diagnostic model constructed by the three-layer cascaded gradient boosting tree algorithm provided in the embodiments of this application:

[0068] When fusing basic features and historical behavior features in the first-level tree, an attention mechanism is introduced to calculate the fusion of basic features and historical behavior features based on dynamic weights and output the initial compliance probability.

[0069] Furthermore, this embodiment introduces an attention mechanism into the first-level tree, which, based on the correlation between basic features and historical behavioral features adapted to dynamic weights, solves the problem of insufficient adaptation of traditional fixed-weight models to the importance of different features.

[0070] In the second-level tree, an improved gated recurrent unit (GRU) is used to process the topology features. Based on the output of the first level, correlation analysis is performed with the processed topology features to correct the judgment threshold of abnormal routes. This application uses an improved GRU to process topology features in the second-level tree and combines the output of the first level to correct the judgment threshold of abnormal routes, thus overcoming the misjudgment problem caused by insufficient utilization of the temporal correlation of topology features in the prior art.

[0071] The third-level tree introduces a regularization term to suppress overfitting; this application introduces a regularization term in the third-level tree to suppress overfitting, improve the stability of the model in complex network environments, and has stronger generalization ability compared to a single-structure model.

[0072] Please continue to refer to Figure 1In this embodiment of the application, the BGP route origin authentication diagnosis method based on feature analysis further includes the following steps:

[0073] S103: In the training of the diagnostic model, the basic features, topological features and historical behavioral features in the sample data are used as inputs, and the corresponding route origin compliance labels are used as outputs for training. The route origin compliance labels include valid, invalid and correction labels. The correction labels are used to mark false positive invalid samples that have been confirmed by manual review.

[0074] In step S103 of this embodiment, for the model training process, the dataset is first divided into a training set and a validation set in a 7:3 ratio. The training set is used for learning the parameters of the diagnostic model, and the validation set is used to adjust the hyperparameters of the diagnostic model. When there is no performance improvement during continuous training, training is stopped and the optimal diagnostic model parameters are saved.

[0075] S104: Obtain the BGP route advertisement to be diagnosed, extract the basic features, topological features and historical behavior features of the BGP route advertisement, input them into the trained route origin diagnosis model, and obtain the diagnosis results. The diagnosis results include legitimate routes, abnormal routes and routes to be verified, wherein the routes to be verified are routes that the model determines may have false positives.

[0076] Furthermore, in step S104 of this application embodiment, the BGP route advertisement to be diagnosed is first extracted according to the feature extraction and processing method in step S101 to extract the basic features, topological features and historical behavior features of the BGP route advertisement to be diagnosed; the extracted features are input into the trained diagnostic model, and the final compliance probability is output.

[0077] Furthermore, the BGP route origin authentication diagnosis method based on feature analysis in this application embodiment also includes the following steps:

[0078] ROA data is stored using a preset hash index structure. This hash index structure uses the network address range with the IP prefix as the hash key to aggregate and store ROA data with the same network address range.

[0079] When the diagnostic result is a route to be verified, a targeted ROA matching query is performed on the IP prefix and origin AS number of the route to be verified based on the above hash index structure, and the diagnostic result is updated according to the query result.

[0080] In this embodiment, the network address range of the IP prefix is ​​used as the hash key to aggregate and store ROA data with the same network address range. This enables targeted and rapid location of the target IP prefix, significantly shortens the matching query time of the route to be verified, ensures the efficiency of the secondary verification process, and avoids the impact of query delay on the real-time performance of route diagnosis.

[0081] In addition, the targeted ROA matching query in this embodiment focuses on the IP prefix and origin AS number of the route to be verified. Combined with the aggregation storage characteristics of the hash index for network address segments, it can directly lock ROA data in the same network segment as the target IP prefix and eliminate interference information from irrelevant network segments.

[0082] In addition, this embodiment performs secondary verification and updates the diagnostic results by querying ROA data through hash index for the intermediate result of the route to be verified. This makes up for the uncertainty that may exist in the initial diagnosis of the model. It is especially suitable for boundary route cases. By verifying the ROA data, the risk of false positive or false negative diagnosis is further reduced, and the reliability of the overall route origin authentication is improved.

[0083] like Figure 2 As shown, in a preferred embodiment of this application, the step of introducing an attention mechanism when fusing basic features and historical behavioral features in the first-level tree specifically includes:

[0084] S201: Preprocess the basic features and historical behavior features to obtain the basic feature matrix and the historical behavior feature matrix;

[0085] S202: A dual-path neural network structure is used in the constructed attention weight calculation layer;

[0086] In one implementation, in the first path, a weight bias module based on AS trust is constructed, an AS-level trust scoring library is introduced, and the trust score of the origin AS number is linearly mapped to generate the initial weight bias vector of the basic feature. The first path improves the differential weight adaptation capability of the basic feature and enhances the sensitivity to malicious AS.

[0087] In one implementation, an abnormal attenuation mechanism is introduced in the second path to assign an attenuation coefficient to the feature dimensions of invalid records occurring within a time period; preferably, the abnormal attenuation mechanism introduced in the second path to assign an attenuation coefficient to the feature dimensions of invalid records occurring within a time period is expressed as follows:

[0088]

[0089] In the formula, c represents the number of records whose ROA validation result is invalid in the historical behavioral features corresponding to the feature dimension in the past month. This represents the preset maximum threshold for the number of invalid records; k represents the base decay factor.

[0090] This application embodiment uses a first path to weight basic features according to AS confidence level and a second path to attenuate historical behavior features according to recent anomaly level. This collaborative processing enables the attention mechanism to prioritize basic features with high confidence AS and filter out noisy features with too many historical anomalies when fusing features, ultimately improving the signal-to-noise ratio of the fused feature matrix.

[0091] Therefore, the dual-path mechanism in this embodiment can effectively improve the model's accuracy in identifying abnormal routes.

[0092] S203: The dual-path outputs are respectively input into a single-hidden-layer neural network, and after fusion calculation, a basic feature attention weight vector is generated. Attention weight vector of historical behavioral features ;

[0093] S204: Employs a feature interaction enhancement strategy, utilizing weight vectors. and The basic feature matrix and historical behavior feature matrix are enhanced and fused. The fused feature matrix is ​​used as the input to the gradient boosting tree model of the first-level tree. A split priority mechanism based on feature security sensitivity is adopted, in which features with high route hijacking risk coefficient participate in node splitting first, and the initial compliance probability is output.

[0094] For further details, please refer to Figure 3 In this embodiment, a feature interaction enhancement strategy is adopted, utilizing weight vectors. and The steps to enhance the basic feature matrix and historical behavior feature matrix include:

[0095] S301: After multiplying the basic feature matrix F1 and the weight vector W1 element by element, the cross features based on the binding relationship between the IP prefix and the AS number are superimposed to obtain the enhanced basic feature matrix; wherein, the cross features are obtained by calculating the binding relationship between the IP prefix and the AS number through hash similarity.

[0096] S302: After multiplying the historical behavior feature matrix F2 element by element with the vector weight W2, embed the time decay correlation features between the historical invalid records and the current route to obtain the enhanced historical behavior feature matrix; where the correlation features are calculated using an exponential function based on the time difference.

[0097] Furthermore, in this embodiment, in the second-level tree, an improved gated recurrent unit (GRU) is used to process the topology features. Based on the first-level output results and the processed topology features, a correlation analysis is performed to correct the judgment threshold of abnormal routes. The steps include: performing structured preprocessing on the topology features, converting AS path attributes into a triple sequence containing AS hop count, adjacent AS relationship type, and path stability score, wherein the path stability score is calculated by the change frequency of the AS path; and introducing AS connection strength features in the association relationship between adjacent ASs to construct a topology feature sequence matrix T.

[0098] An improved gated recurrent unit (GRU) is constructed, and a path safety factor adjustment term is added to the update gate and reset gate of the GRU. The calculation of the update gate incorporates the historical weight of the routing anomalies of the current AS node, and the calculation of the reset gate incorporates the proportion of trusted paths of the AS path.

[0099] Simultaneously, a topology feature importance filtering mechanism is added to the output of the GRU hidden layer. By calculating the mutual information value between each feature and the routing anomaly determination, the feature dimension is retained based on the ranking of mutual information values, resulting in the processed topology feature matrix. ;

[0100] The initial compliance probability output from the first-level tree is converted into a probability feature vector P, which is then compared with the processed topological feature matrix. The association analysis matrix M is formed by concatenating rows; an association rule mining algorithm based on decision trees is used to extract the association patterns between preliminary compliance probabilities and topological features from matrix M.

[0101] A dynamic threshold correction model is constructed based on the discovered association patterns. When a preset association pattern is triggered, the threshold is adjusted according to the misjudgment rate corresponding to the pattern, and the corrected abnormal route judgment threshold is output.

[0102] In an optional implementation, this embodiment constructs an improved gated recurrent unit (GRU), and the step of adding a path safety factor adjustment term to the update gate and reset gate of the GRU includes:

[0103] Calculate the path safety factor S;

[0104] In the step of calculating the path security coefficient S, each node in the AS path is first assigned a corresponding security score based on the number of route hijacking events, ROA compliance rate and the proportion of connections with trusted AS. Then, the average of the security scores of each AS node is taken as the path security coefficient S.

[0105] In this embodiment, the update gate calculation of GRU is improved, and the update gate... Represented as:

[0106]

[0107] In the formula, This indicates updating the gate weight matrix. This indicates the hidden state at the previous moment. This represents the topological feature input at the current time. This indicates that the gate bias term is being updated. This represents the activation function. This indicates the update gate adjustment coefficient, and S represents the path safety factor adjustment term;

[0108] In this embodiment, the improved GRU reset gate is represented as follows:

[0109]

[0110] In the formula, This represents the reset gate weight matrix. This indicates resetting the door bias term. This indicates the reset gate adjustment coefficient, and S indicates the path safety factor adjustment item.

[0111] In one implementation of this application, a decision tree-based association rule mining algorithm is used to extract the association pattern between the preliminary compliance probability and topological features from the matrix M. First, the association analysis matrix M is discretized and preprocessed, dividing the preliminary compliance probability P into five discrete levels according to intervals. Then, the topological feature matrix... The continuous features in the model are divided into three discrete intervals using the equal-frequency binning method. The discrete features are numerically encoded to obtain the discretization matrix M'.

[0112] Furthermore, this application constructs an improved decision tree model, using the discrete levels of the initial compliance probability as the target variable and the discretization results of the topological features as the input features.

[0113] When splitting decision tree nodes, this embodiment of the application uses the information gain rate calculation method of fusion route security weight to assign weight coefficients to features that are highly correlated with route anomaly risk;

[0114] In this embodiment of the application, the information gain rate The calculation formula is expressed as follows:

[0115]

[0116] In the formula, This represents the information gain of feature A. This represents the routing security weight coefficient for feature A. This represents the splitting information of feature A;

[0117] Extract association rules from the generated decision tree, and convert each path from the root node to the leaf node of the decision tree into an association rule; calculate the confidence and support of the rules;

[0118] A routing anomaly risk filtering mechanism is introduced to filter out association patterns that meet preset conditions. The filtered association patterns are stored in a pattern library for subsequent correction of the abnormal route judgment threshold. The preset conditions include: the support of the association rule is not less than 5% and the confidence level is not less than 70%. At the same time, the route anomaly misjudgment rate corresponding to the association rule must be more than 20% higher than the overall average misjudgment rate.

[0119] In summary, this application overcomes the problems of existing technologies, such as reliance on a single feature for route origin verification, weak model generalization ability, high false positive error tolerance mechanism, and poor adaptability, by using multi-dimensional feature fusion, intelligent model architecture innovation, false positive error tolerance mechanism, and dynamic threshold adjustment. It significantly improves the accuracy, robustness, and network adaptability of BGP route origin authentication.

[0120] Furthermore, in another embodiment of this application, a diagnostic device is also provided, which includes a processor, a memory, a network interface, an input device, and a display screen connected via a system bus.

[0121] The memory includes non-volatile storage media and internal memory. The non-volatile storage media of the computer device stores the operating system and may also store computer programs. When executed by the processor, these computer programs enable the processor to implement a feature-based BGP route origin authentication diagnostic method.

[0122] The internal memory may also store computer programs that, when executed by the processor, enable the processor to perform a BGP route origin authentication diagnostic method based on feature analysis.

[0123] Another embodiment of the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, causes the processor to perform the steps of the feature analysis-based BGP route origin authentication diagnostic method described above.

[0124] It should be understood that although the steps in the flowcharts of the various embodiments of the present invention are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the various embodiments may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least a portion of the sub-steps or stages of other steps.

[0125] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the BGP route origin authentication diagnosis method based on feature analysis described above.

[0126] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0127] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

[0128] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A BGP route origin authentication diagnosis method based on feature analysis, characterized in that, Includes the following steps: Construct a BGP routing feature dataset, which contains multiple sets of sample data, each set of sample data corresponding to a BGP route advertisement, and each set of sample data includes at least basic features, topology features, and historical behavior features. A route origin diagnostic model is trained based on the BGP route feature dataset. The route origin diagnostic model is constructed using a three-layer cascaded gradient boosting tree algorithm. In the first-level tree, when fusing basic features and historical behavior features, an attention mechanism is introduced to perform fusion calculations on basic features and historical behavior features based on dynamic weights, outputting an initial compliance probability. In the second-level tree, an improved gated recurrent unit (GRU) is used to process the topology features. Correlation analysis is performed based on the output of the first level and the processed topology features to correct the judgment threshold of abnormal routes. The third-level tree introduces a regularization term to suppress overfitting. In the training of the diagnostic model, the basic features, topological features and historical behavioral features in the sample data are used as inputs, and the corresponding route origin compliance labels are used as outputs for training. The route origin compliance labels include valid, invalid and correction labels. The correction labels are used to mark false positive invalid samples that have been confirmed by manual review. Obtain the BGP route advertisement to be diagnosed, extract the basic features, topological features and historical behavior features of the BGP route advertisement, input them into the trained route origin diagnosis model, and obtain the diagnosis results. The diagnosis results include legitimate routes, abnormal routes and routes to be verified, wherein the routes to be verified are routes that the model determines may have false positives.

2. The BGP route origin authentication diagnosis method based on feature analysis according to claim 1, characterized in that, The basic features are the IP prefix, origin AS number, and prefix length contained in the BGP route advertisement; among them, the IP prefix is ​​extracted using binary bitwise operations; for the origin AS number, the trend feature value is calculated by combining the advertisement frequency change trend of the origin AS number within a certain period. The topological features are the AS path attributes and the association relationships between adjacent ASs formed during the propagation of BGP route advertisements. The historical behavior characteristics are the historical route announcement records associated with the IP prefix and the corresponding ROA verification results.

3. The BGP route origin authentication diagnosis method based on feature analysis according to claim 2, characterized in that, When fusing basic features and historical behavioral features in the first-level tree, the steps of introducing an attention mechanism include: The basic features and historical behavior features are preprocessed to obtain the basic feature matrix and the historical behavior feature matrix; In the constructed attention weight calculation layer, a dual-path neural network structure is adopted. In the first path, a weight bias module based on AS trust is constructed, an AS-level trust score library is introduced, and the trust score of the origin AS number matching is linearly mapped to generate the initial weight bias vector of the basic features. In the second path, an abnormal decay mechanism is introduced to assign a decay coefficient to the feature dimension that has invalid records within a time period. The outputs from both paths are input into a single-hidden-layer neural network, and after fusion calculation, a basic feature attention weight vector is generated. Attention weight vector of historical behavioral features ; A feature interaction enhancement strategy is adopted, utilizing weight vectors. and The basic feature matrix and historical behavior feature matrix are enhanced and fused. The fused feature matrix is ​​used as the input to the gradient boosting tree model of the first-level tree. A split priority mechanism based on feature security sensitivity is adopted, in which features with high route hijacking risk coefficient participate in node splitting first, and the initial compliance probability is output.

4. The BGP route origin authentication diagnosis method based on feature analysis according to claim 3, characterized in that, In the second path, an abnormal decay mechanism is introduced, assigning a decay coefficient to the feature dimensions of invalid records within a time period, expressed as: In the formula, c represents the number of records whose ROA validation result is invalid in the historical behavioral features corresponding to the feature dimension in the past month. This represents the preset maximum threshold for the number of invalid records; k represents the base decay factor.

5. The BGP route origin authentication diagnosis method based on feature analysis according to claim 4, characterized in that, A feature interaction enhancement strategy is adopted, utilizing weight vectors. and The steps to enhance the basic feature matrix and historical behavior feature matrix include: After element-wise multiplication of the basic feature matrix F1 and the weight vector W1, the cross features based on the binding relationship between the IP prefix and the AS number are superimposed to obtain the enhanced basic feature matrix; among which, the cross features are obtained by calculating the binding relationship between the IP prefix and the AS number through hash similarity. After multiplying the historical behavior feature matrix F2 element by element with the vector weight W2, the time decay correlation features between historical invalid records and the current route are embedded to obtain the enhanced historical behavior feature matrix; where the correlation features are calculated using an exponential function based on the time difference.

6. The BGP route origin authentication diagnosis method based on feature analysis according to claim 5, characterized in that, In the second-level tree, an improved gated recurrent unit (GRU) is used to process the topology features. Based on the first-level output and the processed topology features, a correlation analysis is performed to correct the threshold for determining abnormal routes. This includes the following steps: The topological features are preprocessed in a structured manner, and the AS path attributes are converted into a triple sequence containing the AS hop count, the type of relationship between adjacent ASs, and the path stability score. The path stability score is calculated by the change frequency of the AS path. In the association relationship between adjacent ASs, the AS connection strength feature is introduced to construct the topological feature sequence matrix T. An improved gated recurrent unit (GRU) is constructed, incorporating path safety factor adjustment terms into the GRU's update and reset gates. Specifically, the update gate calculation integrates the historical weights of routing anomalies of the current AS node, while the reset gate calculation incorporates the proportion of trusted paths within the AS. Simultaneously, a topology feature importance filtering mechanism is added to the GRU's hidden layer output. By calculating the mutual information value between each feature and the routing anomaly determination, the feature dimensions are retained based on the ranking of mutual information values, resulting in the processed topology feature matrix. ; The initial compliance probability output from the first-level tree is converted into a probability feature vector P, which is then compared with the processed topological feature matrix. The association analysis matrix M is formed by concatenating rows; an association rule mining algorithm based on decision trees is used to extract the association patterns between preliminary compliance probabilities and topological features from matrix M. A dynamic threshold correction model is constructed based on the discovered association patterns. When a preset association pattern is triggered, the threshold is adjusted according to the misjudgment rate corresponding to the pattern, and the corrected abnormal route judgment threshold is output.

7. The BGP route origin authentication diagnosis method based on feature analysis according to claim 6, characterized in that, The steps for constructing an improved gated recurrent unit (GRU) and adding path safety factor adjustment terms to the GRU's update and reset gates include: Calculate the path security coefficient S, where each node in the AS path is assigned a corresponding security score based on the number of route hijacking events, ROA compliance rate, and connection ratio with trusted AS, and the average security score of each AS node is taken as the path security coefficient S. Improved GRU update gate calculation, update gate Represented as: In the formula, This indicates updating the gate weight matrix. This indicates the hidden state at the previous moment. This represents the topological feature input at the current time. This indicates that the gate bias term is being updated. This represents the activation function. This indicates the update gate adjustment coefficient, and S represents the path safety factor adjustment term; The improved GRU reset gate is represented as: In the formula, This represents the reset gate weight matrix. This indicates resetting the door bias term. This indicates the reset gate adjustment coefficient, and S indicates the path safety factor adjustment item.

8. The BGP route origin authentication diagnosis method based on feature analysis according to claim 7, characterized in that, The steps for extracting the association patterns between preliminary compliance probabilities and topological features from matrix M using a decision tree-based association rule mining algorithm include: The correlation analysis matrix M is preprocessed by discretization, and the initial compliance probability P is divided into 5 discrete levels according to intervals. The topological feature matrix is ​​then processed. The continuous features in the model are divided into three discrete intervals using the equal-frequency binning method. The discrete features are numerically encoded to obtain the discretization matrix M'. An improved decision tree model is constructed, using the discrete levels of the initial compliance probability as the objective variable and the discretized results of the topological features as the input features. When splitting decision tree nodes, the information gain ratio, which incorporates route security weights, is used to assign weight coefficients to features highly correlated with route anomaly risk. The information gain ratio... The calculation formula is expressed as follows: In the formula, This represents the information gain of feature A. This represents the routing security weight coefficient for feature A. This represents the splitting information of feature A; Extract association rules from the generated decision tree, and convert each path from the root node to the leaf node of the decision tree into an association rule; calculate the confidence and support of the rules; A routing anomaly risk filtering mechanism is introduced to filter out association patterns that meet preset conditions; the filtered association patterns are stored in the pattern library for subsequent correction of the abnormal route judgment threshold.

9. The BGP route origin authentication diagnosis method based on feature analysis according to claim 8, characterized in that, The feature-based BGP route origin authentication diagnostic method also includes the following steps: ROA data is stored using a preset hash index structure. This hash index structure uses the network address range with the IP prefix as the hash key to aggregate and store ROA data with the same network address range. When the diagnostic result is a route to be verified, a targeted ROA matching query is performed on the IP prefix and origin AS number of the route to be verified based on the hash index structure described above, and the diagnostic result is updated according to the query result.

Images