Method and system for detecting data exception in border gateway protocol, and storage medium
By extracting multi-source information from the border gateway protocol and generating interpretable detection results using time-series prediction and anomaly detection models, the problem of low accuracy and low reliability of detection results in existing technologies is solved, achieving higher detection accuracy and dynamic adaptability.
Patent Information
- Application Number
- CN202511541283.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-27
- Publication Date
- 2026-02-10
AI Technical Summary
Existing methods for detecting data anomalies in border gateway protocols rely on statistical theory and machine learning, which have poor adaptability, low accuracy, and lack of interpretability, resulting in low reliability of the detection results.
By extracting the data to be detected from the border gateway protocol and combining it with multi-source information such as quantity-related features, autonomous system path attributes, behavioral information and historical time series, the predicted time series and residuals are generated using time series prediction models and anomaly detection models, and interpretable detection results are generated through inference models.
It improves the accuracy and dynamic adaptability of data anomaly detection, provides an interpretable detection process, and enhances the responsiveness of network operations and maintenance personnel.
Smart Images
Figure CN121508917A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer technology, and in particular to methods, systems and storage media for detecting data anomalies in border gateway protocols. Background Technology
[0002] As the default external gateway protocol on the current Internet, the stability and security of the Border Gateway Protocol (BGP) are crucial to the normal operation of the entire network. However, due to the limitations of the protocol's design and the increasingly complex network environment, anomalies occur frequently. Therefore, effective monitoring and anomaly detection of data within the BGP has become an important research direction in the field of network security.
[0003] Traditional border gateway protocols rely primarily on statistical theories for data anomaly detection, which is poorly adapted to dynamically changing networks. Subsequently, with the development of artificial intelligence, machine learning has also been applied to data anomaly detection in border gateway protocols. Machine learning rules can be used to detect anomalies, and historical data can be used to train models to recognize anomalies. However, both of these methods have low domain adaptability, rely on limited information sources, resulting in low accuracy and uninterpretable detection processes, leading to low reliability of the results. Summary of the Invention In view of this, the purpose of this application is to propose a method, system, and storage medium for detecting data anomalies in border gateway protocols. This method integrates multiple forms of information in the data to be detected, improves the accuracy of the detection results, and utilizes natural language generation capabilities to output an interpretable detection process, thereby enhancing the response and handling capabilities of network operation and maintenance personnel for data anomalies in border gateway protocols.
[0004] To achieve one of the aforementioned objectives, this application provides a method for detecting data anomalies in a border gateway protocol, the method comprising: Obtain the data to be detected from the border gateway protocol; Extract quantity-related features and path attribute-related features of the autonomous system from the data to be detected; Generate the time series to be detected and the behavioral information of multiple autonomous systems based on the features; Based on the behavioral information, a suspicious autonomous system is selected from among the multiple autonomous systems; Obtain a set of historical time series data, and then query the set of historical time series data for the most similar historical time series data to the time series to be tested. The time series to be tested is input into the trained time series prediction model to generate a predicted time series; Calculate the residuals between the predicted time series and the actual time series; The time series to be tested is input into a trained anomaly detection model, and the anomaly detection model outputs the anomaly state of the time series to be tested. The multiple time series to be tested, the suspected autonomous system, the similar historical time series, the residuals, and the abnormal states are integrated into the prompt. The prompt is input into the inference model, and the inference model generates a comprehensive detection result and an inference process expressed in natural language.
[0005] As a further improvement to one embodiment of this application, before inputting the time series to be tested into the trained time series prediction model, the following steps are included: Select historical time series without anomalies as training time series; The training time series is input as a natural language string into the time series prediction model to be trained; Freeze the multi-head attention layer and feedforward network layer of the time-series prediction model to be trained, and adjust the position embedding layer, residual connection and layer normalization layer in the time-series prediction model to be trained according to the training time series to obtain the trained time-series prediction model.
[0006] As a further improvement to one embodiment of this application, before inputting the time series to be tested into the trained anomaly detection model, the following steps are included: Historical time series with identified anomaly types and historical time series without anomalies were selected as the first training parameters. We selected expertise on border gateway protocols and network anomaly types as the second training parameter; Inject a low-rank matrix into the anomaly detection model to be trained; The parameters of the low-rank matrix are updated using the first training parameters and the second training parameters to obtain the trained anomaly detection model.
[0007] As a further improvement to one embodiment of this application, before injecting the low-rank matrix into the anomaly detection model to be trained, the following steps are included: The anomaly detection model to be trained is subjected to integer quantization. A low-rank adaptive adapter is injected into the target layer of the anomaly detection model to be trained. The output of the target layer is calculated according to the following formula: ; Where x is the given input, These are the weights of the frozen portion in the second trained language model. and Let r be the trainable low-rank decomposition matrix, r be the rank of the low-rank adaptive adapter, and α be the scaling factor.
[0008] As a further improvement to one embodiment of this application, the step of generating the time series to be detected based on the features includes: Based on the aforementioned characteristics, a complete time series is generated; The complete time series is decomposed multiple times in a recursive manner to generate multiple time series to be tested at different time scales; The complete time series and the time series to be tested are processed by discrete wavelet transform to obtain the global trend approximation component and local change detail component of the complete time series and each of the time series to be tested.
[0009] As a further improvement to one embodiment of this application, after generating the time series to be detected based on the features, the process includes: The burst factor of the time series under test is calculated according to the following formula; ; Wherein, B is the aforementioned suddenness factor. σ represents the mean of the time series to be tested, and σ represents the standard deviation. The sudden factor is integrated into the prompt.
[0010] As a further improvement of one embodiment of this application, the behavioral information includes the number of times each of the autonomous systems in the plurality of autonomous systems changes as a source autonomous system, and the number of times each of the autonomous systems in the plurality of autonomous systems violates business relationships; The step of selecting a suspicious autonomous system from multiple autonomous systems based on the behavioral information includes: The behavioral information is input into the autonomous system analysis model, and the autonomous system analysis model outputs the suspicious autonomous system.
[0011] As a further improvement of one embodiment of this application, the historical time series set includes multiple historical time series, text descriptions corresponding to the historical time series, and labels used to indicate abnormal or normal types.
[0012] Based on the same inventive concept, this application also provides a data anomaly detection system in a border gateway protocol, comprising: The acquisition module is used to acquire the data to be detected in the border gateway protocol; The extraction module is used to extract quantity-related features and path attribute-related features of the autonomous system from the data to be detected; The first generation module is used to generate the time series to be detected and the behavioral information of multiple autonomous systems based on the features; The first selection module is used to select a suspicious autonomous system from among the multiple autonomous systems based on the behavioral information; The query module is used to obtain a set of historical time series and query the set of historical time series that has the highest similarity to the time series to be tested. The second generation module is used to input the time series to be tested into the trained time series prediction model to generate a predicted time series. The first calculation module is used to calculate the residual between the predicted time series and the actual time series; The output module is used to input the time series to be tested into the trained anomaly detection model, and the anomaly detection model outputs the anomaly state of the time series to be tested. The reasoning module is used to integrate multiple time series to be tested, the suspected autonomous system, the similar historical time series, the residuals and the abnormal states into a prompt, input the prompt into the reasoning model, and the reasoning model generates a comprehensive detection result and a reasoning process expressed in natural language.
[0013] Based on the same inventive concept, this application also provides a non-transitory computer-readable storage medium storing computer instructions for causing a computer to execute the data anomaly detection method in any of the border gateway protocols described above.
[0014] Compared to existing technologies, the technical advantages of this invention are as follows: First, the behavioral information of the time series to be tested and the autonomous system is extracted from the data to be tested in the border gateway protocol as raw data; then, the residuals between the suspected autonomous system, the similar historical time series, the actual time series and the normal predicted time series, and the abnormal states detected by the model are obtained using the time series to be tested and the autonomous system as multi-source inputs and input into the inference model. This integrates the comprehensive decision-making ability of multi-dimensional information, resulting in detection results with higher accuracy and better dynamic adaptability. Moreover, it can generate the reasoning process expressed in natural language, improving the trustworthiness of the detection results and helping network operation and maintenance personnel to quickly take effective countermeasures. Attached Figure Description
[0015] To more clearly illustrate the technical solutions in this application or related technologies, the drawings used in the description of the implementation methods or related technologies will be briefly introduced below. Obviously, the drawings described below are only the implementation methods of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0016] Figure 1 A flowchart illustrating a data anomaly detection method in a border gateway protocol provided in one embodiment of this application; Figure 2A framework diagram of a data anomaly detection method in a border gateway protocol provided for another embodiment of this application; Figure 3 A flowchart of a training time-series prediction model provided in another embodiment of this application; Figure 4 A flowchart illustrating the training of an anomaly detection model provided in another embodiment of this application; Figure 5 A schematic diagram of a data anomaly detection system in a border gateway protocol provided for an embodiment of this application; Figure 6 This is a schematic diagram of the hardware structure of an electronic device provided for an embodiment of this application. Detailed Implementation
[0017] The present invention will now be described in detail with reference to the specific embodiments shown in the accompanying drawings. However, these embodiments do not limit the present invention, and any structural, methodological, or functional modifications made by those skilled in the art based on these embodiments are included within the scope of protection of the present invention.
[0018] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this application should have the ordinary meaning understood by those skilled in the art to which this application pertains. The terms "first," "second," and similar terms used in the embodiments of this application do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects.
[0019] This application provides a method for detecting data anomalies in a border gateway protocol, such as... Figure 1 and Figure 2 As shown, it includes the following steps: Step S100: Obtain the data to be detected from the border gateway protocol.
[0020] Specifically, the Border Gateway Protocol (BGP) is the default external gateway protocol in the current Internet, serving as a routing protocol between different Autonomous Systems. BGP data consists of routing information and related control messages exchanged between these Autonomous Systems. Types of BGP data anomalies include prefix hijacking, BGP leaks, worm virus impacts, or link failures. Information transmitted to the wrong Autonomous System can lead to problems such as information leakage, network attacks, or network congestion.
[0021] In one possible implementation of this application, the border gateway protocol data to be detected is obtained from a publicly available data source, such as Route Views or RIPE NCC.
[0022] Step S200: Extract features related to quantity and features related to the path attributes of the autonomous system from the data to be detected.
[0023] Specifically, the features in the border gateway protocol data are mainly divided into two categories: quantitative features and autonomous system path attribute features (examples are shown in Table 1), which can reflect the dynamic changes in information transmission between autonomous systems in the border gateway protocol.
[0024] Table 1 - Contents of quantitative features and contents of path attribute features of autonomous systems
[0025] Step S300: Generate the time series to be detected and the behavioral information of multiple autonomous systems based on the features.
[0026] Specifically, after proposing the aforementioned features, a time series corresponding to the data to be detected is generated. In the Border Gateway Protocol (BGP), a time series refers to a set of data points related to routing information recorded chronologically, documenting changes in routing at specific points in time. For example, a time series might record a series of events such as: at a specific point in time, an Autonomous System (AS) announces a certain IP address; at a subsequent specific point in time, another AS also announces the same IP address; at yet another specific point in time, the other AS retracts its announcement of the IP address, and so on. This includes the AS, its actions, and the IP addresses involved.
[0027] In one possible implementation of this application, in order to enable the subsequent model utilizing the time series to be detected to capture the global trend and local abrupt changes in the data to be detected, step S300 generates the time series to be detected based on features, including: Step S311: Generate a complete time series based on the features.
[0028] Step S312 involves recursively decomposing the complete time series multiple times to generate multiple time series to be tested at different time scales.
[0029] Step S313: Use discrete wavelet transform to process the complete time series and the time series to be tested to obtain the global trend approximation component and local change detail component of the complete time series and each time series to be tested.
[0030] Specifically, discrete wavelet transform (DWT) is used for multi-scale analysis of the time series to be detected. First, a low-pass filter is used to obtain the approximate global trend component of the complete time series, and a high-pass filter is used to obtain the detailed components of local changes, thus revealing the global trend and local abrupt changes in the data. The complete time series is then decomposed into multiple shorter time series, and DWT is applied again to these shorter time series; this process is repeated for even shorter time series, and so on. This process is repeated recursively to obtain multiple time series at different time scales, providing richer information dimensions for subsequent models.
[0031] The calculation formula for processing the time series under test using discrete wavelet transform is as follows: ; in, is the processed time series to be tested, a is the scaling factor used to stretch or scale the event series to be tested, b is the translation factor used to move the position of the time series to be tested on the time axis, and (tb) is the translation of the processed time series to be tested on the time axis.
[0032] In one possible implementation of this application, the behavioral information includes the number of times each autonomous system in the multiple autonomous systems changes as a source autonomous system, and the number of times each autonomous system in the multiple autonomous systems violates business relationships.
[0033] Specifically, a source autonomous system (AAS) is an AAS that acts as the source in an AAS path. Most AASs act as intermediate routes within these paths, frequently changing their roles. However, the source of transmission remains relatively stable, ensuring consistent information delivery. If an AAS frequently announces changes in its role as a source AAS, it indicates frequent changes in its transmission method, path, and destination, increasing its suspicion. Furthermore, AASs that repeatedly violate agreed-upon business agreements should also be considered highly suspicious and subject to scrutiny.
[0034] Specifically, step S300, which generates behavioral information for multiple autonomous systems based on features, includes: Step S321: Detect changes in the source autonomous system in the features, count the number of times each autonomous system changes as a source autonomous system, and sort them in descending order.
[0035] Step S322: Obtain the business relationships of multiple autonomous systems from the public dataset.
[0036] Step S324: Extract autonomous systems that violate business relationships from the features, count the number of violations for each autonomous system and sort them in descending order.
[0037] Specifically, among the features related to quantity, the number of declared prefixes and the number of withdrawn prefixes are recorded. Among the features related to the path attributes of autonomous systems, the source autonomous systems are recorded. From the above, we can know the changes in the source autonomous systems and count the number of times each autonomous system changes as a source autonomous system, which serves as a reference value for judging whether it is suspicious.
[0038] Public datasets on the Internet (such as CAIDA) are highly accurate and comprehensive, covering traffic data across various network protocols and application scenarios. These datasets allow users to query the business relationships of multiple autonomous systems and the number of times an autonomous system violates these relationships, serving as a reference value for determining whether such violations are permissible.
[0039] In one possible implementation of this application, it is also necessary to sort the number of changes of different autonomous systems as source autonomous systems in descending order, and to sort the number of violations of business relationships of different autonomous systems in descending order. Autonomous systems with more changes as source autonomous systems are more likely to be suspicious autonomous systems, and autonomous systems with more violations of business relationships are more likely to be suspicious autonomous systems. Data with a higher probability of being suspicious is processed first to improve execution efficiency.
[0040] Step S400: Select a suspicious autonomous system from multiple autonomous systems based on the behavioral information.
[0041] Specifically, based on the behavior of autonomous systems, suspicious autonomous systems are identified. Suspicious autonomous systems may have anomalies in their internal structure or information transmission methods, or they may have malicious intent to attack, which could easily cause data anomalies in the border gateway protocol. Therefore, the suspicious autonomous systems selected in this step are used as a type of information source and input into the inference model to improve the accuracy and comprehensiveness of data anomaly detection.
[0042] In one possible implementation of this application, step S400 includes: Step S410: Input behavioral information into the autonomous system analysis model, and the autonomous system analysis model outputs suspicious autonomous systems.
[0043] Specifically, a trained autonomous system analysis model is used to process the behavioral information involved in step S300. The autonomous system analysis model can combine two reference values, namely the number of changes in the source autonomous system and the number of violations of business relationships, to obtain the suspected autonomous system.
[0044] In one possible implementation of this application, after generating the time series to be detected based on the features in step S300, the method further includes: Step S301: Calculate the burst factor of the time series to be tested according to the following formula;
[0045] Where B is the sudden factor, σ represents the mean of the time series to be tested, and σ represents the standard deviation. Step S302: Integrate the sudden factor into the prompt.
[0046] Specifically, a burst factor is calculated, which represents the suddenness of the time series being tested. This burst factor also serves as an information source input into the inference model, providing richer information dimensions and improving the accuracy and comprehensiveness of anomaly detection. For example, if B equals 0, it means the time series being tested is completely random; the closer B is to -1, the more pronounced the periodicity; and the closer B is to 1, the higher the suddenness.
[0047] Step S500: Obtain the historical time series set and query the historical time series set for the most similar historical time series to the time series to be tested.
[0048] Specifically, the most similar historical time series is found and used as an information source in the inference model to serve as an approximate reference. The inference model then integrates the similar historical time series with other information sources to obtain a comprehensive detection result with strong dynamic adaptability and high accuracy.
[0049] In one possible implementation of this application, a dynamic time warping algorithm is used to perform similarity retrieval in a historical time series set. The dynamic time warping algorithm can measure the similarity between two time series by calculating the minimum cumulative distance between them, and is particularly suitable for comparing sequences of unequal length or with phase shift.
[0050] The formula for the dynamic time warping algorithm is expressed as: ; in, To initialize the distance matrix, It is a certain element in the current time series. , or yes The possible previous pixel, There are two time series, and d is the Euclidean distance.
[0051] In one possible implementation of this application, the historical time series set includes multiple historical time series, textual descriptions corresponding to the historical time series, and labels used to indicate abnormal or normal types.
[0052] Specifically, the inference model has a strong natural language understanding ability. It provides contextual information to the inference model by using textual descriptions of similar historical time series and labels used to indicate abnormal or normal types, so that the inference model can understand similar historical time series more clearly and make more accurate inferences.
[0053] Step S600: Input the time series to be tested into the trained time series prediction model to generate the predicted time series.
[0054] Specifically, the time series to be tested within a specific time scale is input into a trained time series prediction model. The time series prediction model predicts the time series after the time series to be tested on the time axis. The prediction result obtained by the time series prediction model is a normally operating time series, and the predicted time series provides a benchmark of "normal behavior".
[0055] In one possible implementation of this application, a process of training a time-series prediction model is included before step 600, specifically including: Step S601: Select a historical time series without anomalies as the training time series.
[0056] Step S602: Input the training time series as a natural language string into the time series prediction model to be trained.
[0057] Step S603, as follows Figure 3 As shown, the multi-head attention layer and feedforward network layer of the time-series prediction model to be trained are frozen, and the position embedding layer, residual connection and layer normalization layer in the time-series prediction model to be trained are adjusted according to the training time series to obtain the trained time-series prediction model.
[0058] Specifically, the first step is to use historical time series without anomalies as the training set, so that the predicted time series of the large time prediction model are anomaly-free sequences.
[0059] Furthermore, the time series prediction model to be trained is a large language model, possessing the linguistic logic capabilities of a large language model. By freezing the multi-head attention layer and feedforward network layer of the time series prediction model to be trained, the core processing capabilities of the large language model are preserved. The positional embedding layer, residual connections, and layer normalization layer in the time series prediction model to be trained are fine-tuned to adjust its input representation and internal data distribution to adapt to numerical sequences. Fine-tuning the positional embedding layer helps the time series prediction model understand the order of time series and process longer time series, while fine-tuning the residual connections and layer normalization layer improves the stability of training for domain tasks. In this way, after inputting the training time series as natural language strings into the large language model, the powerful learning capabilities of the large language model are transferred to the time series prediction task, transforming language-to-language logical capabilities into time series-to-time series logical capabilities.
[0060] In one possible implementation of this application, the training time series is generated through a sliding window, converting the numerical time series into text strings to form a sequence-to-sequence language modeling task. The training process updates the trainable parameters by minimizing the standard autoregressive language model loss function. The objective function can be expressed as:
[0061] concentrated, This represents the set of trainable parameters for the time series prediction model to be trained, where t is the number of training iterations.
[0062] Step S700: Calculate the residuals between the predicted time series and the actual time series.
[0063] Specifically, the predicted "normal" sequence will be compared with the observed actual time series, and the residual between the two will be calculated. This residual is the difference between the actual time series and the normal baseline, which reflects the degree of abnormality of the actual time series.
[0064] It should be noted that the predicted time series obtained from a single time series prediction model provides a benchmark for normal behavior, but its accuracy and precision are limited. It cannot be directly used as the result of whether the actual time series is abnormal. However, it can serve as a highly valuable information source for the inference module. The inference module then combines other information sources to conduct comprehensive inference and obtain a comprehensive detection result with high accuracy and precision.
[0065] Step S800: Input the time series to be tested into the trained anomaly detection model, and the anomaly detection model outputs the anomaly state of the time series to be tested.
[0066] Specifically, by training an anomaly detection model, it is made capable of determining whether a time series under test is abnormal and identifying the type of anomaly. The output includes whether the time series under test is in a non-abnormal state, or whether the time series under test is in an abnormal state, and the type of abnormal state.
[0067] It should be noted that the anomaly detection model identifies the abnormal state of the time series to be detected and provides it to the inference module as a highly valuable source of information. The inference module then combines this information with other sources to arrive at a comprehensive detection result that is highly interpretable.
[0068] In one possible implementation of this application, such as Figure 4 As shown, before step S800, there is also a process of training an anomaly detection model, which specifically includes: Step S801: Select historical time series with determined anomaly types and historical time series without anomalies as the first training parameters.
[0069] Specifically, by using historical time series that have identified anomaly types or normal data as samples, the anomaly detection model to be trained can learn the precise mapping relationship from input features to anomaly types.
[0070] Step S802: Select expertise on border gateway protocols and network anomaly types as the second training parameter.
[0071] Specifically, by injecting expertise in border gateway protocols, network anomaly types, and time series data analysis into the anomaly detection model to be trained, it can understand the intrinsic relationships between multiple inputs and perform accurate multi-class tasks to distinguish different anomaly types.
[0072] Step S803: Inject a low-rank matrix into the anomaly detection model to be trained.
[0073] Step S804: Update the parameters of the low-rank matrix using the first and second training parameters to obtain the trained anomaly detection model.
[0074] Specifically, a low-rank adaptive method is employed to achieve efficient and low-cost fine-tuning of the anomaly detection model to be trained. This method freezes most of the original parameters of the anomaly detection model to be trained, injecting only small, trainable low-rank matrices into specific layers of the model (such as the attention matrix of the Transformer block). During training, only the parameters of the low-rank matrices are updated. This training method greatly reduces the number of parameters that need to be trained, significantly reduces computational resources and time costs, and effectively avoids the catastrophic forgetting problem, while preserving the general language capabilities of the anomaly detection model to be trained.
[0075] In summary, fine-tuning using a low-rank adaptive method enables effective domain adaptation of large language models even with limited computing resources, thus lowering the technical threshold.
[0076] In one possible implementation of this application, step S803 includes: Step S8031: Perform integer quantization on the anomaly detection model to be trained; Step S8032: Inject a low-rank adaptive adapter into the target layer of the anomaly detection model to be trained; Step S8033: Calculate the output of the target layer according to the following formula:
[0077] Where x is the given input, These are the weights of the frozen portion in the second trained language model. and Let r be a trainable low-rank matrix, r be the rank of the low-rank adaptive adapter, and α be a scaling factor.
[0078] Specifically, in order to further reduce hardware resource consumption, before applying the low-rank adaptive method, the anomaly detection model to be detected is first quantized with 4-digit or 8-digit integers, and the model weights are loaded in a low-precision format. Then, on the quantized model, a low-rank adaptive adapter is injected for the specified target layer (such as linear layers like q_proj and v_proj in the attention mechanism).
[0079] Step S900: Integrate multiple time series to be tested, suspected autonomous systems, similar historical time series, residuals and abnormal states into the prompt, input the prompt into the inference model, and the inference model generates a comprehensive detection result and an inference process expressed in natural language.
[0080] Specifically, after generating all information sources, a structured and information-rich cue is constructed and input into the inference model. This cue serves as a comprehensive context, integrating the time series to be detected, the suspected autonomous system, similar historical time series, residuals, and anomalous states. Based on this cue, the inference model is guided to perform logical reasoning.
[0081] In a concrete implementation, the reasoning model applies the mind chain prompting engineering technique, which requires step-by-step analysis: first, evaluating various information sources; then, explaining the likelihood that each piece of evidence points to; and finally, synthesizing all the information to draw a conclusion.
[0082] Ultimately, the inference model outputs a structured result that not only includes a final classification of data anomalies in the current border gateway protocol, but more importantly, it includes a detailed natural language explanation. This explanation clearly elucidates the complete logical chain that led to this judgment, provides key supporting evidence, and offers preliminary speculations on the root cause of the anomaly. This achieves explainable artificial intelligence and provides practical decision support for network operations personnel.
[0083] This application describes a method for detecting data anomalies in a border gateway protocol. This method not only analyzes the current time series but also incorporates similar historical time series. It utilizes a large model to predict future trends and another large model to determine anomaly states, integrating multi-dimensional information to make the model's decision-making basis more comprehensive. The accuracy and robustness of this method are significantly higher than traditional methods relying on a single information source. Furthermore, through an innovative fine-tuning scheme, it successfully transfers the general reasoning capabilities of a large language model to the highly specialized field of border gateway protocol data anomaly detection, enabling the large language model to deeply understand the inherent laws of this field and outperform direct application of general models. This method also solves the "black box" problem in traditional machine learning anomaly detection. By utilizing the most basic natural language generation capabilities of the large language model, it can not only determine the occurrence of anomalies but also provide detailed, clear, human-scaled explanatory reports explaining the type, characteristics, judgment basis, and possible causes of the anomalies. This greatly increases the trust of network operators in the detection results and provides direct decision support for subsequent troubleshooting and security responses.
[0084] Another embodiment of this application discloses a data anomaly detection system in a border gateway protocol, such as... Figure 5 As shown, it includes: The acquisition module is used to acquire the data to be detected in the Border Gateway Protocol. The extraction module is used to extract quantity-related features and path attribute-related features of the autonomous system from the data to be detected; The first generation module is used to generate the time series to be detected and the behavioral information of multiple autonomous systems based on the features; The first selection module is used to select a suspicious autonomous system from multiple autonomous systems based on behavioral information; The query module is used to obtain a set of historical time series and to search for the most similar historical time series to the time series to be tested. The second generation module is used to input the time series to be tested into the trained time series prediction model and generate the predicted time series. The first calculation module is used to calculate the residuals between the predicted time series and the actual time series; The output module is used to input the time series to be tested into the trained anomaly detection model, and the anomaly detection model outputs the anomaly status of the time series to be tested. The inference module integrates multiple test time series, suspicious autonomous systems, similar historical time series, residuals, and abnormal states into the prompts. The prompts are then input into the inference model, which generates a comprehensive detection result and an inference process expressed in natural language.
[0085] The implementation method of this application also includes: The second selection module is used to select historical time series without anomalies as training time series; The input module is used to input the training time series as a natural language string into the time series prediction model to be trained; The first adjustment module is used to freeze the multi-head attention layer and feedforward network layer of the time-series prediction model to be trained, and adjust the position embedding layer, residual connection and layer normalization layer in the time-series prediction model to be trained according to the training time series, so as to obtain the trained time-series prediction model.
[0086] The implementation method of this application also includes: The third selection module is used to select historical time series with determined anomaly types and historical time series without anomalies as the first training parameters. The fourth selection module is used to select expertise on border gateway protocols and network anomaly types as the second training parameters; The first injection module is used to inject a low-rank matrix into the anomaly detection model to be trained; The second adjustment module is used to update the parameters of the low-rank matrix using the first and second training parameters to obtain the trained anomaly detection model.
[0087] In one possible implementation of this application, the first injection module includes: The first processing module is used to perform integer quantization processing on the anomaly detection model to be trained. The second injection module is used to inject a low-rank adaptive adapter into the target layer of the anomaly detection model to be trained. The second calculation module is used to calculate the output of the target layer according to the following formula:
[0088] Where x is the given input, These are the weights of the frozen portion in the second trained language model. and Let r be a trainable low-rank matrix, r be the rank of the low-rank adaptive adapter, and α be a scaling factor.
[0089] In one possible implementation of this application, the first generation module includes: The third generation module is used to generate complete time series based on features; The decomposition module is used to decompose a complete time series multiple times in a recursive manner to generate multiple time series to be tested at different time scales. The second processing module is used to process the complete time series and the time series to be tested using discrete wavelet transform, so as to obtain the global trend approximation component and local change detail component of the complete time series and each time series to be tested.
[0090] The implementation method of this application also includes: The third calculation module calculates the burst factor of the time series under test according to the following formula;
[0091] Where B is the sudden factor, σ represents the mean of the time series to be tested, and σ represents the standard deviation. The integration module is used to integrate sudden factors into the prompts.
[0092] In one possible implementation of this application, the behavioral information in the first generation module includes the number of times each autonomous system in the multiple autonomous systems changes as a source autonomous system, and the number of times each autonomous system in the multiple autonomous systems violates business relationships.
[0093] The selected modules include: The input / output module is used to input behavioral information into the autonomous system analysis model, and the autonomous system analysis model outputs suspicious autonomous systems.
[0094] In one possible implementation of this application, the historical time series set in the query module includes multiple historical time series, text descriptions corresponding to the historical time series, and labels used to indicate abnormal or normal types.
[0095] Figure 6 This diagram illustrates a more specific hardware structure of an electronic device provided in this embodiment. The device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, memory 1020, input / output interface 1030, and communication interface 1040 are interconnected internally via the bus 1050.
[0096] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.
[0097] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.
[0098] The input / output interface 1030 is used to connect input / output modules to realize information input and output. The input / output modules can be configured as components in the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touch screens, microphones, various sensors, etc., and output devices may include displays, speakers, vibrators, indicator lights, etc.
[0099] The communication interface 1040 is used to connect the communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, radio (shortwave / ultra-shortwave) communication, satellite communication, data link communication, etc.).
[0100] Bus 1050 includes pathways for transmitting information between various components of the device, such as processor 1010, memory 1020, input / output interface 1030, and communication interface 1040.
[0101] It should be noted that although the above-described device only shows the processor 1010, memory 1020, input / output interface 1030, communication interface 1040, and bus 1050, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments described in this specification, and need not include all the components shown in the figures.
[0102] The electronic device described above is used to implement the data anomaly detection method in the corresponding border gateway protocol of any of the foregoing embodiments, and has the beneficial effects of the corresponding method implementation, which will not be elaborated here.
[0103] Based on the same inventive concept, corresponding to any of the above-described embodiments, this application also provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute the data anomaly detection method in the border gateway protocol as described in any of the above embodiments.
[0104] The computer-readable medium in this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.
[0105] The computer instructions stored in the storage medium of the above embodiments are used to cause the computer to execute the data anomaly detection method in the border gateway protocol as described in any of the above embodiments, and have the beneficial effects of the corresponding method implementation, which will not be repeated here.
[0106] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this application (including the claims) is limited to these examples; this manner of description is merely for clarity, and those skilled in the art should consider the specification as a whole. Within the framework of this application, the above embodiments or the technical features of different embodiments can also be appropriately combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this application as described above, which are not provided in the details for the sake of brevity.
[0107] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of this application, the well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided drawings. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of this application, and this also takes into account the fact that the details of the implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of this application will be implemented (i.e., these details should be entirely within the understanding of those skilled in the art). While specific details (e.g., circuits) are set forth to describe exemplary embodiments of this application, it will be apparent to those skilled in the art that the embodiments of this application can be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.
[0108] Although this application has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.
[0109] The embodiments described herein are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made without departing from the spirit and principles of the embodiments described herein should be included within the protection scope of this application.
Claims
1. A method for detecting data anomalies in a border gateway protocol, characterized in that, The method includes: Obtain the data to be detected from the border gateway protocol; Extract quantity-related features and path attribute-related features of the autonomous system from the data to be detected; Generate the time series to be detected and the behavioral information of multiple autonomous systems based on the features; Based on the behavioral information, a suspicious autonomous system is selected from among the multiple autonomous systems; Obtain a set of historical time series data, and then query the set of historical time series data for the most similar historical time series data to the time series to be tested. The time series to be tested is input into the trained time series prediction model to generate a predicted time series; Calculate the residuals between the predicted time series and the actual time series; The time series to be tested is input into a trained anomaly detection model, and the anomaly detection model outputs the anomaly state of the time series to be tested. The multiple time series to be tested, the suspected autonomous system, the similar historical time series, the residuals, and the abnormal states are integrated into the prompt. The prompt is input into the inference model, and the inference model generates a comprehensive detection result and an inference process expressed in natural language.
2. The method for detecting data anomalies in a border gateway protocol according to claim 1, characterized in that, Before inputting the time series to be tested into the trained time series prediction model, the following steps are included: Select historical time series without anomalies as training time series; The training time series is input as a natural language string into the time series prediction model to be trained; Freeze the multi-head attention layer and feedforward network layer of the time-series prediction model to be trained, and adjust the position embedding layer, residual connection and layer normalization layer in the time-series prediction model to be trained according to the training time series to obtain the trained time-series prediction model.
3. The method for detecting data anomalies in a border gateway protocol according to claim 1, characterized in that, Before inputting the time series to be tested into the trained anomaly detection model, the following steps are included: Historical time series with identified anomaly types and historical time series without anomalies were selected as the first training parameters. We selected expertise on border gateway protocols and network anomaly types as the second training parameter; Inject a low-rank matrix into the anomaly detection model to be trained; The parameters of the low-rank matrix are updated using the first training parameters and the second training parameters to obtain the trained anomaly detection model.
4. The method for detecting data anomalies in a border gateway protocol according to claim 3, characterized in that, The process of injecting a low-rank matrix into the anomaly detection model to be trained includes: The anomaly detection model to be trained is subjected to integer quantization. A low-rank adaptive adapter is injected into the target layer of the anomaly detection model to be trained. The output of the target layer is calculated according to the following formula: ； Where x is the given input, These are the weights of the frozen portion in the second trained language model. and Let r be a trainable low-rank matrix, r be the rank of the low-rank adaptive adapter, and α be a scaling factor.
5. The method for detecting data anomalies in a border gateway protocol according to claim 1, characterized in that, The step of generating the time series to be detected based on the features includes: Based on the aforementioned characteristics, a complete time series is generated; The complete time series is decomposed multiple times in a recursive manner to generate multiple time series to be tested at different time scales; The complete time series and the time series to be tested are processed by discrete wavelet transform to obtain the global trend approximation component and local change detail component of the complete time series and each of the time series to be tested.
6. The method for detecting data anomalies in a border gateway protocol according to claim 1, characterized in that, After generating the time series to be detected based on the features, the process includes: The burst factor of the time series under test is calculated according to the following formula; ； Wherein, B is the aforementioned sudden factor. σ is the mean of the time series to be tested, and σ is the standard deviation; The sudden factor is integrated into the prompt.
7. The method for detecting data anomalies in a border gateway protocol according to claim 1, characterized in that, The behavioral information includes the number of times each of the autonomous systems in the multiple autonomous systems changes as a source autonomous system, and the number of times each of the multiple autonomous systems in the multiple autonomous systems violates business relationships; The step of selecting a suspicious autonomous system from multiple autonomous systems based on the behavioral information includes: The behavioral information is input into the autonomous system analysis model, and the autonomous system analysis model outputs the suspicious autonomous system.
8. The method for detecting data anomalies in a border gateway protocol according to claim 1, characterized in that, The historical time series set includes multiple historical time series, text descriptions corresponding to the historical time series, and labels used to indicate abnormal or normal types.
9. A data anomaly detection system in a border gateway protocol, characterized in that, The system includes: The acquisition module is used to acquire the data to be detected in the border gateway protocol; The extraction module is used to extract quantity-related features and path attribute-related features of the autonomous system from the data to be detected; The first generation module is used to generate the time series to be detected and the behavioral information of multiple autonomous systems based on the features; The first selection module is used to select a suspicious autonomous system from among the multiple autonomous systems based on the behavioral information; The query module is used to obtain a set of historical time series and query the set of historical time series that has the highest similarity to the time series to be tested. The second generation module is used to input the time series to be tested into the trained time series prediction model to generate a predicted time series. The first calculation module is used to calculate the residual between the predicted time series and the actual time series; The output module is used to input the time series to be tested into the trained anomaly detection model, and the anomaly detection model outputs the anomaly state of the time series to be tested. The reasoning module is used to integrate multiple time series to be tested, the suspected autonomous system, the similar historical time series, the residuals and the abnormal states into a prompt, input the prompt into the reasoning model, and the reasoning model generates a comprehensive detection result and a reasoning process expressed in natural language.
10. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium stores computer instructions for causing the computer to execute the data anomaly detection method in any of the border gateway protocols of claims 1 to 8.