Neighbor state attack detection method, device, equipment, medium and product
By collecting routing protocol messages within a unit detection time, detecting and counting abnormal neighbor node information, the problem of vulnerability of routing neighbor relationships to attacks is solved, achieving efficient and accurate neighbor state detection and fault location, and supporting the reliability requirements of modern network environments.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-04
- Publication Date
- 2026-03-10
AI Technical Summary
In existing technologies, routing neighbor relationships are vulnerable to malicious attacks that can lead to network failures. Fault detection is delayed, and the accuracy and efficiency of troubleshooting are low, making it difficult to meet the reliability requirements of modern network environments.
By collecting routing protocol messages within a unit detection time, detecting whether neighbor node information is abnormal, and judging whether the neighbor status is under attack based on the abnormality count value, the system can proactively detect and locate attacked neighbor nodes in real time.
It improves the efficiency and accuracy of neighbor state detection, enabling timely detection and location of attacked nodes, and providing important fault repair information.
Smart Images
Figure CN121644172A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of computer network technology, and in particular to a method, apparatus, device, medium, and product for detecting neighbor state attacks. Background Technology
[0002] In large-scale network environments, routing protocols are widely deployed in enterprise networks and carrier backbone networks, and their stable operation is directly related to the continuity of network services. However, in actual network operation, routing neighbor relationships often enter an abnormal state due to malicious attacks or abnormal interference, resulting in the inability to exchange routing information normally, which in turn causes network reachability interruption and seriously affects the normal service of the basic network.
[0003] Currently, the common operational practice is to manually execute commands such as ping and traceroute to troubleshoot each segment after a network connectivity failure occurs, in order to determine whether the routing nodes are working properly. This approach is a typical passive response-based fault handling: connectivity is only tested tentatively after a service interruption occurs, and then the routing protocol status is inferred.
[0004] The above methods have obvious drawbacks: fault detection is severely delayed, making it impossible to provide early warning or rapid awareness, which leads to prolonged fault repair time; and based on the results of connectivity tests, it is impossible to accurately locate the abnormal state of neighbors at the routing protocol level. The troubleshooting process relies on experience, resulting in low accuracy and efficiency, and is difficult to adapt to the increasingly stringent network reliability requirements of modern network environments. Summary of the Invention
[0005] This invention provides a method, apparatus, device, medium, and product for detecting neighbor state attacks, in order to solve the problems of traditional passive response-based fault handling methods for network node operation and maintenance, which suffer from serious delays in fault detection and low accuracy and efficiency in troubleshooting, making it difficult to adapt to the increasingly stringent requirements of modern network environments for network reliability.
[0006] In a first aspect, embodiments of the present invention provide a method for detecting neighbor state attacks, including:
[0007] Within a unit detection time, the routing protocol messages transmitted from the first routing node to the second routing node are collected, and the neighbor node information carried by the routing protocol messages is checked for abnormality; the first routing node and the second routing node are neighbor nodes of each other, and the routing protocol messages carry the neighbor node information of the first routing node;
[0008] If an anomaly is detected in the neighbor node information carried by the routing protocol message within the unit detection time, the anomaly count value is updated and the unit detection time is refreshed.
[0009] If the abnormal count value reaches a threshold value, it is determined that the neighbor state of the first routing node is under attack.
[0010] In a second aspect, an embodiment of the present application provides a neighbor state attack detection apparatus, comprising:
[0011] a neighbor abnormality detection module, configured to collect routing protocol packets transmitted by a first routing node to a second routing node in a unit detection time, and detect whether neighbor node information carried in the routing protocol packets is abnormal; the first routing node and the second routing node are neighbor nodes of each other, and the routing protocol packets carry neighbor node information of the first routing node;
[0012] an information updating module, configured to update an abnormal count value and refresh the unit detection time if the neighbor node information carried in the routing protocol packets is abnormal in the unit detection time;
[0013] an abnormal state determination module, configured to determine that the neighbor state of the first routing node is under attack if the abnormal count value reaches a threshold value.
[0014] In a third aspect, an embodiment of the present application provides an electronic device, comprising:
[0015] at least one processor;
[0016] and a memory connected with the at least one processor in communication;
[0017] wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the neighbor state attack detection method according to any one of the embodiments of the present application.
[0018] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, which stores computer instructions, and the computer instructions are used to enable a processor to implement the neighbor state attack detection method according to any one of the embodiments of the present application.
[0019] In a fifth aspect, an embodiment of the present application provides a computer program product comprising a computer program, and the computer program is used to enable a processor to implement the neighbor state attack detection method according to any one of the embodiments of the present application.
[0020] The technical scheme of the embodiment of the present application comprises the following steps: collecting a routing protocol message transmitted by a first routing node to a second routing node in a unit detection time, and detecting whether the neighbor node information carried by the routing protocol message is abnormal; the first routing node and the second routing node are neighbor nodes of each other, and the routing protocol message carries the neighbor node information of the first routing node; if the neighbor node information carried by the routing protocol message is abnormal in the unit detection time, updating an abnormal count value and refreshing the unit detection time; and if the abnormal count value reaches a threshold value, determining that the neighbor state of the first routing node is attacked. By detecting whether the neighbor node information carried by the routing protocol message is abnormal in the unit detection time and counting, and determining whether the neighbor state of the first routing node is attacked according to the abnormal count value, the neighbor state of the routing node can be actively and timely detected, the attacked neighbor node can be located, the problem that the fault discovery of the traditional passive response type fault processing network node operation and maintenance method is seriously lagged and the troubleshooting accuracy and efficiency are low, and the network reliability requirement of the modern network environment is increasingly strict can be solved, and the efficiency and accuracy of the neighbor state detection are improved, and important information for fault repair is provided.
[0021] It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS
[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.
[0023] Figure 1 A flowchart of a neighbor state attack detection method provided for the first embodiment of the present application;
[0024] Figure 2 A structural schematic diagram of a network in which a neighbor state attack detection device is deployed, provided for the present embodiment;
[0025] Figure 3 A flowchart of a neighbor state attack detection method provided for the second embodiment of the present application;
[0026] Figure 4 A structural schematic diagram of a neighbor state attack detection device provided for the third embodiment of the present application;
[0027] Figure 5A structural schematic diagram of an electronic device for implementing a neighbor state attack detection method according to an embodiment of the present application. DETAILED DESCRIPTION
[0028] For those skilled in the art, the technical solutions in the embodiments of the present application will be better understood by the following description in conjunction with the accompanying drawings of the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work should fall within the scope of protection of the present application.
[0029] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.
[0030] Embodiment one
[0031] Figure 1 A flowchart of a neighbor state attack detection method provided by the first embodiment of the present application, the present embodiment can be applied to the case of detecting the state of the neighbor node of the first routing node. The method can be performed by a neighbor state attack detection device, which can be realized in the form of hardware and / or software, and can be configured in an electronic device. The electronic device can be deployed in series on a network, and is used for detecting the neighbor state of each neighbor node of the routing node on the router link.
[0032] As shown in Figure 1 , the method comprises:
[0033] S110, collecting a routing protocol packet transmitted by a first routing node to a second routing node within a unit detection time, and detecting whether the neighbor node information carried by the routing protocol packet is abnormal; the first routing node and the second routing node are neighbor nodes of each other, and the routing protocol packet carries the neighbor node information of the first routing node.
[0034] In this context, the first routing node and the second routing node are two distinct routing nodes on the routing link, and they are neighbors of each other. The first routing node and the second routing node establish and maintain their neighbor relationship through routing protocol messages. The unit detection time can be considered as the unit time for anomaly detection; this unit detection time is configurable, or it can be defined as a Hello interval or a Holding interval in the message protocol.
[0035] In this embodiment, the neighbor state attack detection device deployed in the network under test intercepts routing protocol messages during the transmission of routing protocol messages from the first routing node to the second routing node, which is a neighbor node. The device then detects these messages and forwards those that pass the detection to the second routing node, ensuring the normal operation of the neighbor relationship between the first and second routing nodes. Messages that fail the detection are directly blocked to prevent attackers from manipulating the neighbor state of routing nodes by forging attack messages carrying neighbor information.
[0036] In this embodiment, a neighbor state attack detection device can be deployed in the network according to a star topology. For example, Figure 2 This is a schematic diagram of the network structure for deploying a neighbor state attack detection device, as provided in this embodiment. Figure 2 As shown, the neighbor state attack detection device is deployed in series in the network under test, and all routing protocol messages of all routing nodes need to be forwarded to neighbor nodes after being detected by the neighbor state attack detection device.
[0037] In this embodiment, the neighbor state attack detection device can also generate network-wide neighbor baseline information through manual input and automatic learning. This neighbor baseline information can be standard information about neighboring nodes that have established stable neighbor relationships with the first routing node. The neighbor baseline information is manually set or audited, and its accuracy must be guaranteed before it can be used to assist in determining whether the neighbor node information carried in routing protocol messages is abnormal. For example, the neighbor baseline information can include information about each routing node in the entire network and the information of its corresponding neighboring nodes. The routing node information can include at least one of the routing node's node identifier (node ID) and Internet Protocol address (IP address). The neighboring node information can include at least one of the neighboring node's ID, IP address, and MAC address.
[0038] In this embodiment, the acquired routing protocol messages are parsed and inspected within a unit detection time to determine whether the neighbor node information carried in the routing protocol messages is abnormal. For example, determining whether the neighbor node information is abnormal can be done by comparing the neighbor node information in the routing protocol messages with the neighbor baseline information. If they match, the neighbor node information is considered normal; if they do not match, the neighbor node information is considered abnormal. Of course, there may also be cases where the neighbor node information is empty. In this case, there is no need to compare with the neighbor baseline information, and the neighbor node information can be directly considered abnormal.
[0039] S120. If the neighbor node information carried in the routing protocol message is abnormal, update the abnormality count value and refresh the unit detection time.
[0040] The anomaly count can be considered as a count of the number of times anomalies are detected. The anomaly count begins when an anomaly is first detected in a neighbor node, and increments by 1 with each subsequent anomaly detection. In this embodiment, to avoid misjudgments caused by network fluctuations, the count of consecutive anomalies is generally used as decision information for neighbor status anomalies. Therefore, after the anomaly count begins, it is reset (i.e., the count is cleared to zero) if normal neighbor node information is detected again.
[0041] In this embodiment, a routing protocol message may be acquired at any point within a unit detection time. For example, assuming a unit detection time is 10 seconds, a routing protocol message may be acquired at the 6th second of the unit detection time, and if the neighbor node information carried in the routing protocol message is found to be abnormal, the abnormality count value is incremented by 1, the unit detection time is refreshed, and the next unit detection time begins again. Furthermore, during the next unit detection time, S110 continues to collect routing protocol messages transmitted from the first routing node to the second routing node and detect whether the neighbor node information carried in the routing protocol message is abnormal.
[0042] S130. If the anomaly count reaches the threshold, it is determined that the neighbor state of the first routing node has been attacked.
[0043] The threshold can be determined according to actual needs, and this embodiment does not impose any restrictions on it.
[0044] In this embodiment, if the anomaly count reaches the threshold, it can be considered that the neighbor state between the first routing node and the second routing node is continuously abnormal, exceeding the range of ordinary network anomalies, and the neighbor state of the first routing node can be considered to be under attack.
[0045] The technical solution of this invention collects routing protocol messages transmitted from a first routing node to a second routing node within a unit detection time and detects whether the neighbor node information carried in the routing protocol messages is abnormal. The first routing node and the second routing node are neighbors, and the routing protocol messages carry the neighbor node information of the first routing node. If the neighbor node information carried in the routing protocol messages is abnormal within the unit detection time, the abnormality count value is updated and the unit detection time is refreshed. If the abnormality count value reaches a threshold, it is determined that the neighbor state of the first routing node has been attacked. By detecting whether the neighbor node information carried in the routing protocol messages is abnormal and counting it within a unit detection time, and determining whether the neighbor state of the first routing node has been attacked based on the abnormality count value, it is possible to actively detect whether the neighbor state of a routing node has been attacked in real time, which improves the efficiency and accuracy of neighbor state detection and enables the location of attacked neighbor nodes, providing important information for fault repair.
[0046] Example 2
[0047] Figure 3 This is a flowchart of a neighbor state attack detection method provided in Embodiment 2 of the present invention. This embodiment specifies S110 and S120 of the above embodiment. Specifically, detecting whether the neighbor node information carried by the routing protocol message is abnormal includes: if the neighbor node information carried by the routing protocol message is empty, or if the neighbor node information carried by the routing protocol message is inconsistent with the neighbor reference information, then the neighbor node information carried by the routing protocol message is determined to be abnormal. Furthermore, if the neighbor node information carried by the routing protocol message is detected to be abnormal within the unit detection time, then the abnormality count value is updated and the unit detection time is refreshed, including: if the neighbor node information carried by the routing protocol message is detected to be abnormal within the unit detection time, then the neighbor node information is determined to be abnormal, the abnormality count value is incremented by one, the current unit detection time ends, and the timer for the next unit detection time begins. Additionally, if the neighbor node information carried by the routing protocol message is detected to be normal or the routing protocol message is not obtained within the unit detection time, then the detection is exited and the abnormality count value is cleared to zero.
[0048] like Figure 3 As shown, the method includes:
[0049] S210. Collect routing protocol messages transmitted from the first routing node to the second routing node within a unit detection time; the first routing node and the second routing node are neighboring nodes, and the routing protocol messages carry the neighboring node information of the first routing node.
[0050] In an optional embodiment of this example, when the first routing node and the second routing node are OSPF routing nodes, the routing protocol message includes an OSPF protocol message, which includes an OSPF Hello message, an OSPF DBD message, or an OSPF LSU message.
[0051] In this embodiment, an OSPF routing node can be considered any router in an Open Shortest Path First (OSPF) network that participates in the OSPF routing process, generates and processes OSPF protocol messages, maintains an OSPF link-state database, and calculates routes based on this database. The routing protocol messages transmitted by the OSPF routing node are OSPF protocol messages. OSPF protocol messages include OSPF Hello messages, OSPF DBD messages, or OSPF LSU messages.
[0052] OSPF Hello messages are periodically sent messages in the OSPF protocol for neighbor discovery and maintenance. Their main functions include neighbor discovery, neighbor relationship maintenance, and the election of the Designated Router (DR) / Backup Designated Router (BDR). The content of an OSPF Hello message may include key information such as the sender's (i.e., the first routing node in this example) IP address, router ID, Hello interval, DR / BDR information, and a list of neighbor IDs.
[0053] OSPF DBD (Database Description) messages are crucial messages in the OSPF protocol used for database synchronization. They play a role in the database synchronization phase of establishing OSPF neighbor relationships, primarily involving master-slave election, database synchronization, and Link-State Advertisement (LSA) requests. Once OSPF database synchronization is complete, DBD messages will no longer appear periodically. The message content includes the sender's IP address, router ID, neighbor IP addresses, master-slave election information, database synchronization information, and detailed LSA requests.
[0054] OSPF LSU (Link State Update) messages are core messages in the SPF protocol used to transmit complete LSA information. They are primarily responsible for synchronizing and updating link state information within the network. LSUs include various LSA types, among which Network LSAs carry an Advertisement ID and a Reachable Neighbor ID. The Advertisement ID can be considered the "Link State ID" field in the LSA header, used to uniquely identify an LSA.
[0055] In another optional embodiment of this example, when the first routing node and the second routing node are ISIS routing nodes, the routing protocol message includes an ISIS protocol message, and the ISIS protocol message includes an ISIS Hello message.
[0056] An ISIS routing node can be considered any router running the Intermediate System to Intermediate System (ISIS) routing protocol. In the ISIS protocol, these ISIS routing nodes are called intermediate systems, and their function is to select the best path for packets and forward them within the network (usually within an autonomous system). The routing protocol messages transmitted by ISIS routing nodes are ISIS protocol messages. ISIS protocol messages include ISIS Hello messages.
[0057] In this embodiment, the ISIS Hello message is a periodic protocol message used in the ISIS protocol to establish and maintain neighbor relationships. Its main functions are neighbor discovery, neighbor relationship maintenance, and Designated Intermediate System (DIS) election. The message content includes key information such as the sender's MAC address, router ID, holding interval, and neighbor MAC list.
[0058] S220. If the neighbor node information carried in the routing protocol message is empty, or if the neighbor node information carried in the routing protocol message is inconsistent with the neighbor reference information, then it is determined that the neighbor node information carried in the routing protocol message is abnormal.
[0059] In this embodiment, each routing node in the network has at least one neighbor node. If the neighbor node information carried in the routing protocol message is empty, it can be considered that the neighbor node information carried in the routing protocol message is abnormal. If the neighbor node information carried in the routing protocol message is not empty, the neighbor node information is further compared with the neighbor reference information to determine whether the two are consistent. If the two are inconsistent, it is determined that the neighbor node information carried in the routing protocol message is abnormal.
[0060] For example, for OSPF Hello messages, if the Hello message does not contain a neighbor ID, it indicates that the neighbor node information is empty. For OSPF LSU Network messages, if the LSU Network message does not contain a reachable neighbor ID, it indicates that the neighbor node information is empty. For ISIS Hello messages, if the Hello message does not contain a neighbor MAC address, it indicates that the neighbor node information is empty.
[0061] In this embodiment, the neighbor reference information corresponding to the OSPF Hello message includes the Internet Protocol address and routing node identifier of the first routing node, as well as a list of neighbor node identifiers; the neighbor reference information corresponding to the OSPF DBD message includes the Internet Protocol address and routing node identifier of the first routing node, as well as a list of Internet Protocol addresses of neighbor nodes; the neighbor reference information corresponding to the OSPF LSU message includes the advertisement identifier and the routing node identifier of the neighbor node; and the neighbor reference information corresponding to the ISIS Hello message includes the Internet Protocol address and routing node identifier of the first routing node, as well as a list of neighbor MAC addresses.
[0062] In this embodiment, one situation where neighbor node information is inconsistent with neighbor base information is that the first routing node information (such as ID and / or IP address) cannot be found in the neighbor base information, and therefore, the corresponding neighbor node information cannot be found either. For example, for OSPF Hello packets, if the IP address and router ID of the first routing node in an OSPF Hello packet in the network cannot be found in the OSPF Hello neighbor base information, it indicates that there is no corresponding neighbor information. For ISISHello packets, if the MAC address and router ID of the first routing node in an ISISHello packet in the network cannot be found in the ISISHello neighbor base information, it indicates that there is no corresponding neighbor information. For OSPF DBD packets, if the IP address and router ID of the first routing node appearing in an OSPF DBD packet in the network cannot be found in the OSPF DBD neighbor base information, it indicates that there is no corresponding neighbor information. For OSPF LSU Network packets, if the advertised ID and reachable neighbor ID of an OSPF LSU Network packet in the network cannot be found in the OSPF LSU neighbor base information, it indicates that there is no corresponding neighbor information.
[0063] Another scenario where neighbor node information differs from neighbor base information is that while the first routing node information can be found in the neighbor base information, the corresponding neighbor node information is not entirely identical to the neighbor node information carried in the routing protocol message. This indicates an error in the neighbor node information. For example, for OSPF Hello messages, if the IP address of the first routing node in the OSPF Hello message and the neighbor ID corresponding to the router ID cannot be found in the OSPF Hello neighbor base information, it indicates an error in the neighbor information. For ISIS Hello messages, if the MAC address of the ISIS Hello message and the neighbor MAC address corresponding to the router ID cannot be found in the ISIS Hello neighbor base information, it indicates an error in the neighbor information. For OSPF DBD messages, if the IP address of the routing node in the OSPF DBD message and the neighbor IP address corresponding to the router ID cannot be found in the OSPF DBD message neighbor base information, it indicates an error in the neighbor information.
[0064] S230. If the neighbor node information carried in the routing protocol message is found to be abnormal within the unit detection time, the abnormality count value is incremented by one, the current unit detection time ends and the timer for the next unit detection time begins.
[0065] In this embodiment, the initial value of the anomaly count is set to zero. If an anomaly is detected in the neighbor node information carried by the routing protocol message within a unit detection time, the anomaly count is incremented by 1. That is, when an anomaly is first detected in the neighbor node information carried by the routing protocol message within a unit detection time, the counter is started to count the number of anomalies. At the same time, the current unit detection time ends, and the timing for the next unit detection time restarts. During the next unit detection time, the routing protocol messages transmitted from the first routing node to the second routing node are collected again to check whether the neighbor node information carried by the routing protocol messages is abnormal.
[0066] S240. If the neighbor node information carried by the routing protocol message is normal or no routing protocol message is obtained within the unit detection time, the abnormal count value is cleared to zero.
[0067] In this embodiment, if the neighbor node information carried in the routing protocol message is normal within the unit detection time, or if no routing protocol message is obtained before the unit detection time ends due to network fluctuations, it cannot be directly determined that the neighbor state is abnormal. In this case, the abnormality count value can be cleared to zero, and the current detection is terminated, meaning the current detection is invalid and will not be used as a basis for determining whether the neighbor state is under attack. The count is restarted when the neighbor node information carried in the routing protocol message is found to be abnormal in the next unit detection time.
[0068] S250. If the anomaly count reaches the threshold, it is determined that the neighbor state of the first routing node has been attacked.
[0069] The technical solution of this invention involves collecting routing protocol messages transmitted from a first routing node to a second routing node within a unit detection time. The first and second routing nodes are neighboring nodes, and the routing protocol messages carry neighboring node information of the first routing node. If the neighboring node information carried in the routing protocol message is empty, or if the neighboring node information carried in the routing protocol message is inconsistent with the neighboring reference information, it is determined that the neighboring node information carried in the routing protocol message is abnormal. If abnormal neighboring node information carried in the routing protocol message is detected within the unit detection time, the abnormality count is incremented by one, the current unit detection time ends, and the timer for the next unit detection time begins. If the neighboring node information carried in the routing protocol message is normal or no routing protocol message is obtained within the unit detection time, the abnormality count is cleared to zero. If the abnormality count reaches a threshold, it is determined that the neighboring state of the first routing node is under attack. By detecting and counting anomalies in the neighbor node information carried in routing protocol messages within a unit detection time, and determining whether the neighbor state of the first routing node has been attacked based on the anomaly count, it is possible to proactively and in real time detect whether the neighbor state of a routing node has been attacked. This improves the efficiency and accuracy of neighbor state detection and enables the location of attacked neighbor nodes, providing important information for fault repair.
[0070] Example 3
[0071] Figure 4 This is a schematic diagram of a neighbor state attack detection device provided in Embodiment 3 of the present invention. Figure 4 As shown, the device includes: a neighbor anomaly detection module 310, an information update module 320, and an anomaly state determination module 330; wherein,
[0072] The neighbor anomaly detection module 310 is used to collect routing protocol messages transmitted from the first routing node to the second routing node within a unit detection time, and to detect whether the neighbor node information carried in the routing protocol messages is abnormal; the first routing node and the second routing node are neighbor nodes to each other, and the routing protocol messages carry the neighbor node information of the first routing node;
[0073] The information update module 320 is used to update the anomaly count value and refresh the unit detection time if the neighbor node information carried by the routing protocol message is abnormal within the unit detection time.
[0074] The abnormal state determination module 330 is used to determine that the neighbor state of the first routing node has been attacked if the abnormal count value reaches a threshold.
[0075] The technical solution of this invention collects routing protocol messages transmitted from a first routing node to a second routing node within a unit detection time and detects whether the neighbor node information carried in the routing protocol messages is abnormal. The first routing node and the second routing node are neighbors, and the routing protocol messages carry the neighbor node information of the first routing node. If the neighbor node information carried in the routing protocol messages is abnormal within the unit detection time, the abnormality count value is updated and the unit detection time is refreshed. If the abnormality count value reaches a threshold, it is determined that the neighbor state of the first routing node has been attacked. By detecting whether the neighbor node information carried in the routing protocol messages is abnormal and counting it within a unit detection time, and determining whether the neighbor state of the first routing node has been attacked based on the abnormality count value, it is possible to actively detect whether the neighbor state of a routing node has been attacked in real time, which improves the efficiency and accuracy of neighbor state detection and enables the location of attacked neighbor nodes, providing important information for fault repair.
[0076] Optional, the neighbor anomaly detection module 310 is specifically used for:
[0077] If the neighbor node information carried in the routing protocol message is empty, or if the neighbor node information carried in the routing protocol message is inconsistent with the neighbor reference information, then the neighbor node information carried in the routing protocol message is determined to be abnormal.
[0078] Optionally, when the first routing node and the second routing node are OSPF routing nodes, the routing protocol message includes an OSPF protocol message, which includes an OSPF Hello message, an OSPF DBD message, or an OSPF LSU message.
[0079] When the first routing node and the second routing node are ISIS routing nodes, the routing protocol message includes an ISIS protocol message, which includes an ISIS Hello message.
[0080] Optionally, the neighbor reference information corresponding to the OSPF Hello message includes the Internet Protocol address and routing node identifier of the first routing node, as well as a list of neighbor node identifiers;
[0081] The neighbor reference information corresponding to the OSPF DBD message includes the Internet Protocol address and routing node identifier of the first routing node, as well as the list of Internet Protocol addresses of neighboring nodes.
[0082] The neighbor reference information corresponding to the OSPF LSU message includes the announcement identifier and the routing node identifier of the neighbor node;
[0083] The neighbor reference information corresponding to the ISIS Hello message includes the Internet Protocol address and routing node identifier of the first routing node, as well as a list of neighbor MAC addresses.
[0084] Optional, the information update module 320 is specifically used for:
[0085] If an anomaly is detected in the neighbor node information carried by the routing protocol message within the unit detection time, the anomaly count is incremented by one, the current unit detection time ends, and the timer for the next unit detection time begins.
[0086] Optionally, the device further includes:
[0087] The zeroing module is used to clear the anomaly count value if the neighbor node information carried by the routing protocol message is normal or the routing protocol message is not obtained within the unit detection time.
[0088] The neighbor state attack detection device provided in the embodiments of the present invention can execute the neighbor state attack detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method execution.
[0089] Example 4
[0090] Figure 5A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.
[0091] like Figure 5 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.
[0092] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.
[0093] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as the neighbor state attack detection method.
[0094] In some embodiments, the neighbor state attack detection method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the neighbor state attack detection method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the neighbor state attack detection method by any other suitable means (e.g., by means of firmware).
[0095] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.
[0096] In some embodiments, the neighbor state attack detection method may be implemented as a computer program, which is implicitly included in a computer program product. When executed by a processor, the computer program implements the neighbor state attack detection method of the present invention. The computer program product can be understood as a software product that primarily implements its solution through a computer program. The computer program used to implement the method of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on a machine, partially on a machine, partially on a remote machine as a standalone software package, or entirely on a remote machine or server.
[0097] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.
[0098] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).
[0099] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.
[0100] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.
[0101] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.
[0102] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.
Claims
1. A method of detecting a neighbor state attack, the method comprising: The method comprises: collecting a routing protocol packet transmitted by a first routing node to a second routing node within a unit detection time, and detecting whether neighbor node information carried by the routing protocol packet is abnormal; the first routing node and the second routing node are neighbor nodes of each other, and the routing protocol packet carries neighbor node information of the first routing node; if it is detected that the neighbor node information carried by the routing protocol packet is abnormal within the unit detection time, updating an abnormal count value and refreshing the unit detection time; if the abnormal count value reaches a threshold value, determining that a neighbor state of the first routing node is under attack.
2. The method of claim 1, wherein, The detection of whether the neighbor node information carried by the routing protocol packet is abnormal comprises: if the neighbor node information carried by the routing protocol packet is empty, or the neighbor node information carried by the routing protocol packet is inconsistent with neighbor reference information, it is determined that the neighbor node information carried by the routing protocol packet is abnormal.
3. The method of claim 2, wherein, In a case where the first routing node and the second routing node are OSPF routing nodes, the routing protocol packet comprises an OSPF protocol packet, and the OSPF protocol packet comprises an OSPF Hello packet, an OSPF DBD packet or an OSPF LSU packet; In a case where the first routing node and the second routing node are ISIS routing nodes, the routing protocol packet comprises an ISIS protocol packet, and the ISIS protocol packet comprises an ISIS Hello packet.
4. The method of claim 3, wherein, The neighbor reference information corresponding to the OSPF Hello packet comprises an Internet protocol address and a routing node identifier of the first routing node, and a neighbor node identifier list; the neighbor reference information corresponding to the OSPF DBD packet comprises an Internet protocol address and a routing node identifier of the first routing node, and an Internet protocol address list of a neighbor node; the neighbor reference information corresponding to the OSPF LSU packet comprises an announcement identifier and a routing node identifier of a neighbor node; the neighbor reference information corresponding to the ISIS Hello packet comprises an Internet protocol address and a routing node identifier of the first routing node, and a neighbor MAC address list.
5. The method of claim 1, wherein, If it is detected that the neighbor node information carried by the routing protocol packet is abnormal within the unit detection time, updating an abnormal count value and refreshing the unit detection time comprises: if it is detected that the neighbor node information carried by the routing protocol packet is abnormal within the unit detection time, increasing the abnormal count value by one, ending the current unit detection time and starting to count the next unit detection time.
6. The method of claim 1, wherein, The method further comprises: if it is detected that the neighbor node information carried by the routing protocol packet is normal or the routing protocol packet is not acquired within the unit detection time, clearing the abnormal count value.
7. A neighbor state attack detection device, characterized in that, The method comprises: The neighbor anomaly detection module is configured to collect a routing protocol packet transmitted by a first routing node to a second routing node within a unit detection time, and detect whether neighbor node information carried by the routing protocol packet is abnormal; the first routing node and the second routing node are neighbor nodes of each other, and the routing protocol packet carries the neighbor node information of the first routing node; The information updating module is configured to update an abnormal count value and refresh the unit detection time if the neighbor node information carried by the routing protocol packet is abnormal within the unit detection time; The abnormal state determination module is configured to determine that a neighbor state of the first routing node is attacked if the abnormal count value reaches a threshold value.
8. An electronic device, comprising: The electronic device comprises: at least one processor; and a memory connected in communication with the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the neighbor state attack detection method in any one of claims 1-6.
9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for enabling the processor to execute the neighbor state attack detection method in any one of claims 1-6 when executed by the processor.
10. A computer program product, characterised in that, The computer program product comprises a computer program, and the computer program implements the neighbor state attack detection method in any one of claims 1-6 when executed by the processor. The computer program product comprises a computer program, and the computer program implements the neighbor state attack detection method in any one of claims 1-6 when executed by the processor.