Traffic anomaly detection method and device, equipment, storage medium and program product

Abstract

The invention discloses a traffic anomaly detection method and device, equipment, a storage medium and a program product. The method comprises: acquiring first data of an AS level of a BGP exit within a first duration before a first moment, and second traffic information and second routing information of the AS level at the first moment, the first data comprising first traffic information, first routing information and first link establishment information, the first routing information comprising a routing credibility score, and the second routing information comprising a routing credibility score; the second routing information comprises a routing credibility grade score; on the basis of the first data, predicting AS-level traffic within a second duration after the first moment; determining flow fluctuation information based on the difference between the predicted flow and the actual flow in the second flow information; on the basis of the traffic fluctuation information, updating a route credibility grade score; determining route fluctuation information based on the difference between the route credibility grade scores before and after updating and the difference between the second route information and the first route information; and performing traffic anomaly detection based on the traffic fluctuation information and the routing fluctuation information.

Description

Technical Field

[0001] This application belongs to the field of network security technology, and in particular relates to a method, apparatus, device, storage medium and program product for detecting abnormal traffic. Background Technology

[0002] With the deepening of digital transformation in the financial industry, the reliability and security of the network architecture of financial cloud platforms, as critical information infrastructure, directly impact the continuity of financial services. To enhance the redundancy and service quality of internet access, financial industry clouds adopt a multi-carrier link interconnection architecture, using the Border Gateway Protocol (BGP) to optimize routing across Autonomous Systems (AS). While this architecture improves network connectivity, it also faces new challenges such as a rapid expansion of routing scale, increased traffic path complexity, and blurred security boundaries. Therefore, analyzing and detecting anomalies at the AS level is crucial.

[0003] Currently, traffic collection typically relies on Network Flow (NetFlow) / Sampled Flow (sFlow) protocols, as well as BGP routing data collected through independent routing collectors. Traffic records are then associated with AS path attributes through a phased splicing method for traffic analysis and anomaly detection.

[0004] However, BGP routing tables are typically in the millions, which may contain forged routes. The methods described above cannot distinguish between legitimate and forged routes. They lack effective real-time identification capabilities for spoofed attack traffic forwarded by multiple ASs, resulting in delayed and inaccurate traffic anomaly detection. Summary of the Invention

[0005] This application provides a traffic anomaly detection method, apparatus, electronic device, computer-readable storage medium, and computer program product, which can distinguish between legitimate routes and spoofed routes, effectively and in real time identify spoofed attack traffic forwarded by multiple ASs, and improve the accuracy and timeliness of traffic anomaly detection.

[0006] In a first aspect, embodiments of this application provide a method for detecting abnormal traffic flow, the method comprising: The system acquires the first traffic information, first routing information, and first link establishment information of the Autonomous System (AS) at the BGP egress point within a first time period before the first moment, as well as the second traffic information and second routing information at the first moment. The first routing information includes a route trust score, a first next-hop delay, and a first path length. The second routing information includes a route trust level score, a second next-hop delay, and a second path length. The route trust score and the route trust level score are determined based on the trustworthiness of the route origin, path stability, next-hop reliability, and community attribute matching degree. The second traffic information includes actual traffic. Based on the first traffic information, first routing information and first link establishment information of the autonomous system (AS) level within the first time period before the first moment, the AS level traffic within the second time period after the first moment is predicted to obtain the predicted traffic. Based on the difference between the predicted traffic and the actual traffic, traffic fluctuation information is determined; The route trust level score is updated based on the traffic fluctuation information; Based on the difference between the updated route trust level score and the route trust level score, the difference between the second next-hop delay and the first next-hop delay, and the difference between the second path length and the first path length, route fluctuation information is determined; Traffic anomaly detection is performed based on the traffic fluctuation information and the routing fluctuation information.

[0007] In one possible implementation, the route origin trustworthiness, the path stability, the next-hop reliability, and the community attribute correspond to multiple trustworthiness evaluation indicators. These multiple trustworthiness evaluation indicators include route origin type, secure route signature verification, route segment authorization matching, path length, path fluctuation frequency, next-hop connectivity, next-hop latency, and community attribute. For a route leading to the destination AS, a route trustworthiness score is obtained, including: Obtain the indicator weights and trust level weight vectors corresponding to the multiple trust evaluation indicators, and the indicator scores of the route on the multiple trust evaluation indicators, wherein the trust level weight vector includes the level weights corresponding to multiple trust levels. For each of the trust levels, a level score is determined based on the product of the indicator score, the indicator weight, and the level weight. The highest value among the multiple rating scores is determined as the route trust rating score.

[0008] In one possible implementation, obtaining the route trust score includes: Based on the baseline scores corresponding to the multiple trust levels, the level scores corresponding to the multiple trust levels are weighted and summed to obtain the routing trust score.

[0009] In one possible implementation, obtaining the route's metric score on the community attribute includes: Extract the community attribute of the route from the BGP routing table. The community attribute includes the autonomous system identifier and the service type identifier. Obtain the list of trusted autonomous systems and the list of trusted service types; Based on the relationship between the autonomous system identifier and the list of trusted autonomous systems, and the relationship between the business type identifier and the list of trusted business types, the index score of the community attribute is determined.

[0010] In one possible implementation, obtaining the metric score of the route on the authorization matching of the route network segment includes: Extract the destination Internet Protocol address of the route from the BGP routing table; Query the Internet Protocol Address-Autonomous System Mapping Table to determine the target autonomous system corresponding to the stated Internet Protocol Address; Search the Internet Router Registry for the authorized network segment corresponding to the target autonomous system; Based on the relationship between the destination Internet Protocol address and the authorized network segment, an index score for authorized matching of the routing network segment is determined.

[0011] In one possible implementation, the plurality of trust levels includes untrusted, low trust, medium trust, high trust, and extremely trustworthy. After determining the level score with the largest value among the plurality of level scores as the route trust level score, the method further includes: The route trust level is determined based on the route trust level score; If the route trust level is untrusted or low trust, output a route anomaly alarm.

[0012] In one possible implementation, the traffic fluctuation information includes traffic fluctuation rate, and updating the route trust level score based on the traffic fluctuation information includes: Determine the volatility factor that is negatively correlated with the aforementioned flow volatility; The route trust level score is updated based on the product of the fluctuation factor and the route trust level score.

[0013] In one possible implementation, obtaining the first traffic information, first routing information, and first connection establishment information of the Autonomous System (AS) at the Border Gateway Protocol (BGP) egress point within a first time period prior to the first moment includes: According to the target time step, obtain multiple first traffic information, multiple first routing information and multiple first link establishment information of the AS level within the first time period before the first moment of the BGP exit; The method of predicting AS-level traffic for a second time period after the first time period based on the first traffic information, first routing information, and first link establishment information of the Autonomous System (AS) within a first time period before the first time period, to obtain predicted traffic, includes: A time-series sequence is constructed based on the plurality of first traffic information, the plurality of first routing information, and the plurality of first connection establishment information; Using a Long Short-Term Memory (LSTM) network model, based on the time series, the AS-level traffic within a second time period after the first time point is predicted to obtain the predicted traffic. The LSTM network model is trained based on a first sample and a first label. The first sample includes multiple historical AS-level traffic information, multiple historical routing information, and multiple historical link establishment information of the BGP exit within the first time period before the second time point. The first label is the average AS-level traffic of the BGP exit within the second time period after the second time point.

[0014] In one possible implementation, after obtaining the predicted traffic, the method further includes: If the predicted traffic is greater than or equal to a traffic threshold, a traffic congestion alarm is output, the traffic threshold being determined based on the outbound link traffic.

[0015] In one possible implementation, the traffic anomaly detection based on the traffic fluctuation information and the routing fluctuation information includes: Using a random forest model, based on the traffic fluctuation information and the routing fluctuation information, the probabilities corresponding to multiple traffic types are determined. The traffic types include normal traffic and abnormal traffic. The abnormal traffic includes distributed denial-of-service attacks, route hijacking, and link failures. The random forest model is trained based on a second sample and a second label. The second sample includes traffic fluctuation samples and routing fluctuation samples. The second label is any one of normal traffic, distributed denial-of-service attacks, route hijacking, and link failures. The traffic type corresponding to the probability that meets the preset probability conditions is determined as the target traffic type.

[0016] In one possible implementation, after determining the traffic type corresponding to the probability that satisfies the preset probability condition as the target traffic type, the method further includes: If the target traffic type is any one of the distributed denial-of-service attack, the route hijacking, and the link failure, an abnormal traffic alarm will be output.

[0017] Secondly, embodiments of this application provide a traffic anomaly detection device, the device comprising: The acquisition module is used to acquire the first traffic information, first routing information, and first link establishment information of the Autonomous System (AS) at the Border Gateway Protocol (BGP) exit within a first time period before the first moment, as well as the second traffic information and second routing information at the AS level at the first moment. The first routing information includes a route trust score, a first next-hop delay, and a first path length. The second routing information includes a route trust level score, a second next-hop delay, and a second path length. The route trust score and the route trust level score are determined based on the trustworthiness of the route origin, path stability, next-hop reliability, and community attribute matching degree. The second traffic information includes actual traffic. The prediction module is used to predict the AS-level traffic in the second time period after the first time period based on the first traffic information, first routing information and first link establishment information of the autonomous system AS-level in the first time period before the first time period, so as to obtain the predicted traffic. The determination module is used to determine traffic fluctuation information based on the difference between the predicted traffic and the actual traffic; The update module is used to update the route trust level score based on the traffic fluctuation information; The determining module is further configured to determine routing fluctuation information based on the difference between the updated route trust level score and the route trust level score, the difference between the second next-hop delay and the first next-hop delay, and the difference between the second path length and the first path length; The detection module is used to detect traffic anomalies based on the traffic fluctuation information and the routing fluctuation information.

[0018] Thirdly, embodiments of this application provide an electronic device, which includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements any of the possible implementations of the first aspect described above.

[0019] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the method in any of the possible implementations of the first aspect described above.

[0020] Fifthly, embodiments of this application provide a computer program product in which instructions, when executed by a processor of an electronic device, cause the electronic device to perform a method as described in any of the possible implementations of the first aspect above.

[0021] This application's embodiments determine route trust scores and route trust level scores based on route origin trustworthiness, path stability, next-hop reliability, and community attribute matching, constructing a dynamic route trust level evaluation system. This system can distinguish between legitimate and spoofed routes based on route trust scores and route trust level scores, laying the foundation for identifying spoofed attack traffic forwarded through multiple ASs. Furthermore, by using the first AS-level traffic information, first route information (including route trust scores), and first link establishment information within the first time period before the first moment at the BGP exit, the system jointly predicts AS-level traffic within the second time period after the first moment, obtaining predicted traffic and improving the accuracy of predicted traffic. By determining traffic fluctuation information based on the difference between the predicted traffic within the second time period after the first moment and the actual traffic at the first moment, and performing traffic anomaly detection based on this traffic fluctuation information—that is, performing traffic anomaly detection based on the current traffic and future traffic—the system improves the timeliness of traffic anomaly detection. Based on this, by updating the route trust level score based on traffic fluctuation information, and determining the route fluctuation information based on the difference between the updated route trust level score and the original route trust level score (i.e., the change in route trust level), the difference between the second next-hop delay and the first next-hop delay, and the difference between the second path length and the first path length, and jointly performing traffic anomaly detection based on traffic fluctuation information and route fluctuation information, it is possible to effectively and in real time identify spoofed attack traffic forwarded by multiple ASs, thereby improving the accuracy and timeliness of traffic anomaly detection. Attached Figure Description

[0022] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a schematic flowchart of a traffic anomaly detection method provided in one embodiment of this application; Figure 2 This is a schematic diagram of the structure of a flow anomaly detection device provided in one embodiment of this application; Figure 3 This is a schematic diagram of the structure of an electronic device provided in one embodiment of this application. Detailed Implementation

[0024] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0025] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0026] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0027] Furthermore, the acquisition, storage, use, and processing of data in this application's technical solution all comply with relevant national laws and regulations.

[0028] Currently, the financial industry cloud has constructed a Border Gateway Protocol (BGP) internet egress to improve internet egress redundancy. By adopting the BGP protocol, the financial industry cloud interconnects with major operators through Autonomous Systems (AS), achieving internet data interoperability. However, the BGP internet egress router has over two million routing entries, resulting in numerous and complex BGP neighbor establishment processes, making macro-level traffic analysis and control difficult. Cross-AS network attacks and abnormal traffic issues are becoming increasingly prominent.

[0029] Traditional methods typically rely on Network Flow (NetFlow) / Sampled Flow (sFlow) protocols for traffic collection, as well as collecting BGP routing data through a separate routing collector. Then, traffic records are associated with AS path attributes through a phased splicing method for traffic analysis and anomaly detection.

[0030] However, attack traffic can be disguised across multiple AS paths. Among millions of routes, the above methods cannot distinguish between legitimate routes and spoofed routes, often resulting in AS-level traffic processing delays and distorted judgment of abnormal traffic, which cannot guarantee the reliable and stable operation of financial industry businesses.

[0031] Therefore, to address the relevant technical issues, embodiments of this application provide a traffic anomaly detection method, apparatus, electronic device, computer-readable storage medium, and computer program product. The traffic anomaly detection method can be applied to scenarios involving the analysis and anomaly detection of BGP egress traffic from an AS-based financial cloud.

[0032] The traffic anomaly detection method provided in the embodiments of this application is described below.

[0033] Figure 1 A flowchart illustrating a traffic anomaly detection method according to an embodiment of this application is shown. This traffic anomaly detection method can be executed by a processor in a traffic anomaly detection system. This traffic anomaly detection system can be located on a financial cloud network management platform. Figure 1 As shown, the traffic anomaly detection method provided in this application includes the following steps: S110. Obtain the first traffic information, first routing information, and first link establishment information of the Autonomous System (AS) at the BGP exit point within the first time period before the first moment, as well as the second traffic information and second routing information at the AS level at the first moment. The first routing information includes the route trust score, the first next-hop delay, and the first path length. The second routing information includes the route trust level score, the second next-hop delay, and the second path length. The route trust score and the route trust level score are determined based on the trustworthiness of the route origin, the stability of the path, the reliability of the next hop, and the matching degree of the community attributes. The second traffic information includes the actual traffic. S120. Based on the first traffic information, first routing information and first link establishment information of the autonomous system (AS) level within the first time period before the first moment, predict the AS level traffic within the second time period after the first moment to obtain the predicted traffic. S130. Determine traffic fluctuation information based on the difference between predicted traffic and actual traffic; S140. Update the route trust level score based on traffic fluctuation information; S150. Determine route fluctuation information based on the difference between the updated route trust level score and the route trust level score, the difference between the second next-hop delay and the first next-hop delay, and the difference between the second path length and the first path length. S160. Based on traffic fluctuation information and routing fluctuation information, perform traffic anomaly detection.

[0034] This application's embodiments determine route trust scores and route trust level scores based on route origin trustworthiness, path stability, next-hop reliability, and community attribute matching, constructing a dynamic route trust level evaluation system. This system can distinguish between legitimate and spoofed routes based on route trust scores and route trust level scores, laying the foundation for identifying spoofed attack traffic forwarded through multiple ASs. Furthermore, by using the first AS-level traffic information, first route information (including route trust scores), and first link establishment information within the first time period before the first moment at the BGP exit, the system jointly predicts AS-level traffic within the second time period after the first moment, obtaining predicted traffic and improving the accuracy of predicted traffic. By determining traffic fluctuation information based on the difference between the predicted traffic within the second time period after the first moment and the actual traffic at the first moment, and performing traffic anomaly detection based on this traffic fluctuation information—that is, performing traffic anomaly detection based on the current traffic and future traffic—the system improves the timeliness of traffic anomaly detection. Based on this, by updating the route trust level score based on traffic fluctuation information, and determining the route fluctuation information based on the difference between the updated route trust level score and the original route trust level score (i.e., the change in route trust level), the difference between the second next-hop delay and the first next-hop delay, and the difference between the second path length and the first path length, and jointly performing traffic anomaly detection based on traffic fluctuation information and route fluctuation information, it is possible to effectively and in real time identify spoofed attack traffic forwarded by multiple ASs, thereby improving the accuracy and timeliness of traffic anomaly detection.

[0035] The specific implementation methods for each of the above steps are described below.

[0036] In some embodiments, the first moment in S110 can be any moment. The first traffic information may include 10-dimensional traffic features such as inflow byte rate, outflow byte rate, inflow volume, outflow volume, inflow packet rate, outflow packet rate, inflow retransmission rate, outflow retransmission rate, inflow volume change rate, and outflow volume change rate. The first routing information may include 4-dimensional routing features such as route trust score, next-hop connectivity (NEXT_HOP connectivity), first next-hop delay (NEXT_HOP delay), and first path length (AS_PATH length). The first connection establishment information may include 2-dimensional connection establishment features such as inflow Transmission Control Protocol (TCP) connection success rate and outflow TCP connection success rate. The second traffic information may include real-time collected actual traffic. This actual traffic may include actual inflow traffic and actual outflow traffic. The second routing information may include route trust score, second next-hop delay (NEXT_HOP delay), and second path length (AS_PATH length).

[0037] The route trust score and route trust level score are determined based on route origin trustworthiness, path stability, next-hop reliability, and community attribute matching degree. These factors correspond to multiple trust evaluation indicators. These indicators may include route origin type (ORIGIN type), secure route signature verification (BGPSEC signature verification), route segment authorization matching, path length (AS_PATH length), path fluctuation frequency, next-hop connectivity (NEXT_HOP connectivity), next-hop latency (NEXT_HOP latency), and community attribute (COMMUNITY attribute). Specifically, route origin trustworthiness corresponds to indicators such as route origin type (ORIGIN type), secure route signature verification (BGPSEC signature verification), and route segment authorization matching. Path stability corresponds to indicators such as path length (AS_PATH length) and path fluctuation frequency. Next-hop reliability corresponds to indicators such as next-hop connectivity (NEXT_HOP connectivity) and next-hop latency (NEXT_HOP latency). Community attribute matching degree corresponds to community attribute (COMMUNITY attribute).

[0038] Based on this, in some embodiments, for a route to the destination AS, obtaining the route trust level score can specifically include: Obtain the indicator weights and trust level weight vectors corresponding to multiple trust evaluation indicators, and the indicator scores of the route on multiple trust evaluation indicators. The trust level weight vector includes the level weights corresponding to multiple trust levels. For each credibility level, the level score is determined based on the product of the indicator score, the indicator weight, and the level weight. The highest score among multiple ratings is determined as the route trustworthiness rating score.

[0039] Here, the weights of the various trustworthiness evaluation metrics can be determined based on the analytic hierarchy process (AHP). For example, the weights of metrics such as route origin type (ORIGIN type), secure route signature verification (BGPSEC signature verification), route segment authorization matching, path length (AS_PATH length), path fluctuation frequency, next-hop connectivity (NEXT_HOP connectivity), next-hop delay (NEXT_HOP delay), and community attribute (COMMUNITY attribute) can be 0.15, 0.20, 0.10, 0.08, 0.12, 0.10, 0.08, and 0.07, respectively.

[0040] In addition, multiple trust levels can include untrusted, low trust, medium trust, high trust, and extremely trust. If a route's trust level is untrusted or low trust, the route could be a forged route. If a route's trust level is medium trust, high trust, or extremely trust, the route could be a legitimate route.

[0041] Furthermore, each credibility evaluation index can correspond to a credibility level weight vector. This credibility level weight vector can include the level weights corresponding to multiple credibility levels. The credibility level weight vectors corresponding to multiple credibility evaluation indices can form a fuzzy evaluation matrix. This fuzzy evaluation matrix can be as follows: [ [0.1, 0.2, 0.3, 0.2, 0.2], # ORIGIN type [0.05, 0.05, 0.1, 0.2, 0.6], # BGPSEC signature verification [0.1, 0.2, 0.3, 0.3, 0.1], # Routing network segment authorization matching [0.05, 0.15, 0.3, 0.3, 0.2], # Length of AS_PATH [0.1, 0.2, 0.3, 0.25, 0.15], # Path fluctuation frequency [0.05, 0.15, 0.25, 0.35, 0.2], # NEXT_HOP connectivity [0.05, 0.1, 0.3, 0.35, 0.2], # NEXT_HOP delay [0.1, 0.2, 0.3, 0.2, 0.2] # COMMUNITY property] In addition, different credibility evaluation indicators can correspond to different indicator scoring methods.

[0042] The ORIGIN type is a BGP attribute used to describe how a route was initially injected into the BGP system. The ORIGIN type can include three attribute values: Interior Gateway Protocol (IGP), Exterior Gateway Protocol (EGP), and Unknown / Incomplete Origin (INCOMPLETE). IGP indicates the route originated within the BGP AS and has the highest reliability, thus its metric score can be set to 1. EGP indicates the route was learned through an Exterior Gateway Protocol and has lower reliability than IGP, thus its metric score can be set to 0.7. INCOMPLETE indicates the route's origin is unclear or unstable and has the lowest reliability, thus its metric score can be set to 0.3. Based on this, after extracting the ORIGIN type of a route from the BGP routing table, the metric score of the route for that ORIGIN type can be determined according to its attribute values.

[0043] For BGPSEC signature verification, the BGPSEC signature typically contains information such as the public key, signature, and validity period, used to verify the authenticity of the route source. If the signature in the BGPSEC signature is valid and within its validity period, the corresponding metric score for BGPSEC signature verification can be set to 1. If the signature in the BGPSEC signature is invalid or not within its validity period, the corresponding metric score for BGPSEC signature verification can be set to 0.

[0044] For route segment authorization matching. In some embodiments, obtaining a metric score for route authorization matching on the route segment may specifically include: Extract the destination Internet Protocol address of the route from the BGP routing table; Query the Internet Protocol Address-Autonomous System Mapping Table to determine the target autonomous system corresponding to the destination Internet Protocol Address; Search the Internet Router Registry for the authorized network segment corresponding to the target Autonomous System; Based on the relationship between the destination Internet Protocol address and the authorized network segment, an index score for authorized matching of the routing network segment is determined.

[0045] Here, the Internet Routing Registry (IRR) database can include the routing authorization network segments corresponding to the AS. The WHOIS database can be used to store the mapping relationship between Internet Protocol (IP) addresses and ASs; that is, the WHOIS database can include an IP-AS mapping table, which is updated hourly.

[0046] As an example, after retrieving the IP address of the route from the BGP routing table, the Internet Protocol Address-Autonomous System (IP-AS) mapping table stored in the WHOIS database can be queried to determine the target AS corresponding to the target IP address, and the authorized network segment corresponding to the target AS can be queried from the IRR database. If the destination IP address is in the authorized network segment corresponding to the target AS, the metric score corresponding to the authorized matching score of the route network segment can be set to 1. If the destination IP address is not in the authorized network segment corresponding to the target AS, the metric score corresponding to the authorized matching score of the route network segment can be set to 1.

[0047] As another example, this application embodiment can pre-convert the destination IP of traffic to an AS number based on the IP-AS mapping table in the WHOIS database, associate it with fields such as AS_PATH and ORIGIN in the BGP routing table, generate an "AS-Route-Traffic" association table, then query the destination IP of the route and its corresponding target AS from the "AS-Route-Traffic" association table, and then query the authorized network segment corresponding to the target AS in the IRR database. If the destination IP address is in the authorized network segment corresponding to the target AS, the indicator score corresponding to the authorized matching of the route network segment can be determined as 1. If the destination IP address is not in the authorized network segment corresponding to the target AS, the indicator score corresponding to the authorized matching of the route network segment can be determined as 1.

[0048] Regarding the AS_PATH length, after extracting the AS_PATH length of a route from the BGP routing table, the AS_PATH length can first be normalized, mapping it to a value between 0 and 20. If the AS_PATH length is less than or equal to 5, the route's metric score under that AS_PATH length is determined to be 1. If the AS_PATH length is between 6 and 10, the route's metric score under that AS_PATH length is determined to be 0.7. If the AS_PATH length is greater than 10, the route's metric score under that AS_PATH length is determined to be 0.3.

[0049] To determine the path fluctuation frequency, the AS_PATH information of the route can be collected every target time step (e.g., 5 minutes) and compared with the previous collection result to identify changes. If the AS_PATH changes between two collections, it is counted as one path fluctuation. The total number of path fluctuations occurring within a unit of time (e.g., 1 hour, or 12 collection cycles) is counted, and this total number of path fluctuations within that unit of time is determined as the path fluctuation frequency. If the path fluctuation frequency is less than or equal to 1 time / hour, the corresponding indicator score can be set to 1. If the path fluctuation frequency is 2-5 times / hour, the corresponding indicator score can be set to 0.5. If the path fluctuation frequency is greater than 5 times / hour, the corresponding indicator score can be set to 0.1.

[0050] To determine the NEXT_HOP connectivity rate, we can count the total number of probes within a unit of time (e.g., 1 hour) (60 probes × 3 packets = 180 probe samples), filter out the valid probes that "respond with at least 1 packet," and calculate the NEXT_HOP connectivity rate using the following formula: NEXT_HOP Connectivity Rate = Valid Probes ÷ Total Probes × 100%. If the NEXT_HOP connectivity rate is less than or equal to 99.9%, the corresponding score is set to 1. If the NEXT_HOP connectivity rate is between 99% and 99.9%, the corresponding score is set to 0.6. If the NEXT_HOP connectivity rate is less than 99%, the corresponding score is set to 0.2.

[0051] To determine the NEXT_HOP latency, first obtain the Round-Trip Time (RTT) data for the NEXT_HOP probe. This RTT data reflects the network response speed of the next hop. Remove RTT data that time out (>200ms) or are outliers (deviation from the average by 3 standard deviations) from a single probe, and take the average RTT as the latency value at that time point. Calculate the average latency across all valid time points within one hour to obtain the NEXT_HOP latency. If the NEXT_HOP latency is less than or equal to 50ms, the corresponding metric score can be set to 1. If the NEXT_HOP latency is between 50ms and 100ms, the corresponding metric score can be set to 0.7. If the NEXT_HOP latency is greater than 100ms, the corresponding metric score can be set to 0.3.

[0052] For the COMMUNITY attribute, in some embodiments, obtaining the route's score on the community attribute metric may specifically include: Extract the community attributes of the routes from the BGP routing table. The community attributes include the autonomous system identifier and the service type identifier. Obtain the list of trusted autonomous systems and the list of trusted service types; Based on the relationship between autonomous system identifiers and the list of trusted autonomous systems, and the relationship between business type identifiers and the list of trusted business types, the index scores of community attributes are determined.

[0053] Here, the financial cloud network management platform can predefine trusted community COMMUNITY attribute rules, using a two-field identifier: "AS number: business type". For example, the core business trusted community is 65000:100 (65000 is the financial cloud autonomous system number, and 100 is the core business type). Untrusted communities are uniformly marked as 65000:200 and above. Additionally, a trusted autonomous system list and a trusted business type list can be predefine. The trusted autonomous system list can include multiple trusted autonomous system identifiers. The trusted business type list can include multiple trusted business types. For example, trusted business types can be marked between 100 and 199. Untrusted business types can be marked as 200 and above.

[0054] As an example, the COMMUNITY field of a route can be extracted from the BGP routing table and split into the "AS number part" and the "service type part". If the field is a single value, i.e., it only includes an AS number and a service type, then if both the AS number and the service type are in the Trusted Autonomous Systems list, the metric score corresponding to the community attribute can be determined as 1.0. If the AS number is in the Trusted Autonomous Systems list, but the service type is not, the metric score corresponding to the community attribute can be determined as 0.4. If the AS number is not in the Trusted Autonomous Systems list, the metric score corresponding to the community attribute can be determined as 0.2. If the COMMUNITY field has multiple values ​​(e.g., [65000:100,65010:300]), the service type corresponding to the confirmed trusted AS number (e.g., 65000) can be extracted first, and the metric score of the community attribute can be determined based on that AS number and service type.

[0055] Based on the above embodiments, a routing trust evaluation system table provided in one embodiment of this application can be shown in Table 1 below: Table 1

[0056] In Table 1, the eight secondary indicators are the eight credible evaluation indicators.

[0057] Based on this, after obtaining the indicator weights and trust level weight vectors corresponding to multiple trust evaluation indicators, and the indicator scores of the route on multiple trust evaluation indicators, for each trust level, the product of the indicator score, indicator weight, and level weight is calculated to obtain the level score corresponding to that trust level. Among the multiple level scores, the trust level corresponding to the highest level score is the trust level of the route, and the highest level score is the route level score.

[0058] Based on this, in some embodiments, obtaining a route trust score may specifically include: Based on the baseline scores corresponding to multiple trust levels, the level scores corresponding to the multiple trust levels are weighted and summed to obtain the routing trust score.

[0059] Here, the baseline scores for multiple trust levels—untrusted, low trust, medium trust, high trust, and extremely trust—can be 1, 3, 5, 7, and 9, respectively. Assuming the level scores corresponding to these trust levels are denoted as A1, A2, A3, A4, and A5, the routing trust score A can be determined using the following formula: A = 1 × A1 + 3 × A2 + 5 × A3 + 7 × A4 + 9 × A5.

[0060] This application innovatively introduces fields such as AS number, AS_PATH (including path length / AS sequence), ORIGIN (IGP / EGP / INCOMPLETE), NEXT_HOP (including IP address / connectivity status), COMMUNITY (financial cloud custom attribute 65000:100-200), and BGPSEC signature (public key / signature validity period), and combines them with auxiliary data such as WHOIS database (IP-AS mapping table, updated hourly) and IRR database (AS routing authorization network segment), and constructs a routing trust evaluation system of "4 primary indicators + 8 secondary indicators" based on the above data.

[0061] By first obtaining the indicator weights and trust level weight vectors corresponding to the aforementioned multiple trust evaluation indicators, and the indicator scores of the route on multiple trust evaluation indicators, and then, for each trust level, calculating the product of the indicator score, indicator weight, and level weight to obtain the level score corresponding to that trust level, and then determining the level score with the largest value among multiple level scores as the route level score, and determining the trust level corresponding to the largest value level score as the route's trust level, a quantitative assessment of route trustworthiness is achieved. Since untrustworthy and low trustworthiness correspond to spoofed routes, and medium trustworthiness, high trustworthiness, and extremely trustworthiness correspond to legitimate routes, this embodiment of the application can distinguish between legitimate routes and spoofed routes, laying the foundation for identifying spoofed attack traffic forwarded through multiple ASs.

[0062] Based on this, in order to improve network stability, in some embodiments, after determining the highest value among multiple level scores as the route trust level score, the method may further include: The route trust level is determined based on the route trust level score; If the route trust level is untrusted or low trust, output a route anomaly alarm.

[0063] This application embodiment outputs route anomaly alarms when the route trust level is untrusted or low trust, enabling early identification and timely handling of forged routes to improve network stability. Handling forged routes can involve blocking the traffic corresponding to that route or redirecting suspected Distributed Denial of Service (DDoS) traffic to a cloud-based scrubbing center (scrubbing capacity ≥200Gbps) for traffic cleanup, thereby improving network stability.

[0064] Based on this, the acquisition of the first traffic information, first routing information, and first connection establishment information of the Autonomous System (AS) at the BGP egress point within the first time period prior to the first moment can specifically include: According to the target time step, obtain multiple first traffic information, multiple first routing information and multiple first link establishment information of AS level within the first time period before the first moment of the BGP exit.

[0065] Here, the first duration can be, for example, 1 hour, and the target time step can be, for example, 5 minutes.

[0066] As an example, a traffic anomaly detection system can collect AS-level traffic data, link establishment data, and routing characteristics at a granular level of 1 hour and 5 minutes in real time, and obtain multiple first traffic information, multiple first routing information, and multiple first link establishment information arranged in chronological order.

[0067] In some embodiments, in S120, the second duration may be, for example, 15 minutes, and the predicted traffic may include input traffic and output traffic. Specifically, the predicted traffic may include the predicted average input traffic and average output traffic for the next 15 minutes.

[0068] As an example, based on the multiple first traffic information, multiple first routing information and multiple first link establishment information arranged in chronological order within the first time period before the first moment, and the contextual dependencies between them, the AS-level traffic within the second time period after the first moment can be predicted to obtain the predicted traffic.

[0069] Therefore, in order to improve the accuracy of traffic prediction, in some embodiments, the above-mentioned S120 may specifically include: A time series sequence is constructed based on multiple first traffic information, multiple first routing information, and multiple first chain establishment information. Using a Long Short-Term Memory (LSTM) network model, based on a time series, the AS-level traffic within the second time period after the first time point is predicted to obtain the predicted traffic. The LSTM network model is trained based on a first sample and a first label. The first sample includes multiple historical traffic information, multiple historical routing information, and multiple historical link establishment information of the BGP exit within the first time period before the second time point. The first label is the average AS-level traffic of the BGP exit within the second time period after the second time point.

[0070] Here, the Long Short-Term Memory (LSTM) network model can be trained based on 6 months of AS-level historical data from the financial cloud. This historical data can include approximately 87,000 first samples and their corresponding first labels. The first samples can include multiple historical traffic information, multiple historical routing information, and multiple historical link establishment information at the AS level for a first duration prior to the second time step, obtained according to the target time step. The second time step can be any time within the aforementioned 6 months, the first duration can be, for example, 1 hour, and the target time step can be, for example, 5 minutes. Furthermore, the historical traffic information can include 10-dimensional traffic features such as inflow byte rate, outflow byte rate, inflow volume, outflow volume, inflow packet rate, outflow packet rate, inflow retransmission rate, outflow retransmission rate, inflow traffic change rate, and outflow traffic change rate. The historical routing information can include 4-dimensional routing features such as route trust score, NEXT_HOP connectivity, NEXT_HOP latency, and AS_PATH length. Historical connection establishment information can include two-dimensional connection establishment features such as inbound Transmission Control Protocol (TCP) connection success rate and outbound TCP connection success rate. Additionally, the first label can be the AS-level traffic average over a second duration following the second time point. The second duration could be, for example, 15 minutes. This traffic average can include both inbound and outbound traffic averages. The above sample data can be divided into training, validation, and test sets in a 7:2:1 ratio.

[0071] As an example, after obtaining the aforementioned historical traffic information, historical routing information, and historical link establishment information, preprocessing such as data cleaning and data normalization can be performed on these information to obtain normalized historical traffic information, historical routing information, and historical link establishment information, and the normalization parameters can be saved. Data cleaning may include filtering invalid entries in the BGP routing table where AS_PATH is empty or NEXT_HOP ping fails, as well as removing abnormal traffic from the traffic data that consists of single packets smaller than 64 bytes or has a destination port of 135 / 445. Data normalization can include mapping traffic data (0-10000Mbps), TCP connection success rate (0-100%), and NEXT_HOP latency (0-200 ms) with large differences in feature value ranges to the same range (such as [0,1] or [-1,1]). This avoids situations where features with large values ​​dominate model training while features with small values ​​are ignored, thus enabling the model to learn the weights of each feature fairly, accelerating convergence and improving traffic prediction accuracy.

[0072] In addition, for each first sample, after data preprocessing, the above 10-dimensional traffic features, 4-dimensional routing features, and 2-dimensional link building features can be determined as 16-dimensional input features. Based on the target time step, the multiple 16-dimensional input features are sorted to obtain time series samples.

[0073] Alternatively, the LSTM model can be built using TensorFlow with a two-layer LSTM model (64 neurons in the first layer + 32 neurons in the second layer, dropout=0.2), using Adaptive Moment Estimation (Adam) as the optimizer (learning rate 0.001) and Mean Squared Error (MSE) as the loss function, trained for 50 epochs (with an early stopping mechanism to prevent overfitting), resulting in a well-trained LSTM model. For the trained LSTM model, the prediction accuracy on the test set should be ≥96%, and the MSE ≤50Mbps.

[0074] Once the trained LSTM model is obtained and deployed, AS-level traffic data, link establishment data, and routing features at a granularity of 1 hour and 5 minutes can be collected in real time. This yields multiple first traffic information, multiple first routing information, and multiple first link establishment information arranged in chronological order. Based on the normalization parameters saved during model training, these data are normalized to obtain a time-series sequence. The time-series sequence includes multiple 16-dimensional input features sorted according to the target time step.

[0075] Based on this, by loading the trained LSTM model through a high-performance inference engine (such as ONNX Runtime), the trained LSTM model can predict AS-level traffic within the second time period after the first moment (delay ≤ 10ms / time) based on the time series, and output the average traffic prediction for the next 15 minutes to obtain the predicted traffic.

[0076] This application embodiment uses an LSTM model to predict AS-level traffic within a second time period after the first time step, based on the aforementioned time series, thereby obtaining the predicted traffic and improving the accuracy and efficiency of traffic prediction.

[0077] Therefore, in order to improve network stability, in some embodiments, after obtaining the predicted traffic, the method may further include: If the predicted traffic is greater than or equal to the traffic threshold, a traffic congestion alarm will be output. The traffic threshold is determined based on the outbound link traffic.

[0078] Here, the traffic threshold can be, for example, 80% of the outbound link traffic. If the predicted traffic is greater than or equal to 80% of the outbound link traffic, traffic congestion can be identified, and a traffic congestion alarm can be output to facilitate timely traffic processing and improve network stability. Traffic processing may include, for example, at least one of the following: prioritizing core services such as payment to high-trust routes or higher, and maintaining available traffic for these core services greater than or equal to 70% of the outbound link traffic; offloading non-core services such as log uploads, backup synchronization, and office work to medium-trust routes, and limiting the available traffic for these non-core services to 30% of the outbound link traffic.

[0079] This application embodiment outputs a traffic congestion alarm when the predicted traffic is greater than or equal to a traffic threshold, which can remind users or the system to automatically and promptly handle traffic to resolve traffic congestion problems and improve network stability.

[0080] In addition, the embodiments of this application can incrementally train the LSTM model for 5-10 rounds every preset time period (e.g., 1 month) using newly added historical data within the preset time period. After verifying that the accuracy is ≥96%, the old model is replaced to adapt to changes in traffic patterns (e.g., peak payment periods during holidays), thereby ensuring the long-term stability of the network.

[0081] In some embodiments, in S130, the flow fluctuation information may include the amount of flow fluctuation and the rate of flow fluctuation. The amount of flow fluctuation may include the amount of inflow flow fluctuation and the amount of outflow flow fluctuation. The rate of flow fluctuation may include the rate of inflow flow fluctuation and the rate of outflow flow fluctuation.

[0082] As mentioned above, actual flow can include the actual inflow and outflow at the first moment, while predicted flow can include the average predicted inflow and average predicted outflow over a second time period after the first moment. Therefore, by calculating the difference between the actual inflow and the average predicted inflow, we can obtain the inflow fluctuation; by calculating the difference between the actual outflow and the average predicted outflow, we can obtain the outflow fluctuation. Based on this, by calculating the ratio of the inflow fluctuation to the average predicted inflow, we can obtain the inflow volatility. Similarly, by calculating the ratio of the outflow fluctuation to the average predicted outflow, we can obtain the outflow volatility.

[0083] In some embodiments, in S140, since the routing trust level is closely related to traffic fluctuations, the routing trust level can be dynamically adjusted based on the traffic fluctuation information after obtaining the traffic fluctuation information.

[0084] Therefore, in order to improve the accuracy of adjusting the reliability level of routes, in some embodiments, the above-mentioned S140 may specifically include: Identify volatility factors that are negatively correlated with flow volatility; The route trust level score is updated based on the product of the fluctuation factor and the route trust level score.

[0085] Here, for any of the inflow and outflow volatility rates, the route trust level score can be updated using the following formula: Second route trust level score = First route trust level score × (1 - Traffic volatility). Wherein, the first route trust level score represents the route trust level score at the second time point before the update, and the second route trust level score represents the route trust level score within the second time period after the updated second time point. Furthermore, if the traffic volatility rate is greater than 100%, the traffic volatility rate can be set to 1. Additionally, the updated route trust level score can be the average of the route trust level scores corresponding to the inflow and outflow volatility rates, respectively.

[0086] The embodiments of this application, through the above formula, can reduce the routing trust level score under conditions of drastic traffic fluctuations, especially significant increases, thereby improving the accuracy of adjusting the routing trust level.

[0087] In some embodiments, in S150, the change in route trust level can be obtained by calculating the difference between the second route trust level score and the first route trust level score.

[0088] Furthermore, as described above, multiple first next-hop delays (NEXT_HOP delays) can be obtained within the first duration prior to the first moment. If the first duration is 1 hour, the difference between the second next-hop delay and the first next-hop delay can be calculated using the following formula to obtain the NEXT_HOP delay change rate: NEXT_HOP latency change rate = (Second NEXT_HOP latency - Average latency of multiple first NEXT_HOP latencies in the past hour) ÷ Average latency of multiple first NEXT_HOP latencies in the past hour × 100%.

[0089] Similarly, within the first duration prior to the first moment, multiple first path lengths (AS_PATH lengths) can be obtained. If the first duration is 1 hour, the difference between the second path length and the first path length can be calculated using the following formula to obtain the AS_PATH length change rate: AS_PATH length change rate = (Second AS_PATH length - average length of multiple first AS_PATH lengths in the past hour) ÷ average length of multiple first AS_PATH lengths in the past hour × 100%.

[0090] The change in route trust level, the rate of change in NEXT_HOP delay, and the rate of change in AS_PATH length can be collectively referred to as route fluctuation information.

[0091] In some embodiments, in S160, a random forest model can be pre-trained, and traffic anomaly detection can be performed based on traffic fluctuation information and routing fluctuation information using the trained random forest model. The traffic anomaly detection result can include normal traffic and abnormal traffic. Traffic anomalies can correspond to multiple anomaly types. These anomaly types can include distributed denial-of-service (DDoS) attacks, route hijacking, and link failures, etc.

[0092] Therefore, in order to improve the efficiency and accuracy of traffic anomaly detection, in some embodiments, the above-mentioned S160 may specifically include: Using a random forest model, based on traffic fluctuation information and routing fluctuation information, the probabilities corresponding to multiple traffic types are determined. Traffic types include normal traffic and abnormal traffic. Abnormal traffic includes distributed denial-of-service attacks, route hijacking, and link failures. The random forest model is trained based on the second sample and the second label. The second sample includes traffic fluctuation samples and routing fluctuation samples. The second label is any one of normal traffic, distributed denial-of-service attacks, route hijacking, and link failures. The traffic type corresponding to the probability that meets the preset probability conditions is determined as the target traffic type.

[0093] Here, the random forest model can be trained using normal samples (approximately 43,500) from stable traffic periods in the financial cloud and anomalous samples (approximately 14,500) such as DDoS attacks (traffic surge ≥200%), route hijacking (route trust level drops ≥4 points), and link failures (NEXT_HOP latency increases ≥100ms), with a positive-to-negative sample ratio of 1:3. That is, the second sample can include 3 / 4 normal samples and 1 / 4 anomalous samples. The second sample can include traffic fluctuation samples and route fluctuation samples. Traffic fluctuation samples can include traffic fluctuation amount and traffic fluctuation rate. Traffic fluctuation amount can include input traffic fluctuation amount and output traffic fluctuation amount. Traffic fluctuation rate can include input traffic fluctuation rate and output traffic fluctuation rate. Route fluctuation samples can include changes in route trust level, NEXT_HOP latency change rate, and AS_PATH length change rate. Furthermore, the second label for normal samples can be "traffic normal." If a sample experiences a traffic surge ≥200%, the sample can be considered an anomalous sample, and the corresponding second label can be "DDoS attack." If the route trust level in a sample drops sharply by ≥4 points, the sample can be considered an anomalous, and the corresponding second label can indicate route hijacking. If the NEXT_HOP latency in a sample increases by ≥100ms, the sample can be considered an anomalous, and the corresponding second label can indicate link failure. The above sample data (including the second sample and its corresponding second label) can be divided into training, validation, and test sets in a 7:2:1 ratio.

[0094] As an example, after obtaining the above sample data, the sample data can be preprocessed such as data cleaning and data normalization to obtain normalized sample data, and the normalization parameters can be saved.

[0095] Alternatively, the random forest model can be a Scikit-learn-based model consisting of 100 decision trees with a maximum depth of 10. The random forest model is trained using the normalized sample data described above. If the validation set accuracy is ≥97% and the recall is ≥95%, the trained random forest model is considered successful.

[0096] After obtaining and deploying the trained random forest model, AS-level real-time traffic information (i.e., second-level traffic information) and routing features (i.e., second-level routing information) can be collected. Following the method described above, this AS-level real-time traffic information and routing features are processed to obtain input features such as input traffic fluctuation, output traffic fluctuation, input traffic volatility, output traffic volatility, route trust level change, NEXT_HOP latency change rate, and AS_PATH length change rate. These input features are then fed into the random forest model to output probabilities corresponding to multiple traffic types. The probability greater than 0.8 or the highest probability among multiple probabilities can be the target probability. The traffic type corresponding to the target probability can be the target traffic type. If the target traffic type is any one of distributed denial-of-service attack, route hijacking, or link failure, then traffic anomaly can be determined.

[0097] This application embodiment uses a random forest model to determine the target traffic type based on the aforementioned traffic fluctuation information and routing fluctuation information, and determines whether the traffic is abnormal based on the target traffic type. It can accurately identify AS-level threats such as DDoS attacks (sudden increase in traffic), route hijacking (sudden drop in trust level), and link failures (increased latency), thereby improving the accuracy and efficiency of traffic anomaly detection.

[0098] Based on this, in order to improve network stability, in some embodiments, after determining the traffic type corresponding to the probability of satisfying a preset probability condition as the target traffic type, the method may further include: If the target traffic type is any one of distributed denial-of-service attack, route hijacking, or link failure, an abnormal traffic alarm will be output.

[0099] Here, if the target traffic type is any one of distributed denial-of-service attacks, route hijacking, or link failure, then traffic anomaly can be identified, and a traffic anomaly alarm can be output. This alarm is then simultaneously pushed to the operations and maintenance platform and traffic scheduling module for timely traffic processing, thereby improving network stability. Traffic processing may include, for example, at least one of the following: prioritizing core services such as payment-related traffic to highly trusted or higher-level routes, and maintaining available traffic for these core services greater than or equal to 70% of the outbound link traffic; offloading non-core services such as log uploads, backup synchronization, and office work to medium-trusted routes, and limiting the available traffic for these non-core services to 30% of the outbound link traffic.

[0100] This application embodiment outputs a traffic anomaly alarm when the target traffic type is any one of distributed denial-of-service attack, route hijacking, or link failure. This can remind users or the system to automatically and promptly handle traffic anomalies, thereby resolving traffic anomaly issues and improving network stability.

[0101] In addition, this application embodiment can supplement new threat events added within a preset time period (e.g., one quarter) and label samples, and merge the old and new data to retrain the model. If the gray-scale verification (10% AS traffic dual-model inference) is correct, the old model is fully replaced with the new model to ensure a recall rate of ≥95% for new threats.

[0102] Through comparative experiments, the embodiments of this application, by using COMMUNITY attribute tagging and a trusted route evaluation mechanism, increase the trusted route utilization rate to 92%, significantly enhancing network stability. Furthermore, the response speed for AS-level threat identification (i.e., AS-level abnormal traffic detection) is improved by 90%, the route hijacking incident repair time is reduced from 2 hours to within 10 minutes, and the risk of service interruption is reduced by 80%. Additionally, by integrating trusted route evaluation with artificial intelligence algorithm prediction, the false alarm rate for anomaly detection is reduced from 20% to below 3%, and the efficiency of operation and maintenance alarm handling is improved by 85%; the DDoS attack identification rate is increased from 75% in existing solutions to 98%, and the attack interception success rate is ≥99%.

[0103] Based on the traffic anomaly detection method provided in the above embodiments, this application also provides specific implementation methods of the traffic anomaly detection device. Please refer to the following embodiments.

[0104] like Figure 2 As shown, a traffic anomaly detection device 200 provided in one embodiment of this application includes the following modules: The acquisition module 210 is used to acquire the first traffic information, first routing information, and first link establishment information of the Autonomous System (AS) at the Border Gateway Protocol (BGP) exit within a first time period before the first moment, as well as the second traffic information and second routing information at the AS level at the first moment. The first routing information includes a route trust score, a first next-hop delay, and a first path length. The second routing information includes a route trust level score, a second next-hop delay, and a second path length. The route trust score and route trust level score are determined based on the trustworthiness of the route origin, path stability, next-hop reliability, and community attribute matching degree. The second traffic information includes actual traffic. Prediction module 220 is used to predict the AS-level traffic in the second time period after the first moment based on the first traffic information, first routing information and first link establishment information of the autonomous system AS-level in the first time period before the first moment, so as to obtain the predicted traffic. The determination module 230 is used to determine traffic fluctuation information based on the difference between predicted traffic and actual traffic; Update module 240 is used to update the route trust level score based on traffic fluctuation information; The determination module 230 is also used to determine routing fluctuation information based on the difference between the updated route trust level score and the route trust level score, the difference between the second next-hop delay and the first next-hop delay, and the difference between the second path length and the first path length; The detection module 250 is used to detect traffic anomalies based on traffic fluctuation information and routing fluctuation information.

[0105] The flow anomaly detection device 200 described above is explained in detail below: In some embodiments, route origin trustworthiness, path stability, next-hop reliability, and community attributes correspond to multiple trustworthiness evaluation indicators. These indicators include route origin type, secure route signature verification, route segment authorization matching, path length, path fluctuation frequency, next-hop connectivity, next-hop latency, and community attributes. Based on this, the acquisition module 210 may specifically include: The acquisition submodule is used to acquire the index weights and trust level weight vectors corresponding to multiple trust evaluation indicators for routes to the destination AS, as well as the index scores of the routes on multiple trust evaluation indicators. The trust level weight vector includes the level weights corresponding to multiple trust levels. The determination submodule is used to determine the level score for each trust level based on the product of the indicator score, indicator weight, and level weight. The determination submodule is used to determine the highest value among multiple level scores as the route trust level score.

[0106] In some embodiments, the acquisition module 210 may specifically include: The calculation submodule is used to perform a weighted summation of the level scores corresponding to multiple trust levels based on the benchmark scores corresponding to multiple trust levels, so as to obtain the routing trust score.

[0107] In some embodiments, the acquisition submodule may specifically include: The extraction unit is used to extract the community attributes of routes from the BGP routing table. The community attributes include the autonomous system identifier and the service type identifier. The acquisition unit is used to acquire a list of trusted autonomous systems and a list of trusted service types. The determination unit is used to determine the index score of community attributes based on the relationship between autonomous system identifiers and the list of trusted autonomous systems, and the relationship between business type identifiers and the list of trusted business types.

[0108] In some embodiments, the acquisition submodule may specifically include: The extraction unit is also used to extract the destination Internet Protocol address of the route from the BGP routing table; The query unit is used to query the Internet Protocol address-Autonomous System mapping table to determine the target autonomous system corresponding to the destination Internet Protocol address; The query unit is also used to query the Internet Router Registry for the authorized network segment corresponding to the target autonomous system; The determination unit is also used to determine the rating of the authorized matching index of the routing network segment based on the relationship between the destination Internet Protocol address and the authorized network segment.

[0109] In some embodiments, multiple trust levels include untrusted, low trust, medium trust, high trust, and extremely trust. Based on this, the acquisition module 210 may further include: The determination submodule is also used to determine the route trust level based on the route trust level score after determining the highest value among multiple level scores as the route trust level score. The alarm submodule is used to output routing anomaly alarms when the routing trust level is untrusted or low trust.

[0110] In some embodiments, the traffic fluctuation information includes the traffic fluctuation rate. Based on this, the update module 240 may specifically include: The determination submodule is also used to determine the volatility factor that is negatively correlated with the flow volatility. The update submodule is used to update the route trust level score based on the product of the volatility factor and the route trust level score.

[0111] In some embodiments, the acquisition module 210 may specifically include: The acquisition submodule is also used to acquire multiple first traffic information, multiple first routing information and multiple first link establishment information of AS level within the first time period before the first moment of the BGP exit, according to the target time step.

[0112] Based on this, the prediction module 220 may specifically include: A submodule is constructed to build a time-series sequence based on multiple first traffic information, multiple first routing information, and multiple first link establishment information. The prediction submodule is used to predict AS-level traffic within a second time period after the first time step using a long short-term memory network model based on a time series sequence. The long short-term memory network model is trained based on a first sample and a first label. The first sample includes multiple historical AS-level traffic information, multiple historical routing information, and multiple historical link establishment information of the BGP exit within the first time period before the second time step. The first label is the average AS-level traffic of the BGP exit within the second time step after the second time step.

[0113] In some embodiments, the prediction module 220 may further include: The alarm submodule is also used to output a traffic congestion alarm when the predicted traffic is greater than or equal to a traffic threshold after the predicted traffic is obtained. The traffic threshold is determined based on the outbound link traffic.

[0114] In some embodiments, the detection module 250 may specifically include: The determination submodule is also used to determine the probabilities corresponding to multiple traffic types based on traffic fluctuation information and routing fluctuation information using a random forest model. The traffic types include normal traffic and abnormal traffic. Abnormal traffic includes distributed denial-of-service attacks, route hijacking, and link failures. The random forest model is trained based on the second sample and the second label. The second sample includes traffic fluctuation samples and routing fluctuation samples. The second label is any one of normal traffic, distributed denial-of-service attacks, route hijacking, and link failures. The determination submodule is also used to determine the traffic type corresponding to the probability that meets the preset probability conditions as the target traffic type.

[0115] In some embodiments, the detection module 250 may further include: The alarm submodule is also used to output a traffic anomaly alarm when the traffic type corresponding to the probability that meets the preset probability conditions is determined as the target traffic type, and the target traffic type is any one of distributed denial-of-service attack, route hijacking and link failure.

[0116] This application's embodiments determine route trust scores and route trust level scores based on route origin trustworthiness, path stability, next-hop reliability, and community attribute matching, constructing a dynamic route trust level evaluation system. This system can distinguish between legitimate and spoofed routes based on route trust scores and route trust level scores, laying the foundation for identifying spoofed attack traffic forwarded through multiple ASs. Furthermore, by using the first AS-level traffic information, first route information (including route trust scores), and first link establishment information within the first time period before the first moment at the BGP exit, the system jointly predicts AS-level traffic within the second time period after the first moment, obtaining predicted traffic and improving the accuracy of predicted traffic. By determining traffic fluctuation information based on the difference between the predicted traffic within the second time period after the first moment and the actual traffic at the first moment, and performing traffic anomaly detection based on this traffic fluctuation information—that is, performing traffic anomaly detection based on the current traffic and future traffic—the system improves the timeliness of traffic anomaly detection. Based on this, by updating the route trust level score based on traffic fluctuation information, and determining the route fluctuation information based on the difference between the updated route trust level score and the original route trust level score (i.e., the change in route trust level), the difference between the second next-hop delay and the first next-hop delay, and the difference between the second path length and the first path length, and jointly performing traffic anomaly detection based on traffic fluctuation information and route fluctuation information, it is possible to effectively and in real time identify spoofed attack traffic forwarded by multiple ASs, thereby improving the accuracy and timeliness of traffic anomaly detection.

[0117] Based on the traffic anomaly detection method provided in the above embodiments, this application also provides specific implementation methods for electronic devices. Figure 3 A schematic diagram of the structure of an electronic device provided in one embodiment of this application is shown.

[0118] like Figure 3 As shown, the electronic device 300 may include a processor 310 and a memory 320 storing computer program instructions.

[0119] Specifically, the processor 310 may include a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0120] Memory 320 may include mass storage for data or instructions. For example, and not limitingly, memory 320 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where suitable, memory 320 may include removable or non-removable (or fixed) media. Where suitable, memory 320 may be internal or external to electronic device 300. In a particular embodiment, memory 320 is a non-volatile solid-state memory.

[0121] In specific embodiments, the memory 320 may be implemented as a read-only memory (ROM), random access memory (RAM), static storage device, dynamic storage device, etc. The memory 320 may store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 320 and executed by the processor 310. The processor 310 implements any of the traffic anomaly detection methods in the above embodiments by reading and executing the computer program instructions stored in the memory 320.

[0122] The processor 310 implements any of the traffic anomaly detection methods in the above embodiments by reading and executing computer program instructions stored in the memory 320.

[0123] In one example, electronic device 300 may further include communication interface 330 and bus 340. Wherein, for example... Figure 3 As shown, the processor 310, memory 320, and communication interface 330 are connected via bus 340 and communicate with each other.

[0124] The communication interface 330 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0125] Bus 340 includes hardware, software, or both, that couples components of an electronic device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-E) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses, or a combination of two or more of these. Where appropriate, bus 340 may include one or more buses. Although specific buses are described and illustrated in the embodiments of this application, this application considers any suitable bus or interconnection.

[0126] For example, the electronic device 300 can be a mobile phone, tablet computer, laptop computer, handheld computer, in-vehicle electronic device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc.

[0127] The electronic device can execute the traffic anomaly detection method in the embodiments of this application, thereby achieving... Figure 1 The described traffic anomaly detection method, and the beneficial effects of the corresponding method embodiments, will not be elaborated further here.

[0128] Furthermore, in conjunction with the traffic anomaly detection methods in the above embodiments, this application embodiment can provide a computer-readable storage medium for implementation. This computer-readable storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the traffic anomaly detection methods in the above embodiments. Examples of such computer-readable storage media include non-transitory computer-readable storage media, such as read-only memory (ROM).

[0129] The computer program instructions stored in the storage medium of the above embodiments are used to cause the computer to execute the traffic anomaly detection method as shown in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0130] Based on the traffic anomaly detection methods in the above embodiments, this application can provide a computer program product for implementation. When the instructions in this computer program product are executed by the processor of an electronic device, they implement any of the traffic anomaly detection methods in the above embodiments.

[0131] The computer program products of the above embodiments are used to implement the traffic anomaly detection method shown in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0132] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0133] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0134] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0135] The aspects of this application have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by dedicated hardware performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0136] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A traffic anomaly detection method, characterized by, The method comprises: obtaining first traffic information, first route information and first link information of an autonomous system (AS) level in a first time period before a first time, and second traffic information and second route information of the AS level at the first time, the first route information comprising a route trust score, a first next-hop delay and a first path length, the second route information comprising a route trust level score, a second next-hop delay and a second path length, the route trust score and the route trust level score being determined based on route origin trust, path stability, next-hop reliability and community attribute matching degree, and the second traffic information comprising actual traffic; predicting AS level traffic in a second time period after the first time based on the first traffic information, the first route information and the first link information of the AS level in the first time period, to obtain predicted traffic; determining traffic fluctuation information based on a difference between the predicted traffic and the actual traffic; updating the route trust level score based on the traffic fluctuation information; determining route fluctuation information based on a difference between the updated route trust level score and the route trust level score, a difference between the second next-hop delay and the first next-hop delay, and a difference between the second path length and the first path length; performing traffic anomaly detection based on the traffic fluctuation information and the route fluctuation information.

2. The method of claim 1, wherein, The route origin trust, the path stability, the next-hop reliability and the community attribute correspond to a plurality of trust evaluation indexes, and the plurality of trust evaluation indexes comprise route origin type, secure route signature verification, route network segment authorization matching, path length, path fluctuation frequency, next-hop connectivity rate, next-hop delay and community attribute. For a route to a destination AS, the route trust level score of the route is obtained, comprising: obtaining an index weight corresponding to each of the plurality of trust evaluation indexes, a trust level weight vector corresponding to the plurality of trust evaluation indexes, and an index score of the route on the plurality of trust evaluation indexes, the trust level weight vector comprising a level weight corresponding to each of the plurality of trust levels; for each of the trust levels, determining a level score based on a product of the index score, the index weight and the level weight; determining the maximum value of the plurality of level scores as the route trust level score.

3. The method of claim 2, wherein, The route trust score is obtained, comprising: weighting and summing the level scores corresponding to the plurality of trust levels based on reference scores corresponding to the plurality of trust levels, to obtain the route trust score.

4. The method of claim 2, wherein, The index score of the route on the community attribute is obtained, comprising: extracting the community attribute of the route from a BGP route table, the community attribute comprising an autonomous system identifier and a service type identifier; obtaining a list of trusted autonomous systems and a list of trusted service types; determining the index score of the community attribute based on a relationship between the autonomous system identifier and the list of trusted autonomous systems, and a relationship between the service type identifier and the list of trusted service types.

5. The method of claim 2, wherein, Obtain the metric score of the route on the authorization matching of the route network segment, including: Extract the destination Internet Protocol address of the route from the BGP routing table; Query the Internet Protocol Address-Autonomous System Mapping Table to determine the target autonomous system corresponding to the stated Internet Protocol Address; Search the Internet Router Registry for the authorized network segment corresponding to the target autonomous system; Based on the relationship between the destination Internet Protocol address and the authorized network segment, a score for the authorized matching of the routing network segment is determined.

6. The method of claim 2, wherein, The multiple trust levels include untrusted, low trust, medium trust, high trust, and extremely trust. After determining the highest value among the multiple trust level scores as the route trust level score, the method further includes: The route trust level is determined based on the route trust level score; If the route trust level is untrusted or low trust, output a route anomaly alarm.

7. The method of claim 1, wherein, The traffic fluctuation information includes the traffic fluctuation rate, and the updating of the route trust level score based on the traffic fluctuation information includes: Determine the volatility factor that is negatively correlated with the aforementioned flow volatility; The route trust level score is updated based on the product of the fluctuation factor and the route trust level score.

8. The method of claim 1, wherein, The acquisition of the first traffic information, first routing information, and first connection establishment information of the Autonomous System (AS) at the BGP egress point within a first time period before the first moment includes: According to the target time step, obtain multiple first traffic information, multiple first routing information and multiple first connection establishment information of the AS level within the first time period before the first moment of the BGP exit; The method of predicting AS-level traffic for a second time period after the first time period based on the first traffic information, first routing information, and first link establishment information of the Autonomous System (AS) within a first time period before the first time period, to obtain predicted traffic, includes: A time-series sequence is constructed based on the plurality of first traffic information, the plurality of first routing information, and the plurality of first connection establishment information; Using a Long Short-Term Memory (LSTM) network model, based on the time series, the AS-level traffic within a second time period after the first time point is predicted to obtain the predicted traffic. The LSTM network model is trained based on a first sample and a first label. The first sample includes multiple historical AS-level traffic information, multiple historical routing information, and multiple historical link establishment information of the BGP exit within the first time period before the second time point. The first label is the average AS-level traffic of the BGP exit within the second time period after the second time point.

9. The method according to claim 1 or 8, characterized in that, After obtaining the predicted traffic, the method further includes: If the predicted traffic is greater than or equal to a traffic threshold, a traffic congestion alarm is output, the traffic threshold being determined based on the outbound link traffic.

10. The method of claim 1, wherein, The traffic anomaly detection based on the traffic fluctuation information and the routing fluctuation information includes: Determine probabilities corresponding to a plurality of traffic types based on the traffic fluctuation information and the route fluctuation information by a random forest model, the traffic types including normal traffic and abnormal traffic, the abnormal traffic including a distributed denial of service attack, route hijacking, and link failure, the random forest model being trained based on second samples and second labels, the second samples including traffic fluctuation samples and route fluctuation samples, the second labels being any one of normal traffic, a distributed denial of service attack, route hijacking, and link failure; Determine the traffic type corresponding to the probability satisfying the preset probability condition as a target traffic type.

11. The method of claim 10, wherein, After the traffic type corresponding to the probability satisfying the preset probability condition is determined as the target traffic type, the method further includes: In a case where the target traffic type is any one of the distributed denial of service attack, the route hijacking, and the link failure, output an abnormal traffic alarm.

12. A flow anomaly detection apparatus characterized by comprising: The apparatus includes: An acquisition module configured to acquire first traffic information, first route information, and first link establishment information of an autonomous system (AS) level within a first time length before a first time, and second traffic information and second route information of the AS level at the first time, the first route information including a route trust score, a first next-hop delay, and a first path length, the second route information including a route trust level score, a second next-hop delay, and a second path length, the route trust score and the route trust level score being determined based on route origin trustworthiness, path stability, next-hop reliability, and community attribute matching degree, and the second traffic information including actual traffic; A prediction module configured to predict AS level traffic within a second time length after the first time based on the first traffic information, the first route information, and the first link establishment information of the AS level within the first time length before the first time, and obtain predicted traffic; A determination module configured to determine traffic fluctuation information based on a difference between the predicted traffic and the actual traffic; An update module configured to update the route trust level score based on the traffic fluctuation information; The determination module is further configured to determine route fluctuation information based on a difference between the updated route trust level score and the route trust level score, a difference between the second next-hop delay and the first next-hop delay, and a difference between the second path length and the first path length; A detection module configured to perform abnormal traffic detection based on the traffic fluctuation information and the route fluctuation information.

13. An electronic device, comprising: The electronic device includes a processor and a memory storing computer program instructions; The processor, when executing the computer program instructions, implements the abnormal traffic detection method of any one of claims 1-11.

14. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer program instructions, and the computer program instructions, when executed by a processor, implement the abnormal traffic detection method of any one of claims 1-11.

15. A computer program product, characterised in that, The instructions in the computer program product, when executed by a processor of an electronic device, cause the electronic device to perform the flow anomaly detection method of any one of claims 1-11.

Images