Abnormal mode recognition method and system based on AS semantic embedding

Abstract

The invention provides an abnormal mode recognition method and system based on AS semantic embedding. The method comprises the steps of building a relational graph based on real internet AS connection data, distinguishing connection types, downloading in batches, decompressing and caching BGP update data, detecting abnormal update and extracting routing features. Building an embedded model network; using AS relation graph data to train an embedding model, fusing the proximity and hierarchical relation through a comprehensive scoring function, training a node embedding vector and a weight vector by using a comparative learning method, and capturing spatial proximity and hierarchical difference characteristics of the AS network; inputting the AS routing behavior characteristics into the embedded model, and calculating path difference characteristics before and after abnormity; headmold and path features are obtained based on input data before and after abnormity, the mean value, the mean value variation, the standard deviation, the standard deviation variation and the correlation of the features are analyzed, a threshold value is set, and the mode is a self-healing mode when the standard deviation variation is small and the correlation is high; and the reconstruction mode is large in standard deviation variation and low in correlation.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data mining and computer technology, and particularly relates to an abnormal pattern recognition method and system based on AS semantic embedding. BACKGROUND

[0002] In recent years, with the continuous expansion of the Internet and the increasing complexity of network architecture, anomaly detection technology has played an important role in ensuring network stability and security. However, most existing detection methods often rely on black-box models or feature-driven strategies, although they have achieved certain results in accuracy, they still lack in explainability and practical operability. Especially in the field of Border Gateway Protocol (BGP), abnormal behavior usually involves cross-domain Autonomous System (AS) interaction, and lacks effective semantic understanding and pattern restoration mechanism, making it difficult for network operators to directly accept and apply the detection results. BGP is a core cross-domain routing protocol that supports the interconnection of the global Internet, responsible for exchanging routing information between different autonomous systems and building a complete global path. Each BGP announcement contains an AS path to a specific IP prefix, and in theory, under the stable operation of BGP, each AS should master the effective route to the global network. However, due to the lack of built-in identity authentication mechanism in the BGP protocol, any AS has the ability to publish route update information, which makes the network vulnerable to configuration errors or malicious manipulation. For example, BGP hijacking behavior directs Internet traffic to the incorrect AS by forging paths, while BGP route leakage exposes internal paths in unintended scenarios, both of which can cause serious traffic diversion and security risks. Historically, similar incidents have occurred frequently: in 2019, a Swiss operator leaked more than 70,000 routes due to configuration errors; in 2021, a British company hijacked more than 31,000 prefixes due to operational errors; and in a recent incident, a cryptocurrency platform was subjected to BGP hijacking attacks, resulting in approximately $1.9 million in asset losses. These cases fully demonstrate that traditional detection methods based on thresholds or rules are difficult to effectively deal with complex and variable BGP abnormal behaviors, especially in the absence of semantic modeling and pattern analysis, they cannot provide precise and understandable disposal recommendations for network operators. Therefore, there is an urgent need for an abnormal pattern recognition and analysis method for BGP protocol, which not only can efficiently identify potential abnormalities, but also can combine the semantic interaction between ASs to realize more explainable and operable abnormal behavior restoration. Such a method will not only improve detection accuracy, but also provide more valuable decision-making basis for network security response.

[0003] Publication No. CN119788578A (A Border Gateway Protocol Abnormality Detection Method, Device and Computer Equipment) discloses a BGP abnormality detection method and system based on a time convolution network (TCN) model, which relates to the field of network anomaly detection. First, the BGP data to be tested is obtained, which is each type of data in multiple types of BGP data and has been preprocessed. Then, the BGP data to be tested is extracted from the BGP data to be tested and these data are fused. Subsequently, the fused BGP data to be tested is input into the BGP time convolution network for detection, and finally the abnormality detection result of the BGP data to be tested is obtained. This method can effectively process the long time sequence characteristics of BGP data and capture the long-term dependence relationship in BGP data, thereby improving the accuracy of BGP data anomaly detection.

[0004] Publication No. CN118413373A (An Inter-domain Routing Abnormality Detection Method Based on Network Representation Learning) discloses an inter-domain routing abnormality detection method based on network representation learning, which relates to the fields of network security and inter-domain routing anomaly recognition. First, under offline conditions, network representation learning is performed on the commercial relationships between Internet autonomous systems, so as to eliminate the need for manual configuration. Then, by monitoring the route changes of multiple inter-domain routing convergence points in real time, the route changes are recorded and have high scalability. Then, by analyzing the path difference value, the abnormality of the route changes is detected in real time, and a general real-time detection is realized with low false alarm rate. Finally, the abnormal route changes are attributed and a route abnormality event alarm is generated, which has good interpretability, thereby realizing real-time, fine-grained and accurate recognition of route hijacking and route leakage. The method has strong scalability, accuracy and real-time performance, and can effectively detect and alarm inter-domain routing abnormalities.

[0005] In the global Internet, route anomaly detection is a key step to ensure network security and stable operation. To address this challenge, researchers have proposed various detection methods. However, traditional methods often rely on complex analysis of route information from multiple data sources, and still require a lot of manual intervention at key stages, limiting their adaptability and efficiency in dynamic environments. With the development of machine learning technology, academia has begun to try to introduce automated models to improve the intelligent level of anomaly detection by identifying the behavior patterns of route announcements. Although these methods have reduced the burden of manual work to some extent, they often rely on large-scale labeled data and hand-designed features, which not only brings significant data collection and model maintenance costs, but also makes it difficult to adapt to frequent changes in network structure and attack methods. In addition, many deep learning-based methods rely on learning high-dimensional latent representations for classification, and although their numerical performance is good, they lack explicit interpretability, making it difficult for network operators to provide specific fault location and repair suggestions, thereby limiting their application value in actual deployment.

[0006] Anomaly detection techniques are crucial for network stability and security, but most existing methods rely on black-box models or feature-driven strategies, which lack explainability and practical operability. In the field of core cross-domain routing protocol BGP, which supports global Internet interconnection, abnormal behavior involves cross-domain AS interaction, and BGP itself lacks built-in identity authentication mechanisms, making it vulnerable to configuration errors or malicious manipulation. Existing methods lack effective semantic understanding and pattern restoration mechanisms, and traditional threshold or rule-based detection methods are difficult to cope with complex and variable BGP anomalies, making it difficult for network operators to provide accurate and understandable treatment recommendations. Therefore, there is an urgent need for an anomaly pattern recognition and analysis method for BGP protocol that can efficiently identify potential anomalies and restore abnormal behavior based on AS interaction semantics, improving detection accuracy and providing more valuable decision-making basis for network security response. SUMMARY

[0007] The present application overcomes the above-mentioned shortcomings of the prior art and provides an anomaly pattern recognition method and system based on AS semantic embedding. By mining the semantic relationships and inherent routing behavior characteristics between ASs in the BGP protocol, an explainable representation space is constructed, thereby achieving efficient detection and pattern analysis of BGP anomalies, and providing more instructive response basis for network operation.

[0008] The application aims to accurately identify abnormal patterns in BGP routing through in-depth analysis of inter-autonomous system connection data. First, an AS relationship graph is constructed based on different types of AS connection data in the real Internet, and point-to-point (P2P) and provider-to-customer (P2C) relationship types are distinguished. Abnormal BGP update data is downloaded and cached by date batch to update. In the feature extraction stage, proximity distance and hierarchical distance are introduced as input features, the former is used to measure the spatial proximity between nodes in the AS graph, and the latter is used to express the relative position of nodes in the topology hierarchy, and the directionality and type of the edge are combined for modeling. Then, in the embedding training process, the model is optimized to stably retain the proximity and hierarchical relationship features at the same time, and the stochastic gradient descent (SGD) algorithm is used to adjust the network weights to improve the representation and generalization ability of the model. Then, the AS routing behavior features are extracted from the BGP routing update data, and a path difference calculation method for features is proposed to quantify the structural difference of the routing path, and the distance and edge weight between nodes are calculated based on the embedding model. Finally, by training the embedding model and setting a threshold, the fluctuation difference of the two calculated features is analyzed to identify abnormal patterns, and self-healing patterns and reconstruction patterns are identified. This method can efficiently and accurately detect abnormal patterns in BGP data through innovative AS semantic embedding and abnormal pattern recognition mechanism, and provide more accurate and interpretable solutions for network security.

[0009] The application provides an abnormal pattern recognition method based on AS semantic embedding, which comprises the following steps: S1: constructing a relationship graph based on real Internet AS connection data and distinguishing connection types. Batch download, decompression and caching of BGP update data by date, detecting abnormal updates, and extracting routing features; S2: building an embedding model network; the structure of the embedding network is: starting from the input layer, sequentially connecting the embedding mapping layer, the double metric calculation module, the loss optimization layer and the output layer.

[0010] The embedding mapping layer is used to map the AS nodes to a d-dimensional vector space, and is mapped to the proximity space and the hierarchical space through two linear layers; the double metric calculation module is used to calculate the proximity distance and the hierarchical distance between nodes; the loss optimization layer is used to balance the two errors, and the SGD algorithm is used for comparative training through the comprehensive scoring mechanism; the output layer is used to output the node embedding vector and the weight vector; S3: training the embedding model using AS relationship graph data, integrating proximity and hierarchical relationships through a comprehensive scoring function, training node embedding vectors and weight vectors using a contrastive learning method to capture spatial proximity and hierarchical difference features of the AS network; S4: Input the AS routing behavior characteristics into the trained embedding model, and calculate the path difference characteristics before and after the anomaly. head_tail_d calculates the structural distance of the first and last node embedding vectors; path_d accumulates the embedding distance of each pair of adjacent nodes in the path, combined with edge weight and direction information; S5: Based on the head_tail_d and path_d characteristics obtained from the input data before and after the anomaly, analyze their mean, mean change, standard deviation, standard deviation change and correlation. Set threshold to distinguish, small standard deviation change and high correlation for self-healing mode; large standard deviation change and low correlation for reconstruction mode.

[0011] Preferably, step S1 specifically comprises: S1.1: Use the AS relationship dataset provided by CAIDA to construct an AS graph. The dataset records contain a triple , wherein and represent two different autonomous systems, and represents the type of relationship between them. When is P2C, a directed edge from to is added to the AS graph; when is C2P, a directed edge from to is added. If represents a P2P relationship, the system adds a bidirectional edge from to and from to . Ensure that the bidirectional connection between ASs can influence each other; S1.2: Obtain BGP update data according to the date and extract routing features, which are divided into two stages of data collection and feature construction. The data collection stage generates daily BGP update filenames at 5-minute intervals, concatenates remote data source addresses (such as RIPERIS) to construct download link lists, checks whether the local already exists.bz2 compressed files or.update original files, uses wget to download missing files, and decompresses them into MRT format BGP update data through bzip2. The feature construction stage filters records with A / W field as "A", extracts column 7 as AS path path, and inputs each AS node in path into the trained embedding model to construct structural features; Preferably, step S2 specifically comprises: S2.1: The embedding mapping layer maps the AS node to a d-dimensional vector space by learning a low-dimensional embedding function ( is a learnable parameter, and ) maps each AS node to The vector representation is embedded into a proximity space and a hierarchy space through two linear layers respectively; S2.2: The double metric calculation module is used for calculating the proximity distance and the hierarchy distance between nodes; Definition of proximity distance Measuring the proximity relationship and the connection density of AS nodes, for directly connected vertex pairs For vertex pairs connected by indirect edges , by constraining Reflecting the proximity difference, the proximity distance is defined as:

[0012] Wherein and represent the embedding vectors of nodes and , is a learnable weight vector used to adjust the contribution of different dimensions, and is the Hadamard product, which quantifies the spatial position relationship of nodes by calculating the difference between node embedding vectors and weighting. Definition of hierarchy distance Used to quantify the relative position of AS nodes in the hierarchy and the hierarchy difference, for vertex pairs with directed edges and the reverse edge not in , it needs to satisfy (where is a vertex pair connected by an undirected edge) to reflect the hierarchy difference; for the edge type of AS graph, the P2C edge (provider to customer) distance is positive and as large as possible to distinguish the upper and lower levels, and the P2P edge (peer-to-peer interconnection) is bidirectional and symmetric, and the distance tends to zero; the hierarchy distance formula is defined as:

[0013] Wherein and represent the embedding vectors of nodes and , is a learnable weight vector with the same dimension as the node embedding dimension, which reflects the hierarchy space relationship by weighting the difference between node embedding vectors.

[0014] S2.3: The loss optimization layer is used to balance the proximity error and the hierarchy error, which integrates the two metrics through a comprehensive scoring mechanism and uses the SGD algorithm for comparative training; the output layer is used to output the trained node embedding vector and the weight vector.

[0015] Preferably, the step S3 specifically comprises: S3.1: The embedding model is trained using AS relation graph data, constructing neighbor vectors and hierarchical vectors to model the network structure from two dimensions. When constructing neighbor vectors, first-order proximity (1 for direct connections between nodes, 0 otherwise) and second-order proximity (measuring the structural similarity of neighbors by comparing the first-order proximity vector similarity of nodes using cosine similarity) are defined. In the embedding space, proximity relationships are modeled through vector differences. When constructing hierarchical vectors, the P2C (provider-customer) relationship in the AS network is modeled based on directed edges. Represents a node Higher level The topological partial order relation maps node embeddings to hierarchical vectors and quantifies the asymmetric hierarchical structure. S3.2: Define a comprehensive scoring function and optimize embedding training by combining proximity and hierarchical relationships. The comprehensive score is defined as:

[0016] in Indicates proximity. To indicate hierarchical relationships, through minus This allows embedding training to retain neighboring and hierarchical features; S3.3: Define a training optimization problem to broaden the difference between observed and unobserved edges and train node embeddings, neighbor vectors, and hierarchical vectors for observed edges. Non-observed edge ,satisfy The objective function is defined as:

[0017] Where E is the edge set of the AS graph. The function is the sigmoid function; it is solved using a fully connected neural network. The network consists of an embedding layer and two linear layers. The embedding layer is used to generate the embedding vectors of the AS nodes. Two linear layers map the embedding vectors to proximity. hierarchical relationship Subspace; during training, for each edge Randomly sample 10 pairs of unobserved edges Training samples are generated by generating node embedding vectors. and The objective function is then optimized using the SGD algorithm.

[0018] Preferably, step S4 specifically includes: S4.1: Quantify the structural differences of routing paths in routing roles, obtain path information based on the processed BGP update data, input each AS node in the path into the trained embedding model, and generate feature representations as inputs for subsequent difference feature calculations; S4.2: Design two path difference features based on the trained embedding model to quantify the path structure difference, for path represents the first AS node), the head-tail node distance feature is defined as:

[0019] wherein, represents the structural distance between two nodes and calculated by the embedding model, and is specifically defined as:

[0020] wherein, and represent the embedding vector components of nodes and in the first dimension, is a weight vector in the adjacent distance, is a weight vector in the hierarchical distance, used to model the path direction information.

[0021] The second path difference feature measures the structural change between each pair of adjacent AS nodes on the path, and is defined as:

[0022] wherein each term is still calculated using the embedding distance formula and the change trend of the path structure is depicted by accumulating the embedding distance between adjacent nodes.

[0023] Preferably, the step S5 specifically comprises: S5.1: Analyze the structural change of the quantification features before and after the abnormal event, train the embedding model based on the data before and after the abnormal event, respectively, and obtain the quantification features before and after the abnormal period using the two models; read the embedding result CSV files of the two time periods and splice them into a complete data frame, and focus on and two structural features; calculate the statistics of the two features before the abnormal event (forward) and after the abnormal event (backward), including the mean and its change , the standard deviation and its change , and the correlation coefficient (Correlation). The formula is defined as: ​

[0024] wherein the mean change indicates the embedding center shift, the standard deviation change reveals the network stability change, and the correlation coefficient reflects the embedding structure consistency between the two phases; S5.2: Based on the statistical index to distinguish abnormal mode, comparison (path embedding distance change) and (head and tail node embedding difference) two features before and after the performance of the event, the standard deviation change ( ) and correlation (Correlation) are calculated, and the threshold is set to determine the mode type; the self-healing mode distinguishing condition is that the standard deviation changes of the two features are less than the threshold and the correlation is greater than 0.5, reflecting the network topology recovery stability; the reconstruction mode distinguishing condition is that the standard deviation changes of the two features are greater than the threshold and the correlation is less than 0.5, reflecting the network connection relationship reconstruction.

[0025] The second aspect of the application relates to an abnormal mode recognition system based on AS semantic embedding.

[0026] The application collects the connection data between autonomous systems in the real Internet, constructs an AS relationship graph and extracts BGP update data features. Each node in the AS graph is embedded and coded to generate a unified node embedding representation, and the connection density between nodes and their relative position relationship in the topology hierarchy are captured through adjacent vector and hierarchical vector mapping. On this basis, the embedding model is optimized in combination with the proximity and hierarchical relationship, and the random gradient descent algorithm is used to adjust the network weight to improve the representation ability and generalization ability of the model. In order to further extract path difference features, two calculation methods of head and tail node embedding distance and path node overall embedding distance are proposed. Finally, the mean, standard deviation and correlation of the features are analyzed, and the threshold is set to identify abnormal mode, so as to effectively distinguish self-healing mode and reconstruction mode. The method can significantly improve the detection of autonomous system routing behavior abnormal mode.

[0027] The application includes five stages of data acquisition stage, feature extraction stage, embedding training stage, quantitative path difference stage and abnormal mode distinguishing analysis stage, and the specific process of each stage is described as follows.

[0028] In the data acquisition stage, the main steps are as follows. S1: Based on the connection data between different types of autonomous systems (AS) in the real Internet, an AS relationship graph is constructed, and different connection types such as point-to-point (P2P) and provider-to-customer (P2C) relationship types are distinguished. The update data is downloaded, detected, decompressed and cached in batches according to date, and the BGP update data of the day is extracted.

[0029] In the feature extraction stage, the main steps are as follows. S2: First, the embedding encoding of each node in the AS graph is performed to obtain a unified node embedding representation; then, the node embedding is converted into adjacent vectors and hierarchical vectors through two embedding mapping methods respectively to capture different dimensional graph structure information. Among them, the adjacent distance is calculated by weighting the Hadamard product of the embedding difference of the nodes and the adjacent vector weight, reflecting the connection tightness between the nodes, and the greater the value, the closer the nodes. The hierarchical distance is calculated by weighting the node difference through the learnable hierarchical vector, which is used to measure the relative position relationship of the nodes in the topological hierarchy. The two types of vectors capture the spatial proximity and topological hierarchy difference of the structure respectively, and the adjacent distance and hierarchical distance features are obtained through a learnable metric function.

[0030] In the embedding training stage, the main steps are as follows. S3: In the embedding training process, the model is optimized by combining the adjacent degree and hierarchical relationship distance functions to ensure that the model can stably maintain these two features at the same time. A comprehensive score is defined to balance the adjacent degree and hierarchical relationship. In the optimization, unobserved edges are randomly sampled and compared with observed edges, and a fully connected neural network is used for optimization. The network layer is composed of an embedding layer and two linear layers, the embedding layer generates the embedding vector of the AS node, and the linear layer maps the embedding vector to the adjacent and hierarchical relationship space. The objective function is optimized by the stochastic gradient descent (SGD) algorithm to adjust the network weights and improve the representation and generalization ability of the model.

[0031] In the model training and anomaly detection stage, the main steps are as follows. S4: The features of AS routing behavior are obtained from the above BGP routing update data and input into the trained embedding model, and two operable path difference calculation methods are proposed: head_tail_d (first and last node embedding distance feature) and path_d (node overall embedding distance). head_tail_d extracts the first node and the last node of each path to calculate the structural distance between their embedding vectors; while path_d calculates the embedding distance between each pair of adjacent AS nodes in the path in turn and accumulates the results. Both of these two features are calculated through node embedding vectors and combined with edge weights and direction information.

[0032] In the anomaly pattern discrimination analysis stage, the main steps are as follows. S5: Based on the data before and after the anomaly, the embedding model is trained, and the head_tail_d and path_d features are analyzed. The mean, mean change, standard deviation, standard deviation change and correlation of these two features are calculated, and a threshold is set to distinguish the anomaly pattern. When the standard deviation change is less than the threshold and the correlation is greater than 0.8, it is defined as a self-healing mode; when the standard deviation change is greater than the threshold and the correlation is less than 0.5, it is defined as a reconstruction mode.

[0033] Through the synergistic effect of the above stages, the application realizes efficient and accurate detection of abnormal behavior in time series. Compared with the traditional static model relying on single-point error or rule setting method, this method combines supergraph structure expression, time series reconstruction ability and dynamic threshold judgment strategy, improves the detection accuracy, enhances the robustness and generalization ability of the model, and is suitable for abnormal monitoring tasks in network security, BGP routing monitoring and other complex scenes.

[0034] In summary, the application is a BGP anomaly pattern recognition method based on AS semantic embedding. To solve the problems of lack of built-in identity authentication in BGP protocol and insufficient interpretability and operability of traditional detection methods, precise anomaly recognition is realized by deep analysis of inter-autonomous system connection data. The method first constructs an AS relationship graph containing P2P and P2C relationship types based on real Internet data, and updates the cache abnormal BGP data in batches according to date; then innovatively extracts two-dimensional features of proximity distance (spatial proximity) and hierarchical distance (topological hierarchical position), models combined with edge direction and type, and adjusts weights by optimizing embedding model and using SGD algorithm, to improve the representation and generalization ability of the model to AS network structure; then two path difference calculation methods of head_tail_d and path_d are proposed to quantify the structural difference of routing path; finally, through the analysis of multi-dimensional indexes and fluctuation changes of two types of features, the threshold is set to accurately distinguish self-healing mode and reconstruction mode, providing a solution with high accuracy and strong interpretability for network security.

[0035] The main innovation of the application is: (1) Breakthrough the limitation of traditional single-dimensional feature, innovatively introduce the proximity distance and hierarchical distance two-dimensional core feature. First, the AS graph nodes are embedded and coded to obtain a unified representation, and then transformed into proximity vector and hierarchical vector through two independent embedding mapping, respectively capturing the spatial connection tightness and topological hierarchical relative position between AS nodes. The proximity distance is calculated by Hadamard multiplication weighting of node embedding difference and proximity vector weight, and the hierarchical distance is obtained by weighting the node difference with the learnable hierarchical vector, and then the features are integrated by the learnable metric function to realize the comprehensive and accurate description of the AS graph structure information, solving the problem that traditional features cannot consider spatial relationship and hierarchical difference.

[0036] (2) In view of the difficulty in quantifying the structural differences of BGP routing paths, two operational path difference calculation schemes, head_tail_d and path_d, are proposed. head_tail_d focuses on the key nodes of the routing path, extracts the first and last node embedding vectors and calculates the structural distance, quickly capturing the core differences of the path. path_d covers the complete topology of the path, and the embedding distance is calculated for each pair of adjacent AS nodes and accumulated, fully reflecting the overall structural changes of the path. Both methods are based on the trained embedding model, combined with edge weights and direction information for calculation, realizing multi-dimensional and accurate quantification of the differences of BGP routing paths, and providing reliable quantitative basis for subsequent anomaly discrimination.

[0037] (3) Based on the embedding model trained by data before and after the anomaly, focusing on the head_tail_d and path_d features, through calculating multiple indicators such as mean, mean change, standard deviation, standard deviation change and correlation, setting a clear threshold (double condition of standard deviation change and correlation), the self-healing mode and reconstruction mode are accurately distinguished, and the anomaly discrimination has both quantitative basis and strong explanatory ability.

[0038] The advantages of the present application are: based on anomaly pattern recognition, innovative introduction of double-dimensional distance features and learnable metric design, targeted path difference quantification method, combined with multi-index threshold anomaly pattern discrimination mechanism, effectively capturing the topological structure features and routing path differences of AS network, realizing accurate identification of self-healing mode and reconstruction mode, and enhancing the explanatory ability and operability of anomaly pattern recognition. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1 is the model framework diagram of the present application.

[0040] Figure 2 is the three-dimensional visual diagram of the node embedding vector of the present application.

[0041] Figure 3 is the projection of the embedding vector of the present application in the YZ plane.

[0042] Figure 4 is the projection of the embedding vector of the present application in the XY plane.

[0043] Figure 5 is the method flow chart of the present application. DETAILED DESCRIPTION

[0044] The technical solutions of the present application will be specifically described below with reference to the drawings.

[0045] Example 1

[0046] The embodiment relates to a router optimization method applying an abnormal mode recognition method based on AS semantic embedding.

[0047] The application carries out abnormal mode recognition based on AS semantic embedding, in the specific implementation process, firstly, AS connection data under a real Internet environment is collected, an AS graph structure containing P2P and P2C relations is constructed, and BGP abnormal data is updated in batches every day. Then, in the feature extraction stage, the adjacent distance and the hierarchical distance are introduced, and the spatial and topological relations between AS nodes are modeled. In the embedding training process, the AS representation is extracted through the embedding layer and the linear layer, and the adjacent degree and the hierarchical relation are taken as the objective function, and the SGD algorithm is used for optimization. Subsequently, path features are extracted from the route update record, and the path evolution is quantified by using two structure difference calculation methods. And Finally, the classification recognition of different abnormal modes (such as self-healing type and reconstruction type) is realized by analyzing the fluctuation difference of the two features and setting a threshold. The overall process has high operability, can efficiently capture abnormal modes in route structure changes, and realizes accurate detection and explanation.

[0048] The technical scheme adopted by the application to achieve the above application purposes is as follows: The application carries out abnormal mode recognition based on AS semantic embedding, in the specific implementation process, firstly, AS connection data under a real Internet environment is collected, an AS graph structure containing P2P and P2C relations is constructed, and BGP abnormal data is updated in batches every day. Then, in the feature extraction stage, the adjacent distance and the hierarchical distance are introduced, and the spatial and topological relations between AS nodes are modeled. In the embedding training process, the AS representation is extracted through the embedding layer and the linear layer, and the adjacent degree and the hierarchical relation are taken as the objective function, and the SGD algorithm is used for optimization. Subsequently, path features are extracted from the route update record, and the path evolution is quantified by using two structure difference calculation methods. And Finally, the classification recognition of different abnormal modes (such as self-healing type and reconstruction type) is realized by analyzing the fluctuation difference of the two features and setting a threshold. The overall process has high operability, can efficiently capture abnormal modes in route structure changes, and realizes accurate detection and explanation.

[0049] The technical scheme adopted by the application to achieve the above application purposes is as follows: The router optimization method applying the abnormal mode recognition method based on AS semantic embedding of the application comprises the following steps: S1: constructing a relation graph based on real Internet AS connection data and distinguishing connection types. BGP update data is downloaded, decompressed and cached in batches according to date, abnormal updates are detected, and route features are extracted. S2: Construct an embedded model network; the structure of the embedded network is as follows: starting from the input layer, it is sequentially connected to the embedding mapping layer, the dual metric calculation module, the loss optimization layer, and the output layer.

[0050] The embedding mapping layer is used to map AS nodes to a d-dimensional vector space, and maps them to the neighborhood space and the hierarchy space through two linear layers respectively; the dual metric calculation module is used to calculate the neighborhood distance and hierarchy distance between nodes; the loss optimization layer is used to balance the two errors. This layer fuses the metrics through a comprehensive scoring mechanism and uses the SGD algorithm for comparative training; the output layer is used to output the node embedding vector and the weight vector. S3: Use AS relationship graph data to train the embedding model, integrate proximity and hierarchical relationship through a comprehensive scoring function, and use contrastive learning method to train node embedding vectors and weight vectors to capture the spatial proximity and hierarchical difference features of the AS network. S4: Input the AS routing behavior features into the trained embedding model and calculate the path difference features before and after the anomaly. head_tail_d calculates the structural distance between the embedding vectors of the first and last nodes; path_d accumulates the embedding distances of each pair of adjacent nodes in the path, combining edge weights and direction information; S5: Based on the head_tail_d and path_d features obtained from the input data before and after the anomaly, analyze their mean, mean change, standard deviation, standard deviation change, and correlation. Set thresholds for discrimination: small standard deviation change and high correlation indicate self-healing mode; large standard deviation change and low correlation indicate reconstruction mode.

[0051] S6: Based on the BGP routing anomaly model, it is applied to SDN router optimization and intelligent management. When a BGP update anomaly is detected, the system automatically determines the mode based on the standard deviation change and correlation. In self-healing mode, the SDN controller dynamically adjusts the network path or configuration to restore normal routing; in reconstruction mode, deep reconfiguration and network rebuilding are initiated.

[0052] In step S1: S1.1: Construct an AS graph using the AS relation dataset provided by CAIDA. Each record in the dataset contains a triple. ,in and This represents two different autonomous systems, and This represents the type of relationship between them. When When it's P2C, an additional line will be added to the AS diagram from... point to The directed edge; when When it's C2P, an additional entry will be added from... point to A directed edge. If To indicate a P2P relationship, the system will add [the following]. arrive and from arrive Bidirectional edges. Ensure that bidirectional connections between ASs can influence each other; S1.2: Obtain BGP update data and extract routing features based on the date. This process is divided into two stages: data collection and feature construction. In the data collection stage, BGP update filenames for the day are generated at 5-minute intervals. A list of download links is constructed by concatenating the address of a remote data source (such as RIPERIS). The system checks whether a .bz2 compressed file or the original .update file already exists locally. Missing files are downloaded using wget and decompressed into MRT format BGP update data using bzip2. In the feature construction stage, records with "A" in the A / W field are filtered, and the 7th column is extracted as the AS path. Each AS node in the path is input into the trained embedding model to construct structural features.

[0053] In step S2: S2.1: The embedding mapping layer maps AS nodes to a d-dimensional vector space by learning a low-dimensional embedding function. ( These are learnable parameters, and Map each AS node to The node embedding vector is represented by a dimensional vector; and the node embedding vector is mapped to the neighborhood space and the hierarchy space through two linear layers, respectively. S2.2: The dual-metric calculation module is used to calculate the proximity distance and hierarchical distance between nodes; Define nearest neighbor distance To measure the proximity and connectivity of AS nodes, consider directly connected vertex pairs. Pairs of vertices with no direct edges Through constraints Reflecting differences in proximity, the nearest neighbor distance is defined as:

[0054] in and Representing nodes respectively and Embedded vector, The learnable weight vector is used to adjust the contribution of different dimensions, and ⊙ is the Hadamard product, which is used to calculate the difference in node embedding vectors and weight the spatial positional relationship of nodes. Define hierarchical distance Used to quantify the relative position and hierarchical differences of AS nodes in a hierarchical structure, for directed edges. And the opposite edge Not here The vertex pairs in the array must satisfy the following conditions: (in To reflect hierarchical differences, undirected edges connect vertex pairs; for AS graph edge types, P2C edges (provider to customer) have positive and as large a distance as possible to distinguish upper and lower levels, while P2P edges (peer-to-peer) are bidirectionally symmetrical with a distance approaching zero; the hierarchical distance formula is defined as:

[0055] in and Representing nodes respectively and Embedded vector, The weight vectors are learnable and have the same dimension as the node embedding dimension. The difference in weighted node embedding vectors reflects the hierarchical spatial relationship.

[0056] S2.3: The loss optimization layer is used to balance the proximity error and the hierarchical error. This layer integrates the two metrics through a comprehensive scoring mechanism and uses the SGD algorithm for comparative training. The output layer is used to output the trained node embedding vector and weight vector.

[0057] In step S3: S3.1: The embedding model is trained using AS relation graph data, constructing neighbor vectors and hierarchical vectors to model the network structure from two dimensions. When constructing neighbor vectors, first-order proximity (1 for direct connections between nodes, 0 otherwise) and second-order proximity (measuring the structural similarity of neighbors by comparing the first-order proximity vector similarity of nodes using cosine similarity) are defined. In the embedding space, proximity relationships are modeled through vector differences. When constructing hierarchical vectors, the P2C (provider-customer) relationship in the AS network is modeled based on directed edges. Represents a node Higher level The topological partial order relation maps node embeddings to hierarchical vectors and quantifies the asymmetric hierarchical structure. S3.2: Define a comprehensive scoring function and optimize embedding training by combining proximity and hierarchical relationships. The comprehensive score is defined as:

[0058] in Indicates proximity. To indicate hierarchical relationships, through minus This allows embedding training to retain neighboring and hierarchical features; S3.3: Define a training optimization problem to broaden the difference between observed and unobserved edges and train node embeddings, neighbor vectors, and hierarchical vectors for observed edges. Non-observed edge ,satisfy The objective function is defined as:

[0059] Where E is the edge set of the AS graph. The function is the sigmoid function; it is solved using a fully connected neural network. The network consists of an embedding layer and two linear layers. The embedding layer is used to generate the embedding vectors of the AS nodes. Two linear layers map the embedding vectors to proximity. hierarchical relationship Subspace; during training, for each edge Randomly sample 10 pairs of unobserved edges Training samples are generated by generating node embedding vectors. and The objective function is then optimized using the SGD algorithm.

[0060] The trained and optimized model is used for 3D visualization to show the hierarchical structure and neighborhood distribution of AS nodes. The embedding vector of each node is decomposed into its projection along the hierarchical direction and its orthogonal residual, which are used to represent the Z-axis (hierarchical distance) and XY-axis (neighborhood distance), respectively. The residual part is visualized in two dimensions using the t-SNE method.

[0061] Specifically, to demonstrate the structural characteristics of the AS routing role, the node embedding vectors calculated by the trained model are visualized in three dimensions. This is because the model learns a unit vector representing the hierarchical descent direction. We will embed the vector of each AS node It is decomposed into two parts, which are in Projection in the direction, and in relation to The residuals in the orthogonal plane. The specific calculation is as follows:

[0062] in, This represents the node's position along the hierarchical direction, serving as the Z-axis in the three-dimensional coordinate system; while This indicates its relative position in the embedding space, without considering the influence of hierarchy. We... Using t-SNE for 2D dimensionality reduction, and taking the coordinates of the nodes on the X and Y axes, the final representation is as follows:

[0063] The above method effectively maps high-dimensional embedding vectors to a three-dimensional space, making the hierarchy... and proximity It can be displayed intuitively.

[0064] To verify whether the embedded vectors retained the actual AS routing role information, we selected three typical AS nodes: (1) 15 Tier-1 ASes (such as AT&T's AS7018, NTT's AS2914, etc.); (2) several important but non-Tier-1 Major ASes (such as Telstra's AS1221, KDDI's AS2516, etc.); and (3) 50 randomly selected Stub ASes (i.e., terminal ASes connected to only one provider). Two key planes were projected in the above three-dimensional space to show their distribution.

[0065] Figure 2 The diagram illustrates the distribution of AS node embedding vectors in 3D space, where each point corresponds to a unique AS, and the color distinguishes its level. As can be seen from the diagram, the top and bottom ASs exhibit a clear clustering phenomenon in space, indicating a high degree of proximity between them; in contrast, the ASs in the middle levels are more dispersed, showing a lower degree of proximity.

[0066] Figure 3 and Figure 4 The projections of the AS embedding vectors onto the YZ and XY planes are shown respectively. It can be observed that Tier-1 ASs cluster into a high-density cluster at the highest level, indicating their central position in the core network; some key but non-Tier-1 ASs form multiple clusters at relatively lower levels; while stub ASs are more dispersed, mainly located in the lower-level regions of the embedding space. These results demonstrate that the generated embedding vectors effectively preserve the spatial proximity and hierarchical structure features between ASs.

[0067] In step S4: S4.1: Quantify the structural differences of routing paths in routing roles, obtain path information based on the processed BGP update data, input each AS node in the path into the trained embedding model, and generate feature representations as inputs for subsequent difference feature calculations; S4.2: Based on the trained embedding model, two path difference features are designed to quantify path structure differences, and to analyze the path... ( Indicates the first (number of AS nodes), distance feature between first and last nodes Defined as:

[0068] in, This represents two nodes calculated by the embedded model. and The structural distance between them is specifically defined as:

[0069] in, and Represents a node and In the dimensional embedding vector components, It is the weight vector in the nearest neighbor distance. It is the weight vector in the hierarchical distance, used to model path direction information.

[0070] The second type of path difference characteristics The structural change between each pair of adjacent AS nodes on the path is measured and defined as:

[0071] Each of these terms still uses the aforementioned embedding distance formula. The calculation is performed, and the changing trend of the path structure is characterized by accumulating the embedding distance between adjacent nodes.

[0072] In step S5: S5.1: Analyze the structural changes of quantified features before and after the abnormal event. Train embedding models based on data before and after the abnormal event, and use the two models to quantify the abnormal period to obtain the quantified features before and after the abnormality. Read the CSV files of the embedding results for the two time periods and concatenate them into a complete data frame. and Two structural features; calculate statistics for both features in the forward and backward phases, including the mean ( ) and their changes ( ), standard deviation ( ) and their changes ( Correlation coefficient. The formula is defined as:

[0073] Among them, the change in mean indicates the shift of the embedding center, the change in standard deviation reveals the change in network stability, and the correlation coefficient reflects the consistency of the embedding structure before and after the stage. S5.2: Identify abnormal patterns based on statistical indicators and compare them. (Path embedding distance variation) and (Embedding differences between first and last nodes) The performance of the two features before and after the abnormal event, and the change in standard deviation ( The standard deviations of the two features are used to determine the pattern type, and a threshold is set to determine the pattern type. The self-healing pattern is determined when the standard deviations of the two features are both less than the threshold and the correlation is greater than 0.5, which reflects the network topology recovery and stability. The reconstruction pattern is determined when the standard deviations of the two features are both greater than the threshold and the correlation is less than 0.5, which reflects the reconstruction of network connection relationships.

[0074] The dataset used in this study analyzed three different types of BGP anomalies to explore their spatiotemporal evolution characteristics. These three datasets represent direct anomalies caused by the Malaysian Telecom incident; indirect anomalies caused by the Slammer worm attack; and anomalies caused by the Moscow Blackout incident.

[0075] Further quantitative analysis of the two key structural features head_tail_d and path_d was conducted using the three datasets mentioned above. The main statistical indicators of these features were calculated in the forward and backward embedding models to reveal the impact of abnormal events on the routing structure, as shown in Tables 1, 2 and 3.

[0076] Table 1. Eigenvalues ​​in the ex-ante and ex-post embedding spaces (Malaysian-Telecom)

[0077] Table 2. Eigenvalues ​​in the ex-ante and ex-post embedding spaces (Slammer)

[0078] Table 3. Eigenvalues ​​in the ex-ante and ex-post embedding spaces (Moscow-Blackout)

[0079] Based on the feature quantification results of three typical BGP anomalies—Malaysian-Telecom, Slammer, and Moscow-Blackout—in Tables 1–3, this paper identifies their evolution types as follows based on the standard deviation changes and correlations of two structural features: the path head-tail embedding difference (head_tail_d) and the path embedding distance (path_d), and by setting a pattern discrimination threshold: (1) Malaysian Telecom: Self-Healing Mode In the Malaysian-Telecom anomaly, the standard deviation changes of the two structural features (head_tail_d2 and path_d2) between the pre- and post-anomaly phases were both below the set thresholds (0.4 and 1.3), while their correlation coefficients were both above 0.5 (0.65 and 0.94, respectively). This indicates that the network embedding space maintained high consistency after the anomaly occurred, with no significant structural perturbations or rearrangements, demonstrating the system's good stability and self-healing capabilities. Therefore, this event was classified as a self-healing event.

[0080] (2) Slammer: Refactoring Pattern

[0081] In the Slammer anomaly, the standard deviation changes of two structural features (head_tail_d2 and path_d2) reached 1.05 and 1.46, respectively, both exceeding their corresponding discrimination thresholds. Simultaneously, their correlation coefficients were 0.34 and 0.46, significantly lower than 0.5, indicating a drastic change in the embedding space structure before and after the anomaly. This phenomenon reflects a systematic adjustment to the network topology or policy structure, with a comprehensive reconstruction of embedding relationships. Therefore, this anomaly evolution is identified as a reconstruction pattern.

[0082] (3) Moscow-Blackout: Refactoring Pattern

[0083] In the Iscor-Blackout anomaly, the standard deviation changes of the two structural features (head_tail_d2 and path_d2) were 0.91 and 2.14, respectively, far exceeding the corresponding thresholds. Their correlations were also below 0.5 (0.47 and 0.41, respectively), exhibiting a trend of drastic fluctuations in embedding features and decreased structural consistency. These changes suggest that the network may have formed new topological clustering or routing strategies after the anomaly, with a significant shift in the embedding structure. Therefore, this anomaly evolution was identified as a reconstruction pattern.

[0084] In summary, with the help of + The indicator discrimination mechanism of (standard deviation change and correlation) can quantitatively classify and categorize the evolution mechanisms of different BGP anomalies, which helps to deeply understand the adaptive response and topology reconstruction process of network anomalies.

[0085] Example 2

[0086] This embodiment relates to an anomaly pattern recognition system based on AS semantic embedding, comprising a data acquisition module, a network construction module, an embedding training module, a path difference calculation module, and an anomaly pattern discrimination module connected in sequence, for implementing the method of the present invention.

[0087] The data acquisition module constructs a relationship graph based on real Internet AS connection data, distinguishes between P2P (peer-to-peer) and P2C (provider-customer) connection types, downloads, decompresses and caches BGP update data in batches by date, detects abnormal updates, and extracts routing features. The embedding model module constructs an embedding model network, whose structure includes an embedding mapping layer, a dual-metric calculation module, a loss optimization layer, and an output layer. The embedding mapping layer maps AS nodes to a d-dimensional space and then maps them to the neighborhood space and the hierarchical space through two linear layers. The dual-metric calculation module calculates the proximity and hierarchical distance of nodes. The loss optimization layer fuses the two metrics and uses the SGD algorithm for comparative training. The output layer outputs the embedding vector and weight vector of each node. The embedding training module uses AS relation graph data to train the embedding model, integrates proximity and hierarchical relationship through a comprehensive scoring function, and uses a contrastive learning method to train and generate node embedding vectors and weight vectors. The quantification path difference module inputs the AS routing behavior features into the trained embedding model and calculates the path difference features before and after the anomaly. Calculate the embedding distance between the first and last nodes of the path. Accumulate the embedding distance of each pair of adjacent AS nodes in the path; The anomaly pattern discrimination and analysis module trains an embedding model based on data before and after the anomaly and analyzes it. and The mean, standard deviation, and their changes and correlations of features are used to set thresholds to identify abnormal patterns. Small changes in standard deviation and high correlations are identified as self-healing patterns, while large changes in standard deviation and low correlations are identified as reconstruction patterns.

[0088] The above embodiments of the present invention are merely illustrative examples and are not intended to limit the scope of the invention. The actual scope of protection should be defined by the appended claims. Any modifications, substitutions, or improvements made within the basic ideas and principles of the present invention should be considered as included within the scope of protection of the present invention.

Claims

1. An anomaly pattern recognition method based on AS semantic embedding, comprising the following steps: S1: Construct a relationship graph based on real Internet AS connection data to distinguish connection types; Batch download, decompress, and cache BGP update data by date; detect abnormal updates and extract routing features. S2: Construct an embedded model network; the structure of the embedded network is as follows: starting from the input layer, it is sequentially connected to the embedding mapping layer, the dual metric calculation module, the loss optimization layer, and the output layer; The embedded mapping layer is used to map AS nodes to a d-dimensional vector space, and maps them to the neighborhood space and the hierarchy space through two linear layers respectively. The dual-metric calculation module is used to calculate the proximity distance and hierarchical distance between nodes; the loss optimization layer is used to balance the two types of errors. This layer integrates the metrics through a comprehensive scoring mechanism and uses the SGD algorithm for comparative training; the output layer is used to output the node embedding vector and the weight vector. S3: Use AS relationship graph data to train the embedding model, integrate proximity and hierarchical relationship through a comprehensive scoring function, and use contrastive learning method to train node embedding vectors and weight vectors to capture the spatial proximity and hierarchical difference features of the AS network. S4: Input the AS routing behavior features into the trained embedding model and calculate the path difference features before and after the anomaly; head_tail_d calculates the structural distance between the embedding vectors of the first and last nodes; path_d accumulates the embedding distance of each pair of adjacent nodes in the path, and combines the edge weights and direction information. S5: Based on the head_tail_d and path_d features obtained from the input data before and after the anomaly, analyze their mean, mean change, standard deviation, standard deviation change, and correlation; set thresholds for discrimination: small standard deviation change and high correlation indicate self-healing mode; large standard deviation change and low correlation indicate reconstruction mode.

2. The anomaly pattern recognition method based on AS semantic embedding as described in claim 1, wherein step S1 specifically includes: S1.1: Construct an AS graph using the AS relation dataset provided by CAIDA; each record in the dataset contains a triple. ,in and This represents two different autonomous systems, and Represents the type of relationship between them; when When it's P2C, an additional line will be added to the AS diagram from... point to The directed edge; when When it's C2P, an additional entry will be added from... point to A directed edge; if To indicate a P2P relationship, the system will add [the following]. arrive and from arrive Bidirectional edges; ensuring that bidirectional connections between ASs can influence each other; S1.2: Obtain BGP update data and extract routing features based on the date. This is divided into two stages: data collection and feature construction. During the data collection stage, the BGP update file name for the day is generated at 5-minute intervals. The remote data source address (such as RIPE RIS) is concatenated to construct a list of download links. The system checks whether a .bz2 compressed file or a .update original file already exists locally. The missing file is downloaded using wget and decompressed into MRT format BGP update data using bzip2. In the feature construction stage, records with "A" in the A / W field are selected, and the 7th column is extracted as the AS path. Each AS node in the path is input into the trained embedding model to construct structural features.

3. The anomaly pattern recognition method based on AS semantic embedding as described in claim 1, wherein step S2 specifically includes: S2.1: The embedding mapping layer maps AS nodes to a d-dimensional vector space by learning a low-dimensional embedding function. ( are learnable parameters, and Map each AS node to The node embedding vector is represented by a dimensional vector; and the node embedding vector is mapped to the neighborhood space and the hierarchy space through two linear layers, respectively. S2.2: The dual-metric calculation module is used to calculate the proximity distance and hierarchical distance between nodes; Define nearest neighbor distance To measure the proximity and connectivity of AS nodes, consider directly connected vertex pairs. Pairs of vertices with no direct edges Through constraints Reflecting differences in proximity, the nearest neighbor distance is defined as: in and Representing nodes respectively and Embedded vector, The learnable weight vector is used to adjust the contribution of different dimensions, and ⊙ is the Hadamard product, which is used to calculate the difference in node embedding vectors and weight the spatial positional relationship of nodes. Define hierarchical distance Used to quantify the relative position and hierarchical differences of AS nodes in a hierarchical structure, for directed edges. And the opposite edge Not here The vertex pairs in the array must satisfy the following conditions: To reflect the differences in levels, among which Undirected edges connect vertex pairs; for AS graph edge types, P2C edges (provider to customer) are designed with positive and as large a distance as possible to distinguish upper and lower levels, while P2P edges (peer-to-peer) are bidirectionally symmetric with a distance approaching zero; the level distance formula is defined as: in and Representing nodes respectively and Embedded vector, The weight vectors are learnable and have the same dimension as the node embeddings. The difference in weighted node embeddings reflects the hierarchical spatial relationship. S2.3: The loss optimization layer is used to balance the proximity error and the hierarchical error. This layer integrates the two metrics through a comprehensive scoring mechanism and uses the SGD algorithm for comparative training. The output layer is used to output the trained node embedding vector and weight vector.

4. The anomaly pattern recognition method based on AS semantic embedding as described in claim 1, wherein step S3 specifically includes: S3.1: The embedding model is trained using AS relation graph data, constructing neighbor vectors and hierarchical vectors to model the network structure from two dimensions. When constructing neighbor vectors, first-order proximity (1 for direct connections between nodes, 0 otherwise) and second-order proximity (measuring the structural similarity of neighbors by comparing the first-order proximity vector similarity of nodes using cosine similarity) are defined. In the embedding space, proximity relationships are modeled through vector differences. When constructing hierarchical vectors, the P2C (provider-customer) relationship in the AS network is modeled based on directed edges. Represents a node Higher level The topological partial order relation maps node embeddings to hierarchical vectors and quantifies the asymmetric hierarchical structure. S3.2: Define a comprehensive scoring function and optimize embedding training by combining proximity and hierarchical relationships. The comprehensive score is defined as: in Indicates proximity. To indicate hierarchical relationships, through minus This allows embedding training to retain neighboring and hierarchical features; S3.3: Define a training optimization problem to broaden the difference between observed and unobserved edges and train node embeddings, neighbor vectors, and hierarchical vectors for observed edges. Non-observed edge ,satisfy The objective function is defined as: Where E is the edge set of the AS graph. The function is the sigmoid function; it is solved using a fully connected neural network. The network consists of an embedding layer and two linear layers. The embedding layer is used to generate the embedding vectors of the AS nodes. Two linear layers map the embedding vectors to proximity. hierarchical relationship Subspace; during training, for each edge Randomly sample 10 pairs of unobserved edges Training samples are generated by producing node embedding vectors. and The objective function is then optimized using the SGD algorithm.

5. The anomaly pattern recognition method based on AS semantic embedding as described in claim 1, wherein step S4 specifically includes: S4.1: Quantify the structural differences of routing paths in routing roles, obtain path information based on the processed BGP update data, input each AS node in the path into the trained embedding model, and generate feature representations as inputs for subsequent difference feature calculations; S4.2: Based on the trained embedding model, two path difference features are designed to quantify path structure differences, and to analyze the path... ( Indicates the first (number of AS nodes), distance feature between first and last nodes Defined as: in, This represents two nodes calculated by the embedded model. and The structural distance between them is specifically defined as: in, and Represents a node and In the dimensional embedding vector components, It is the weight vector in the nearest neighbor distance. It is the weight vector in the hierarchical distance, used to model path direction information; The second type of path difference characteristics The structural change between each pair of adjacent AS nodes on the path is measured and defined as: Each of these terms still uses the aforementioned embedding distance formula. The calculation is performed, and the changing trend of the path structure is characterized by accumulating the embedding distance between adjacent nodes.

6. The anomaly pattern recognition method based on AS semantic embedding as described in claim 1, wherein step S5 specifically includes: S5.1: Analyze the structural changes of quantitative features before and after the abnormal event, train embedding models based on data before and after the abnormal event, and use the two models to quantify the abnormal period to obtain the quantitative features before and after the abnormal event. Read the embedded CSV files from two time periods and concatenate them into a complete data frame. and Two structural features; Calculate statistics, including the mean, for the two features in the forward and backward phases before and after the anomaly. and its change Standard deviation and its change The correlation coefficient, or Correlation, is defined by the formula: Among them, the change in mean indicates the shift of the embedding center, the change in standard deviation reveals the change in network stability, and the correlation coefficient reflects the consistency of the embedding structure before and after the stage. S5.2: Identify abnormal patterns based on statistical indicators and compare changes in path embedding distance. Differences between embedding the first and last nodes The performance of the two features before and after the anomalous event is analyzed, and the change in standard deviation is calculated. Correlation is used to determine the mode type by setting a threshold. The self-healing mode is determined when the standard deviation of both features is less than the threshold and the correlation is greater than 0.5, reflecting the network topology recovery and stability. The reconstruction mode is determined when the standard deviation of both features exceeds the threshold and the correlation is less than 0.5, reflecting the reconstruction of network connectivity.

7. An abnormal pattern recognition method based on AS semantic embedding as described in claim 1, comprising a data acquisition module, a network construction module, an embedding training module, a path difference calculation module, and an abnormal pattern discrimination module performed sequentially; The data acquisition module constructs a relationship graph based on real Internet AS connection data, distinguishes between peer-to-peer (P2P) and provider-customer (P2C) connection types, downloads, decompresses, and caches BGP update data in batches by date, detects abnormal updates, and extracts routing features. The embedding model module constructs an embedding model network, which includes an embedding mapping layer, a dual-metric calculation module, a loss optimization layer, and an output layer. The embedding mapping layer maps AS nodes to a d-dimensional space and maps them to a neighbor space and a hierarchical space through two linear layers. The dual-metric calculation module calculates the proximity and hierarchical distance of nodes. The loss optimization layer integrates the two metrics and uses the SGD algorithm for comparative training. The output layer outputs the embedding vector and weight vector of the nodes. The embedding training module uses AS relation graph data to train the embedding model, integrates proximity and hierarchical relationship through a comprehensive scoring function, and uses a contrastive learning method to train and generate node embedding vectors and weight vectors. The quantification path difference module inputs the AS routing behavior features into the trained embedding model and calculates the path difference features before and after the anomaly. Calculate the embedding distance between the first and last nodes of the path. Accumulate the embedding distance of each pair of adjacent AS nodes in the path; The anomaly pattern discrimination and analysis module trains an embedding model based on data before and after the anomaly and analyzes it. and The mean, standard deviation, and their changes and correlations of features are used to set thresholds to identify abnormal patterns. Small changes in standard deviation and high correlations are identified as self-healing patterns, while large changes in standard deviation and low correlations are identified as reconstruction patterns.

Images