Multi-convergent-point detection method and device for hidden hijacking of inter-domain routing

Abstract

The invention discloses a multi-convergent-point detection method and device for hidden hijacking of inter-domain routing, and belongs to the technical field of the Internet. The method comprises the following steps of: hierarchically storing routing table data of a plurality of rendezvous points in a prefix tree structure by constructing a unified routing index; comparing routing entries of different rendezvous points based on the index, and identifying routing conflict instances satisfying prefix association, path difference and source difference; and judging and outputting the hidden hijacking instance from the conflict instance by verifying the authorization state, the path accessibility and the intermediate node overlapping relationship. According to the method, efficient and accurate detection of the inter-domain routing hidden hijacking behavior is realized, and the security and reliability of an internet routing system are improved.

Description

Technical Field

[0001] This invention relates to the field of Internet technology, and in particular to a method, apparatus, device, and storage medium for detecting multi-convergence point hijacking of inter-domain routing. Background Technology

[0002] Border Gateway Protocol (BGP) is a key protocol for exchanging routing information and establishing inter-domain routing paths between Autonomous Systems (AS) on the Internet. Since its establishment in standard documents such as RFC 4271, BGP has become the de facto standard for inter-domain routing on the Internet. Its core function is to enable each AS to advertise its owned or reachable IP address prefixes to neighboring ASes, thereby achieving global interconnection. After receiving a route advertisement from a neighboring AS, each AS updates its Routing Information Base (RIB) according to its local policies and BGP routing rules, and selects the optimal path for forwarding. This path selection typically depends on several factors, such as path length (AS_PATH), local priority (LOCAL_PREF), and next-hop reachability (NEXT_HOP).

[0003] Despite its crucial role in internet architecture, BGP's protocol design lacks robust security mechanisms, leaving it vulnerable to various security threats. One of the most typical problems is BGP prefix hijacking, where an AS (Application Server) misconfigures or acts maliciously to falsely advertise IP prefixes or subprefixes it doesn't possess. This causes some ASs globally to receive incorrect routes, leading to traffic destined for legitimate destinations being misdirected to attackers. Such attacks not only render victim services unreachable but can also trigger traffic interception, man-in-the-middle attacks, and other serious consequences, severely impacting internet security and stability. To address these threats, the industry has proposed various mechanisms to enhance BGP security. Among these, Resource Public Key Infrastructure (RPKI) and the RPKI-based Route Origin Validation (ROV) mechanism have received extensive research and standardization. RPKI binds IP prefixes to their legitimate AS numbers by publishing cryptographically signed Route Origin Authorization (ROA) records. ASs deploying ROV can verify the legitimacy of received route advertisements based on the ROA information, thus filtering out unauthorized routes. This mechanism can theoretically effectively prevent hijacking by unauthorized prefixes.

[0004] However, the deployment of RPKI and ROV on the current Internet is still insufficient, especially the limited scope of ROV deployment. As of March 2025, approximately 57.1% of IPv4 prefixes globally have ROA record coverage, but the actual number of ROV deployments remains limited, with only a few hundred to a few thousand ASs implementing this verification mechanism. Furthermore, the difficulty in accurately observing the deployment status externally further impacts the overall effectiveness of the RPKI / ROV system. In this partially deployed environment, attackers can exploit the fact that some ASs have not deployed ROV to launch a more covert prefix hijacking attack, namely stealthy hijacking. The key characteristic of stealthy hijacking is that because the deployment of ROV in some ASs restricts the propagation of malicious prefix announcements, some ASs will not receive malicious prefix announcements on the control plane, but their actual traffic may still pass through ASs that have not deployed ROV but have adopted malicious prefix announcements, thus being incorrectly forwarded to the attacker. Since the victimized AS does not receive malicious prefix announcements on the control plane, it is difficult to trigger alarms. This type of attack is highly covert, and existing control plane-based detection and protection mechanisms are difficult to detect.

[0005] Current research and defense against covert hijacking are still in the early stages of exploration. Most existing methods focus on post-incident mitigation strategies, lacking a general and systematic online detection mechanism. Therefore, there is an urgent need to design a detection method that can proactively discover conflicts in BGP routing behavior observed by different ASs from a multi-convergence point perspective, thereby identifying potential covert hijacking behaviors. Such a method is expected to compensate for the shortcomings of existing mechanisms in covert hijacking detection and improve the overall level of BGP security protection. Summary of the Invention

[0006] The present invention aims to at least partially solve one of the technical problems in the related art.

[0007] To address this issue, this invention discloses a multi-convergence point detection method for covert hijacking of inter-domain routes. By constructing a unified routing index structure, it integrates and stores routing table data from multiple convergence points. Based on this index, it compares routing entries from different convergence points to identify routing instances with path-source conflicts. Furthermore, by verifying route authorization status, path reachability, and node associations, it determines covert hijacking behavior from the conflict instances. This method effectively detects covert hijacking of inter-domain routes, improving the security of the routing system.

[0008] Another objective of this invention is to provide a multi-convergence point detection device for inter-domain route covert hijacking.

[0009] The third objective of this invention is to provide a computer device.

[0010] The fourth objective of this invention is to provide a non-transitory computer-readable storage medium.

[0011] To achieve the above objectives, this invention proposes a multi-convergence point detection method for inter-domain route covert hijacking, comprising: A unified routing index is constructed by parsing the routing table data of multiple aggregation points and storing the IP prefix, AS path and source aggregation point information in a hierarchical manner using a prefix tree data structure, forming a routing index structure that includes prefix nodes, AS path sets and source aggregation point sets. To identify routing conflict instances, the system traverses the routing entries of each aggregation point based on the unified routing index. By comparing the routing records of different source aggregation points, it detects routing conflict pairs that satisfy prefix association, AS path source AS difference, and source aggregation point difference, and generates a set of routing conflict instances. To detect covert hijacking instances, based on the conflict pairs in the set of route conflict instances, the system verifies the differences in ROA authorized status, the lack of route reachability at the conflict convergence point, and the overlap between intermediate nodes of the AS path and the conflict convergence point to determine whether covert hijacking behavior exists. Conflict pairs that meet the determination criteria are then added to the set of covert hijacking instances.

[0012] The multi-convergence point detection method for inter-domain route covert hijacking according to an embodiment of the present invention may also have the following additional technical features: In one embodiment of the present invention, constructing a unified routing index includes: Each node of the prefix tree contains the following data fields: IP prefix, AS path set, and source aggregation point set; where the IP prefix is ​​used to identify the routing entry, the AS path set stores all AS path information that advertises the corresponding prefix, and the source aggregation point set records the aggregation point identifier that provides the corresponding routing information. When inserting a route record into the Trie tree, if the Trie node corresponding to the current IP prefix does not yet exist, a new node is created dynamically, and the AS path and source aggregation point of the route are added to the AS path set and source aggregation point set of the new node, respectively. If the node already exists, only its AS path set and source aggregation point set are updated.

[0013] In one embodiment of the present invention, identifying routing conflict instances includes: The formation of the candidate parent node set involves: starting from the root node of the Trie tree, matching the binary bits of the IP prefix bit by bit, recording all intermediate nodes containing valid routing records, and adding the finally matched node to the candidate parent node set to support conflict detection in parent-child prefix relationships.

[0014] In one embodiment of the present invention, detecting instances of covert hijacking includes: The criteria for determining ROA authorization status conflicts include: Matching ROA records and The length does not exceed the maximum length limit of the ROA, and Match with the legitimate source AS recorded in the ROA, and at the same time The matched ROA records contain multiple records whose length exceeds the maximum length limit. The source AS does not match the legitimate source recorded in the ROA.

[0015] In one embodiment of the present invention, identifying routing conflict instances further includes: Extract key information for the current route entry, including: extract the IP prefix, AS path, and source aggregation point information of the route entry being traversed.

[0016] In one embodiment of the present invention, detecting instances of covert hijacking further includes: Representing and resolving conflicting route pairs includes: representing the conflicting pairs in the set of route conflicting instances as p1:V1...(M1)...O1 and p2:V2...(M2)...O2; where p1 and p2 are the two conflicting IP prefixes, V1 and V2 are the corresponding source aggregation points, O1 and O2 are the corresponding source ASs, and M1 and M2 represent intermediate AS nodes existing in the AS path.

[0017] In one embodiment of the present invention, the method further includes: Routing table data is obtained from BGP data collectors in multiple geographic regions, including route-views2, wide, and amsix collection points published by RouteViews, to ensure that the routing index covers the routing announcement behavior of different regions.

[0018] To achieve the above objectives, another aspect of the present invention provides a multi-convergence point detection device for inter-domain route covert hijacking, comprising: The routing index building module is used to build a unified routing index. By parsing the routing table data of multiple aggregation points, it stores the IP prefix, AS path and source aggregation point information in a hierarchical manner using a prefix tree data structure, forming a routing index structure that includes prefix nodes, AS path sets and source aggregation point sets. The routing conflict identification module is used to identify routing conflict instances. Based on the unified routing index, it traverses the routing entries of each aggregation point, and by comparing the routing records of different source aggregation points, it detects routing conflict pairs that satisfy prefix association, AS path source AS difference, and source aggregation point difference, and generates a set of routing conflict instances. The covert hijacking detection module is used to detect covert hijacking instances. Based on the conflict pairs in the route conflict instance set, it verifies the differences in ROA authorized status, the lack of route reachability of the conflict aggregation point, and the overlap between the intermediate nodes of the AS path and the conflict aggregation point to determine whether covert hijacking behavior exists, and adds the conflict pairs that meet the judgment conditions to the covert hijacking instance set.

[0019] This invention discloses a multi-convergence point detection method and apparatus for inter-domain route covert hijacking, effectively addressing the core shortcomings of traditional detection methods, such as limited scope and difficulty in detecting cross-regional covert hijacking behavior. By constructing a unified routing index structure and integrating multi-source data, it achieves automated identification and correlation analysis of complex routing conflict instances. Utilizing a multi-dimensional verification mechanism, it accurately determines covert hijacking, significantly improving the detection coverage and accuracy, and enhancing the overall security and proactive defense capabilities of internet routing infrastructure.

[0020] To achieve the above objectives, a third aspect of this application provides a computer device, including a processor and a memory; wherein the processor runs a program corresponding to the executable program code by reading executable program code stored in the memory, for implementing a multi-convergence point detection method for inter-domain route covert hijacking as described in the first aspect embodiment.

[0021] To achieve the above objectives, a fourth aspect of this application provides a non-transitory computer-readable storage medium storing a computer program that, when executed by a processor, implements a multi-convergence point detection method for inter-domain route covert hijacking as described in the first aspect embodiment.

[0022] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0023] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 This is a flowchart of a multi-convergence point detection method for covert hijacking of inter-domain routes according to an embodiment of the present invention; Figure 2 This is a flowchart illustrating the specific steps of a multi-convergence point detection method for covert hijacking of inter-domain routes according to an embodiment of the present invention. Figure 3 This is a model architecture diagram of a multi-convergence point detection system for covert hijacking of inter-domain routes according to an embodiment of the present invention; Figure 4 This is a schematic diagram of a multi-convergence point detection device for inter-domain route covert hijacking according to an embodiment of the present invention; Figure 5 It is a computer device according to an embodiment of the present invention. Detailed Implementation

[0024] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0025] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0026] The following description, with reference to the accompanying drawings, describes a method, apparatus, device, and storage medium for detecting multi-convergence point hijacking of inter-domain routes according to an embodiment of the present invention.

[0027] The core idea of ​​this invention is to construct a unified index and correlation analysis system that integrates multi-source routing data, efficiently integrating and structurally storing routing announcement information from different geographical regions and network aggregation points, thereby achieving full-domain awareness and deep correlation of inter-domain routing status. Based on this unified index, the system can automatically traverse and compare routing entries from different aggregation points, identifying potential routing conflict instances with prefix correlation, path source AS differences, and source point differences. Furthermore, by introducing a multi-dimensional verification mechanism—including verification of routing authorization status, analysis of the reachability of conflicting paths, and determination of the overlap between intermediate nodes of AS paths and conflicting aggregation points—the system can accurately filter and confirm covert hijacking behavior from a large number of routing conflicts. This method transforms traditional single-perspective, passive routing security monitoring into an active defense system based on multi-aggregate point data fusion, supporting automated correlation analysis and intelligent judgment, thereby significantly improving the detection coverage and judgment accuracy of complex covert hijacking behavior, and enhancing the overall security and reliability of the Internet routing system.

[0028] Example 1 To achieve the above invention, embodiments of the present invention provide a multi-convergence point detection method for inter-domain route covert hijacking, such as... Figure 1 As shown, it includes: A unified routing index is constructed by parsing the routing table data of multiple aggregation points. The IP prefix, AS path and source aggregation point information are stored hierarchically in a prefix tree data structure, forming a routing index structure that includes prefix nodes, AS path sets and source aggregation point sets.

[0029] Specifically, this step first initializes an empty Trie tree structure with an empty root node, and then expands the nodes layer by layer according to the binary representation of the IP prefix. Each Trie node contains three key data fields: IP prefix information, AS path set (AS_PATH Set), and Origin Collector Set. The AS path set stores all AS paths that advertise the prefix, while the Origin Collector Set records multiple BGP monitoring points (such as RouteViews collectors) that provide this routing information.

[0030] Specifically, the system sequentially traverses the complete BGP routing table of each aggregation point, parsing each route record to extract its IP prefix, AS path, and source aggregation point information. Then, the system inserts the prefix into the Trie tree layer by layer according to its binary representation. If a corresponding node does not yet exist for the current path, a new node is dynamically created; if it already exists, the AS path of the current route is added to the AS path set of that node, and the source collector for that route is added to the source aggregation point set. This process follows the longest prefix matching principle, ensuring that each prefix has a unique path representation in the Trie tree.

[0031] Furthermore, IP prefixes are typically represented in IPv4 or IPv6 format, with lengths ranging from 0–32 bits and 0–128 bits, respectively. Each path in the AS path set generally has a length not exceeding 20 AS nodes (according to RFC 4271 recommendation), while the source aggregation point set can contain multiple collector identifiers, such as `route-views2`, `amsix`, `wide`, etc. The Trie tree construction needs to support high-concurrency insertion and query operations to accommodate the processing requirements of approximately 50 million routing records per day.

[0032] Specifically, this step is mainly used for the fusion and indexing of routing data from multiple aggregation points in practical applications, and is suitable for large-scale BGP routing monitoring systems. Through unified modeling, the system can break through the limitations of the traditional single-point perspective, improve the global observation capability of route declaration consistency, and provide a structured data foundation for subsequent route conflict identification and covert hijacking detection.

[0033] Specifically, this unified routing index structure significantly improves the storage efficiency and query performance of routing data, especially when dealing with prefixes with parent-child relationships, enabling the rapid location of all routing records that may cover that prefix. Simultaneously, by maintaining a set of AS paths and source aggregation points in the Trie nodes, the system can accurately identify differences in routing information between different aggregation points, providing crucial evidence for the detection of covert hijacking.

[0034] Furthermore, the construction of the unified routing index involves parsing routing table data from multiple aggregation points and storing IP prefixes, AS paths, and source aggregation point information hierarchically using a prefix tree data structure. This results in a routing index structure containing prefix nodes, AS path sets, and source aggregation point sets, including: Each node of the prefix tree contains the following data fields: IP prefix, AS path set, and source aggregation point set; where the IP prefix is ​​used to identify the routing entry, the AS path set stores all AS path information that advertises the corresponding prefix, and the source aggregation point set records the aggregation point identifier that provides the corresponding routing information.

[0035] Specifically, the technical implementation of this step is based on a trie structure, which is used to efficiently organize and index BGP routing information from multiple aggregation points, thereby providing structured data support for subsequent routing conflict and covert hijacking detection.

[0036] Specifically, each Trie node stores an IP prefix field to identify the routing entry it represents. This prefix is ​​typically in CIDR notation (e.g., 192.0.2.0 / 24) and is matched bit-by-bit in binary form to support prefix parent-child relationship identification. The AS path set field stores information about all Autonomous System paths that advertise this prefix. Each path is an ordered sequence of AS numbers, for example... Where AS1 is the source AS and ASn is the AS where the aggregation point is located. The source aggregation point set field is used to record the identifiers of multiple aggregation points that provide this routing information, such as the collector number of RouteViews or the BGP session point identifier of the operator, to ensure that each routing information can be traced back to its source.

[0037] Furthermore, the design of this structure follows the standard field definitions of BGP route entries (RFC 4271) and incorporates ROA data for auxiliary analysis of route authorization status. During the construction of the Trie tree, the system employs the longest prefix matching principle to ensure that each IP prefix has a unique path within the tree. Multiple AS paths and source aggregation points are stored using a set structure (such as a hash table or ordered list) to support concurrent multi-path queries and conflict identification.

[0038] Specifically, by unifying the indexing of routing information from multiple aggregation points, the limitations of traditional single-point analysis are overcome, enhancing the global observation capability of route declaration consistency. Simultaneously, the structured organization of the Trie tree significantly improves route query efficiency, making it particularly suitable for real-time processing and analysis of large-scale BGP data, providing a solid data foundation for covert hijacking detection.

[0039] When inserting a route record into the Trie tree, if the Trie node corresponding to the current IP prefix does not yet exist, a new node is created dynamically, and the AS path and source aggregation point of the route are added to the AS path set and source aggregation point set of the new node, respectively. If the node already exists, only its AS path set and source aggregation point set are updated.

[0040] Specifically, the core of this step lies in building a structured, queryable routing information index to support subsequent detection of routing conflicts and covert hijacking. Specifically, the system first performs binary parsing of the IP prefix of the current routing record, matching path nodes in the Trie tree bit by bit. If a node at a certain level is found not to have been created during the matching process, the system will dynamically generate that node and add it to the Trie tree structure to ensure that all routing prefixes can be fully indexed. The creation of new nodes follows the hierarchical structure of IP prefixes. For example, for the IPv4 address `192.168.1.0 / 24`, the system will sequentially match `192`, `192.168`, `192.168.1`, and `192.168.1.0 / 24`, creating or locating the corresponding node in each step.

[0041] Furthermore, after a node is created or located, the system adds the AS path (AS_PATH) and source collector (Origin Collector) recorded in the current route record to the node's AS path set and source collector set, respectively. The AS path set stores information about all AS paths that declare the prefix, while the source collector set records observations of the prefix at different collectors. In the implementation, the set structure typically uses a `set` or `multiset` to avoid duplicate records and support efficient member query operations.

[0042] Specifically, this step requires consideration of the granularity differences in IP prefixes in its technical implementation. For example, the ` / 24` and ` / 25` prefixes have different path depths in the Trie tree. The system uses a bit-by-bit matching mechanism to ensure that the hierarchical relationship of the prefixes is accurately reflected in the tree structure. Furthermore, to improve query efficiency, Trie tree nodes typically use hash tables or dictionary structures for fast child node lookups, with a time complexity of O(log n). ,in The length of the IP prefix (in bits).

[0043] Specifically, this step operates in a large-scale BGP routing data processing environment, processing approximately 50 million routing records daily, covering over 370 aggregation points globally. By dynamically constructing Trie trees, the system can efficiently integrate routing information from multiple aggregation points, providing a unified data foundation for subsequent routing conflict identification. The technical value of this step lies in improving the global visibility and analyzability of routing data through structured storage of routing information, providing crucial support for detecting covert hijacking activities.

[0044] To identify routing conflict instances, the system traverses the routing entries of each aggregation point based on the unified routing index. By comparing the routing records of different source aggregation points, it detects routing conflict pairs that satisfy prefix association, AS path source AS difference, and source aggregation point difference, and generates a set of routing conflict instances.

[0045] Specifically, the core of this step lies in leveraging the efficient organization capabilities of the prefix Trie tree to compare the routing tables of multiple aggregation points, thereby discovering inconsistencies in routing information in terms of source and path, and providing structured input for subsequent covert hijacking detection.

[0046] Specifically, the system first initializes an empty set of route conflict instances, `ConflictSet`, to store all detected conflicting route pairs. Then, the system traverses the complete routing table of each aggregation point, extracting key fields from each route record, including the IP prefix, AS path (AS_PATH), and origin collector. For each route record, the system searches the unified routing index (Trie tree) built in step 1 using the IP prefix as the key. The search process starts from the root node of the Trie tree, matching the binary representation of the IP prefix bit by bit, recording all intermediate nodes containing valid routing information, forming a set of candidate parent nodes. These nodes include the exact matching node of the current prefix and its parent node, i.e., the overlay node of the shorter prefix, thus supporting the identification of parent-child prefix relationships.

[0047] Furthermore, the system focuses on the following three dimensions during the comparison process: 1. Prefix correlation: The current route prefix has a parent-child relationship with other route prefixes in the Trie tree (i.e., prefix coverage); 2. AS path source AS difference: The source AS of the current route record (i.e., the starting AS in AS_PATH) is inconsistent with the source AS of other records in the Trie tree; 3. Source convergence point difference: The source convergence point of the current route record is different from the source convergence point of other records in the Trie tree. If all three conditions are met simultaneously, the system determines that a route conflict exists and combines the current route entry with the conflict record into a conflict instance, adding it to `ConflictSet`.

[0048] Specifically, this step is suitable for online analysis environments with large-scale BGP routing data, such as routing snapshot processing based on BGP data collectors like RouteViews and RIPE RIS. The system processes approximately 50 million routing records daily, covering over 370 aggregation points globally, ensuring comprehensive and real-time routing conflict detection. In practical deployments, this step can serve as an intermediate step in a routing anomaly detection pipeline, providing a high-quality candidate conflict set for covert hijacking identification.

[0049] Specifically, this step effectively identifies routing inconsistencies across convergence points through a structured comparison mechanism, overcoming the limitations of traditional single-point analysis. Its Trie tree-based path matching strategy not only improves route lookup efficiency but also enhances the ability to identify prefix coverage relationships. In actual testing, this step provided numerous valid conflict instances for the subsequent covert hijacking detection module, significantly improving the system's accuracy and coverage in identifying covert hijacking behavior, making it a key technical step in achieving secure inter-domain routing detection.

[0050] Furthermore, the identification of routing conflict instances involves traversing the routing entries of each aggregation point based on the unified routing index, comparing routing records from different source aggregation points, detecting routing conflict pairs that satisfy prefix association, AS path source AS difference, and source aggregation point difference, and generating a set of routing conflict instances, including: The formation of the candidate parent node set involves: starting from the root node of the Trie tree, matching the binary bits of the IP prefix bit by bit, recording all intermediate nodes containing valid routing records, and adding the finally matched node to the candidate parent node set to support conflict detection in parent-child prefix relationships.

[0051] Specifically, in some implementations, the candidate parent node set is formed by performing a bit-by-bit matching operation in a uniformly constructed prefix Trie tree. Specifically, this process uses the IP prefix of the current route entry as the key, starting from the root node of the Trie tree and matching downwards bit by bit until a Trie node that completely matches the prefix is ​​found. During the matching process, the system records all intermediate nodes containing valid route records; these nodes typically correspond to the shorter prefix of the current prefix (i.e., the parent prefix), thus forming the candidate parent node set. This set includes not only the finally matched complete prefix node but also all parent nodes along its path, used to support route conflict detection under parent-child prefix relationships.

[0052] Furthermore, the matching process employs a bit-by-bit comparison method. Each Trie node represents a specific bit (0 or 1) of a prefix, and the path is traversed recursively or iteratively. In each matching step, if a matching path exists between the current bit and a child node of a node in the Trie tree, the process continues downwards; otherwise, the matching terminates. Along the matching path, the system checks whether each node contains a valid routing record, i.e., whether its AS path set and source / convergence point set are not empty. If a valid record exists, the node is added to the candidate parent node set.

[0053] Optionally, the Trie tree structure used in this step supports prefix compression (such as Patricia Trie) to reduce storage overhead and improve query efficiency. In practical applications, this step typically runs in large-scale BGP routing data processing systems, handling tens of millions of routing entries, with each prefix typically ranging from 8 to 32 bits (IPv4) or 128 bits (IPv6). By constructing a set of candidate parent nodes, the system can identify differences in the paths advertised by the same prefix at different aggregation points, providing a structured data foundation for subsequent routing conflict and covert hijacking detection. This step plays a crucial role in the overall detection process, and its accuracy directly affects the efficiency of subsequent conflict instance identification and the reliability of covert hijacking determination.

[0054] To detect covert hijacking instances, based on the conflict pairs in the set of route conflict instances, the system verifies the differences in ROA authorized status, the lack of route reachability at the conflict convergence point, and the overlap between intermediate nodes of the AS path and the conflict convergence point to determine whether covert hijacking behavior exists. Conflict pairs that meet the determination criteria are then added to the set of covert hijacking instances.

[0055] Specifically, the technical implementation of this step is based on a comprehensive analysis of the ROA authorization status, the lack of route reachability, and the overlap between intermediate nodes of the AS path and the conflict convergence point.

[0056] Specifically, the system first initializes a set of covert hijacking instances. This is used to store all route conflict pairs that meet the criteria for covert hijacking. The system then iterates through the set of route conflict instances. Each pair of conflicting route entries in the table is represented as follows: and ,in and For conflicting IP prefixes, and As a source convergence point, and For source AS, and This is an intermediate node in the AS path.

[0057] Furthermore, the system first verifies the differences in ROA authorization status. If Match a ROA record whose length does not exceed the maximum prefix length defined in the ROA. If it is consistent with the source AS declared in the ROA, then it indicates It is a legal declaration; and if No ROA record was matched, or its length exceeds the maximum length defined by the ROA, or If it is inconsistent with the source AS declared in the ROA, it indicates Unauthorized declaration behavior exists. Secondly, the system verifies the source aggregation point. Did you not receive it? And the source AS is The routing, i.e. It does not exist in the routing table. The routing records are used to confirm The declaration is covert. Finally, the system checks whether there are intermediate nodes in the AS path. and Overlap, that is If true, then it indicates Sent to The traffic will pass through ,and It is possible that the malicious declaration has been adopted. Routing, which leads to traffic hijacking.

[0058] Specifically, this step applies to network environments with partial ROV (Remotely Operated Vehicle) mechanisms deployed, especially in areas with insufficient ROV coverage, where covert hijacking attacks are difficult to detect by control plane detection mechanisms. Through this step, the system can identify potential covert hijacking behaviors at the data plane level, providing network operators with early warning and tracing capabilities.

[0059] Specifically, this step, through structured rule matching, effectively identifies covert hijacking instances that are difficult to detect using traditional methods, improves the detection accuracy and coverage of BGP routing anomalies, and has significant security enhancement value.

[0060] Furthermore, the detection of covert hijacking instances involves determining whether covert hijacking behavior exists based on conflict pairs in the route conflict instance set by verifying differences in ROA authorized states, missing route reachability of conflict convergence points, and overlap between intermediate nodes in the AS path and conflict convergence points. Conflict pairs meeting the determination criteria are then added to the covert hijacking instance set, including: The criteria for determining ROA authorization status conflicts include: Matching ROA records and The length does not exceed the maximum length limit of the ROA, and Match with the legitimate source AS recorded in the ROA, and at the same time The matched ROA records contain multiple records whose length exceeds the maximum length limit. The source AS does not match the legitimate source recorded in the ROA.

[0061] Specifically, the core of this step lies in identifying whether there is a coexistence of legitimate and illegitimate declarations by comparing the differences in the ROA authorization status of two routing entries, thereby providing a key basis for the detection of covert hijacking.

[0062] Specifically, the determination condition includes: prefix Matches at least one ROA record, whose prefix length does not exceed the maximum length limit declared by the ROA, and whose source AS... Consistent with the legitimate source AS recorded in the ROA; while the prefix Among the matched ROA records, at least one record has a prefix length exceeding its maximum length limit, or its source AS. The data does not match a valid source AS recorded in the ROA. The mathematical expression for this condition is: .

[0063] Furthermore, this determination process relies on real-time querying and matching of the ROA database. The system first determines the conflict route based on the prefixes in the conflict route entries. and The system searches for the corresponding ROA record in the RPKI database. ROA records are typically stored in CIDR format and contain the authorized IP prefix, maximum length, and legitimate origin AS. The system determines the legitimacy of the route advertisement by matching prefix inclusion and prefix length constraints.

[0064] Furthermore, the maximum length limit of ROA Typically set by the ROA publisher based on its network topology and routing policy, its value ranges from 0 to 32 (IPv4) or 0 to 128 (IPv6). If the prefix length of a route advertisement exceeds the maximum length declared in the ROA, the advertisement is considered illegal. Furthermore, the source AS... and The matching must strictly follow the integer comparison of the AS number to ensure that it is completely consistent with the origin AS field in ROA.

[0065] Specifically, this criterion is primarily used to identify route advertisements that are not filtered by ROV on the control plane, but whose actual traffic may be forwarded by unauthorized ASs. For example, when... By legal AS It was announced and verified by ROV, and By illegal AS If a declaration is made but not verified by ROV, and the two have an overlapping relationship on the path, it may constitute a covert hijacking.

[0066] Specifically, by introducing a comparison mechanism of ROA authorization status, the system can identify route entries that appear legitimate on the control plane but whose actual declared source is inconsistent with the ROA, thereby effectively detecting covert hijacking behavior. This method compensates for the blind spots of traditional ROV-based detection mechanisms in some deployment environments, improving the detection accuracy and coverage of inter-domain route security.

[0067] Extract key information for the current route entry, including: extract the IP prefix, AS path, and source aggregation point information of the route entry being traversed.

[0068] Specifically, after loading route entries into memory, the system uses a predefined parser to identify and extract three core data elements for each entry, based on the BGP protocol standard format (such as the MP_REACH_NLRI and AS_PATH attributes defined in RFC 4271): the IP prefix (usually represented in CIDR format, such as 192.0.2.0 / 24), the AS path (an ordered sequence of Autonomous System numbers representing the propagation path of route advertisements), and the source aggregation point (used to identify the specific BGP data collector providing the observation data for this route). This parsing process must ensure the accuracy and consistency of the data format, providing standardized input for subsequent construction of a unified index and comparative analysis.

[0069] Furthermore, in practical systems applied to global internet routing monitoring, this step requires processing massive amounts of high-concurrency routing table data. Taking multiple large BGP monitoring points covering major global regions (such as RouteViews and RIPE RIS) as an example, the system needs to process tens of millions of raw BGP update messages or routing table snapshots daily. The extraction operation requires high throughput and stability, typically implemented using streaming or batch processing frameworks. The extracted IP prefix length ranges from 0 to 32 bits for IPv4 and from 0 to 128 bits for IPv6; the AS path length generally follows BGP implementation conventions, typically not exceeding 20 AS nodes; the source aggregation point identifier is a unique string or number used to distinguish collectors from different geographical or logical locations.

[0070] Specifically, this step is the primary data processing stage in building a multi-convergence point routing analysis pipeline, and is widely used in internet infrastructure security monitoring, routing anomaly analysis, and network situational awareness platforms. By accurately and efficiently extracting key triplet information from routing entries, it lays a solid and standardized data foundation for subsequent "unified routing index construction" and "routing conflict instance identification." Its technical effect lies in transforming unstructured, scattered raw routing data into structured features that can be directly processed by the algorithm, significantly improving the data processing efficiency of the entire detection method, the decoupling degree between system modules, and the reliability and accuracy of the final routing security analysis results.

[0071] Representing and resolving conflicting route pairs includes: representing the conflicting pairs in the set of route conflicting instances as p1:V1...(M1)...O1 and p2:V2...(M2)...O2; where p1 and p2 are the two conflicting IP prefixes, V1 and V2 are the corresponding source aggregation points, O1 and O2 are the corresponding source ASs, and M1 and M2 represent intermediate AS nodes existing in the AS path.

[0072] Specifically, the system reads each pair of conflict entries from the set of route conflict instances generated in the previous step and parses and reconstructs them according to a predefined structured template. This template uniformly represents each conflicting route as "p:V…(M)…O". In implementation, the system extracts the inherent attributes of each route using a parsing algorithm: the prefix p is stored as a CIDR format string; the source aggregation point V is represented by a collector identifier; the source ASO is the Autonomous System Number; and the intermediate AS sequence M represents an ordered list of nodes (potentially empty) located between the source AS and the aggregation point in the AS path. This process ensures that the routing information of both conflicting parties is deconstructed into standardized fields that can be accurately compared.

[0073] Furthermore, this step requires efficient processing of a conflict instance set that may reach tens of thousands. The system typically employs a batch processing mechanism, traversing the conflict set and performing the aforementioned resolution operation on each pair of conflicts. Parameter-wise, p1 and p2 may have a parent-child overlay relationship or be completely identical; V1 and V2 represent observation points from different geographical or network locations (such as route-views2 and amsix); O1 and O2 are different autonomous system numbers; M1 and M2 are path sequences, their lengths constrained by BGP path length conventions. This standardized representation provides a directly computable logical entity for subsequent covert hijacking determination based on multi-dimensional rules.

[0074] Specifically, by transforming unstructured conflict pairs into a unified and standardized logical representation, the system can clearly separate the various dimensions of the conflict (prefix, source, origin, path), thus providing accurate and discrete input data for subsequent verification of a series of judgment rules, such as ROA authorization status, lack of reachability of convergence points, and overlapping relationships of path nodes. Its technical effect lies in achieving decoupling between detection logic and data structure, significantly improving the matching efficiency of the rule engine, code maintainability, and the reliability and interpretability of the entire covert hijacking judgment process.

[0075] Routing table data is obtained from BGP data collectors in multiple geographic regions, including route-views2, wide, and amsix collection points published by RouteViews, to ensure that the routing index covers the routing announcement behavior of different regions.

[0076] Specifically, in some implementations, the collectors used include three representative aggregation points released in the RouteViews project: `route-views2` (North America), `wide` (Asia), and `amsix` (Europe). These collection points are deployed in the backbone networks of different continents and have extensive route observation capabilities, which can reflect the route announcement behavior in different regions.

[0077] Furthermore, the system periodically retrieves daily 12:00 BGP route snapshots from RouteViews' public data interface. Each snapshot contains the complete routing table (RIB) currently observed by the collection point. The collection frequency is typically set to once daily to ensure data timeliness and continuity. In practice, the system uses standard BGP data collection tools such as `telnet` or `BGPStream` to establish connections with the collection points and obtain their BGP table data. Each route record contains key fields such as IP prefix, AS path (AS_PATH), next hop (NEXT_HOP), and source collection point (Collector).

[0078] Furthermore, the selection of data collection points must meet certain representativeness and coverage requirements. For example, `route-views2` is located in the United States, covering the main backbone network in North America; `wide` is located in Japan, covering the Asian region; and `amsix` is located in the Netherlands, covering the European backbone network. The routing tables of these data collection points typically range from millions to tens of millions of entries, processing approximately 50 million raw routing data entries daily, covering more than 370 BGP data collection points globally. Through data fusion from multiple regional data collection points, the system can construct a routing index with high spatial coverage, providing a foundation for subsequent detection of routing conflicts and covert hijacking.

[0079] Specifically, this step is the first stage of the entire covert hijacking detection system. Its core function is to break through the limitations of traditional routing analysis based on a single data collection point and improve the ability to observe global routing status. By collecting and integrating data from multiple aggregation points, the system can identify situations where different declared paths exist for the same prefix in different regions, thereby providing structured data support for subsequent conflict identification and abnormal behavior analysis.

[0080] Specifically, this step significantly enhances the global representativeness and completeness of the routing index by introducing multiple regional collection points. In actual testing, the system successfully identified multiple cross-regional routing conflict instances in the early stages of operation, providing crucial clues for covert hijacking detection. This method has significant application value in scenarios such as BGP security monitoring, network anomaly tracing, and routing policy optimization.

[0081] This invention discloses a multi-convergence point detection method for covert routing hijacking across domains. By constructing a unified routing index and a multi-dimensional correlation verification mechanism, it effectively solves the core technical challenges of traditional detection methods, such as a single perspective and difficulty in identifying cross-regional collaborative covert hijacking. This method achieves end-to-end analysis from multi-source data aggregation and automated identification of conflict instances to intelligent judgment of hijacking behavior, significantly improving the detection coverage and accuracy of complex routing hijacking attacks, and enhancing the global observation capabilities and proactive security defense level of Internet routing infrastructure.

[0082] Example 2 To achieve the above invention, embodiments of the present invention also provide specific steps of a multi-convergence point detection method for inter-domain route covert hijacking, including: Step S101: Establish a unified routing index based on the routing tables of multiple aggregation points. This step includes the following sub-steps in sequence: Step S1011: Initialize the unified routing index structure. This step includes the following sub-steps in sequence: Step S10111: Create an empty prefix index structure using a prefix tree (Trie) data structure to store and organize routing entries for multiple convergence points.

[0083] Step S10112: Define data fields for the Trie tree node, including prefix information, the corresponding AS path set, and the source aggregation point set.

[0084] Step S1012: Process the routing tables of each aggregation point. This step includes the following sub-steps in sequence: Step S10121: Iterate through the complete routing table of each aggregation point in sequence.

[0085] Step S10122: For each routing record, extract its IP prefix, AS path, and source aggregation point information.

[0086] Step S10123: Insert the routing record into a unified prefix index Trie tree according to its IP prefix. This step includes the following sub-steps in sequence: Step S101231: If the Trie node corresponding to the prefix does not yet exist, create the corresponding node in the Trie tree.

[0087] Step S101232: Add the AS path corresponding to the prefix to the AS path set of the corresponding Trie node.

[0088] Step S101233: Add the source aggregation point corresponding to the prefix to the source aggregation point set of the corresponding Trie node.

[0089] Step S102: Traverse and identify routing conflict instances between different convergence points. This step includes the following sub-steps in sequence: Step S1021: Initialize the ConflictSet, a collection of route conflict instances.

[0090] Step S1022: Traverse all routing entries for all aggregation points. This step includes the following sub-steps in sequence: Step S10221: Iterate through each route entry in the complete routing table of each aggregation point.

[0091] Step S12222: Extract the IP prefix, AS path, and source aggregation point information of the current routing entry.

[0092] Step S10223: Using the IP prefix as the key, perform an index lookup in the unified routing index (i.e., the prefix Trie tree constructed in step 1). This step includes the following sub-steps in sequence: Step S102231: Starting from the root node of the Trie tree, match the IP prefix path bit by bit.

[0093] Step S102232: In the matching path, record all Trie nodes that contain valid routing records to form a set of candidate parent nodes on the prefix path.

[0094] Step S102233: Determine the final node corresponding to the current route prefix in the Trie tree and add it to the candidate parent node set.

[0095] Step S1023: Identify routing conflicts and generate conflict instances. This step includes the following sub-steps in sequence: Step S10231: Traverse each node in the candidate parent node set.

[0096] Step S10232: For each routing record in each candidate node, determine whether its source aggregation point is different from the source aggregation point of the current routing entry, and determine whether the source AS of its AS path is different from the source AS of the current routing entry.

[0097] Step S10233: If the two conditions of step S10232 are met, then a routing conflict is considered to exist.

[0098] Step S10234: Combine the current route entry with the candidate entry that is in conflict to form a conflict instance, and add it to the route conflict instance set ConflictSet.

[0099] Step S103: Detect potential covert hijacking instances through rule matching. This step includes the following sub-steps in sequence: Step S1031: Initialize the StealthHijackSet collection of stealth hijacking instances.

[0100] Step S1032: Iterate through each pair of conflicting route entries in ConflictSet. This step includes the following sub-steps in sequence: Step S10321: Represent the two routing entries in the conflict pair as p1: V1...(M1)...O1 and p2:V2...(M2)...O2, where p1 and p2 are the prefixes of the two routing entries, V1 and V2 are their respective source aggregation points, O1 and O2 are their respective source ASs, and M1 and M2 represent possible intermediate ASs.

[0101] Step S10322: Determine if there is a route authorization state conflict, i.e., there is an ROA that matches p1 and p1 does not exceed the maximum length limit recorded, and O1 matches the recorded source AS, and there is also an ROA that matches p2 and p2 exceeds the maximum length limit recorded, or O2 does not match the recorded source AS.

[0102] Step S10323: Determine that V1 does not have a route to prefix p2 with origin O2.

[0103] Step S10324: Determine if there exists an M1 that is exactly V2.

[0104] Step S10325: If steps S10322 to S10324 are all satisfied, then the conflict pair is considered to constitute a stealth hijacking instance, and it is added to the StealthHijackSet of stealth hijacking instances.

[0105] Specifically, the inter-domain route covert hijacking detection method based on multi-convergence point route analysis includes the steps of constructing a unified route index, identifying route conflict instances, and detecting covert hijacking instances. The unified route index is built based on the routing tables of multiple convergence points. The unified route index adopts a prefix tree (Trie) data structure. Each node of the prefix tree contains the following data fields: IP prefix, AS path set, and source convergence point set. The determination conditions for route conflict instances include the same prefix or the existence of a parent-child relationship, and different source convergence points and different source ASs. The route conflict instance identification process uses the prefix of each route entry as the key to search for candidate nodes on its path in the Trie tree, and performs conflict matching by combining the route records recorded in the candidate nodes. The covert hijacking instance is identified based on the identified route conflict instance through rule matching. The determination rules for covert hijacking instances include authorized state conflict, the absence of a route with conflict prefix 2 declared by conflict source 2 at conflict convergence point 1, and the existence of an overlap relationship between path node 1 and conflict convergence point 2. The authorized state conflict is determined based on ROA data.

[0106] This invention discloses a multi-convergence point detection method for covert hijacking of inter-domain routes. By fusing multi-convergence point data to construct a unified index and implementing multi-rule correlation analysis, it effectively addresses the core technical shortcomings of traditional solutions, such as isolated perspectives and difficulty in identifying cross-regional collaborative hijacking. It achieves a closed-loop end-to-end system from global route status awareness and automated conflict instance screening to intelligent determination of covert hijacking, significantly improving the detection coverage and accuracy of complex hijacking attacks, and enhancing the proactive defense capabilities and overall security of the Internet routing system.

[0107] Implementation 3 To achieve the above invention, embodiments of the present invention also provide an application scenario for the specific steps of a multi-convergence point detection method for inter-domain route covert hijacking, such as... Figure 2 As shown, it includes: Step 1: Establish a unified routing index.

[0108] Step 2: Identify routing conflict instances.

[0109] Step 3: Detect instances of covert hijacking.

[0110] The relevant steps are explained in detail below: Step 1: Establish a unified routing index based on the routing tables of multiple aggregation points: First, an index framework based on a trie structure is initialized. This trie structure expands layer by layer from the root node, with each node storing routing information in a specific data field, including the IP prefix itself, the set of all AS paths corresponding to that prefix, and the set of source aggregation points that provide this routing information.

[0111] Next, the complete routing table of each aggregation point is processed one by one. Each routing record in the table is parsed, and its field information is extracted. This parsed routing information is then stored in the prefix tree node according to the prefix index. For each IP prefix, the system searches for the corresponding node position in the prefix tree. If the node does not already exist, a new node is created dynamically. After a node is created or located, the AS path of the current routing entry is added to the AS path set of that node, and the source aggregation point is also recorded in the source aggregation point set of the node.

[0112] Step 2, traverse and identify routing conflict instances between different convergence points: First, initialize an empty set of route conflict instances to store all detected conflict instances.

[0113] Subsequently, the complete routing table of each aggregation point is traversed, and each routing entry is analyzed to extract its information, including the IP prefix, AS path, and source aggregation point. For each routing entry, the system uses the IP prefix as the retrieval basis and performs a query in the constructed unified routing index (prefix Trie tree). The query process starts from the root node of the Trie tree, matching the binary bits of the IP prefix bit by bit, and recording all intermediate nodes containing valid routing records during the matching process, forming a set of candidate parent nodes. These candidate nodes include the exact matching node of the current prefix, as well as shorter prefixes that it may cover in the Trie tree.

[0114] Finally, the system analyzes whether routing conflicts exist. For each routing record in the candidate nodes, it checks whether its source aggregation point is different from the source aggregation point of the current routing entry, and also determines whether the source AS (i.e., the starting autonomous system of the path) of its AS path is inconsistent with the source AS of the current routing entry. If both conditions are met, a routing conflict is determined to exist, and the current routing entry is combined with the conflicting candidate entry to form a conflict instance, which is then added to the routing conflict instance set.

[0115] Step 3: Detect potential covert hijacking instances through rule matching: First, initialize a set of covert hijacking instances to store all routing conflicts that meet the covert hijacking criteria.

[0116] Subsequently, each pair of conflicting route entries in the set of conflicting route instances is traversed. For each pair of conflicting routes p1:V1...(M1)...O1 and p2:V2...(M2)...O2, their key attributes are parsed, including the IP prefix (p1, p2), the source aggregation point (V1, V2), the source AS (O1, O2), and the intermediate ASs (M1, M2) that may exist in the AS path.

[0117] Next, multi-layered rule matching is used to determine whether the conflict constitutes covert hijacking. First, route authorization state conflicts are checked, specifically using ROA records for verification. If p1 meets the authorization range in the ROA record (i.e., p1 matches one ROA record and does not exceed its maximum length limit, and O1 matches a legitimate source AS in the ROA record), while p2 does not meet its ROA authorization range (i.e., for all ROA records matched by p2, p2 exceeds the maximum length limit or O2 does not match a legitimate source AS), then p2 is considered an unauthorized advertisement. Second, it is verified whether the source aggregation point V1 has not received the route from p2. If V1's routing table does not contain a route with the prefix p2 and source AS O2, then the malicious route is covert. Finally, it is checked whether M1 (i.e., an intermediate AS in p1's AS path) happens to be V2 (i.e., p2's source aggregation point). If so, it indicates that traffic from V1 to p2 is forwarded to O2 when passing through V2, resulting in actual hijacking.

[0118] Finally, when all the above conditions are met, the conflict pair is determined to constitute a covert hijacking instance and is added to the covert hijacking instance set.

[0119] This invention discloses a method for detecting multi-convergence point hijacking of inter-domain routes, outlining specific steps and application scenarios. By constructing a unified routing index that integrates multi-source data and implementing multi-dimensional rule association verification, it effectively solves the core technical challenges of traditional solutions, such as a single detection perspective and difficulty in identifying cross-regional collaborative hijacking. It achieves a closed-loop analysis of the entire process, from global routing status awareness and automatic conflict instance screening to intelligent hijacking behavior determination, significantly improving the detection coverage and accuracy of complex covert hijacking attacks, thereby comprehensively enhancing the proactive security defense capabilities and overall reliability of the Internet routing system.

[0120] Example 4 To achieve the above invention, embodiments of the present invention also provide a multi-convergence point detection system for inter-domain route covert hijacking, such as... Figure 3 As shown, it includes: The system consists of three modules: a route index construction module, a route conflict detection module, and a covert hijacking detection module. The route index construction module is responsible for obtaining multi-convergence routing table data from public data sources such as RouteViews and constructing a unified route index based on a prefix Trie tree structure, providing an efficient data organization method for subsequent analysis. The route conflict detection module traverses the route entries in the unified index, identifies route pairs that meet conflict conditions by comparing routing information from different convergence points, and generates a set of route conflict instances. The covert hijacking detection module further analyzes these conflict instances, performing precise matching through preset covert hijacking identification rules, and finally outputs a confirmed set of covert hijacking instances.

[0121] Specifically, in terms of technical implementation, the system uses Python 3.10 as the primary development language, runs on the Linux operating system platform, and is equipped with an Intel Xeon E5-2650 multi-core processor to ensure efficient processing of massive amounts of routing data. The system automatically acquires global multi-convergence point routing table data published by RouteViews daily, including daily 12:00 snapshots from three main collectors: route-views2 (North America), wide (Asia), and amsix (Europe), starting from January 1, 2025. The daily processing volume of raw routing data is approximately 50 million BGP routes, covering more than 370 convergence points globally, ensuring comprehensiveness and timeliness of detection.

[0122] Furthermore, during the first three months of actual operation, the system successfully detected 110 potential covert hijacking instances. These instances all conformed to the covert hijacking characteristics proposed in this invention, including typical abnormal patterns such as ROA authorization conflicts, and were confirmed through data plane probing methods. The results show that this invention can effectively identify covert hijacking behaviors that are difficult to detect using traditional methods, improving the security of inter-domain routing systems and their ability to detect route hijacking.

[0123] This invention discloses a multi-convergence point detection system for covert hijacking of inter-domain routes. By constructing a multi-module collaborative full-process analysis architecture, it effectively solves the core technical bottlenecks of traditional detection schemes, such as limited perspective and difficulty in systematically identifying and verifying cross-regional collaborative hijacking. The system achieves a complete technical closed loop, from the aggregation and fusion of multi-source heterogeneous routing data and automatic discovery of conflict instances across the entire domain to intelligent judgment and verification of covert hijacking behavior. This significantly improves the automated detection coverage and judgment confidence of complex, low-visibility hijacking attacks. Its modular design not only enhances the system's scalability and processing efficiency but also provides practical and effective technical support for improving the overall proactive defense capabilities and security operation level of Internet routing infrastructure.

[0124] Example 5 To achieve the above invention, such as Figure 4 As shown, this embodiment also provides a multi-convergence point detection device 10 for inter-domain route covert hijacking, the device 10 comprising: The routing index building module 100 is used to build a unified routing index. By parsing the routing table data of multiple aggregation points, it stores the IP prefix, AS path and source aggregation point information in a hierarchical manner using a prefix tree data structure, forming a routing index structure that includes prefix nodes, AS path sets and source aggregation point sets.

[0125] The routing conflict identification module 200 is used to identify routing conflict instances. Based on the unified routing index, it traverses the routing entries of each aggregation point, and by comparing the routing records of different source aggregation points, it detects routing conflict pairs that satisfy prefix correlation, AS path source AS difference, and source aggregation point difference, and generates a set of routing conflict instances.

[0126] The covert hijacking detection module 300 is used to detect covert hijacking instances. Based on the conflict pairs in the route conflict instance set, it determines whether there is covert hijacking behavior by verifying the differences in ROA authorization status, the lack of route reachability of the conflict convergence point, and the overlap between the intermediate nodes of the AS path and the conflict convergence point. Conflict pairs that meet the judgment conditions are added to the covert hijacking instance set.

[0127] This invention discloses a multi-convergence point detection device for covert hijacking of inter-domain routes. Through its modular and collaborative architecture, it effectively addresses the core shortcomings of traditional solutions, such as isolated data and fragmented detection processes. The device comprises core modules for multi-regional data acquisition and indexing, conflict instance identification, and covert hijacking determination. It achieves a closed-loop analysis process from multi-source heterogeneous data aggregation and automated global conflict screening to intelligent multi-dimensional rule verification. Its systematic design significantly improves the detection capability and accuracy of cross-regional collaborative hijacking attacks, enhances the automation level of the detection process and the reliability of the results, and provides a solid technical foundation for building a proactive and intelligent internet route security defense system.

[0128] To implement the methods of the above embodiments, the present invention also provides a computer device, such as... Figure 5 As shown, the computer device 600 includes a memory 601 and a processor 602; wherein, the processor 602 reads the executable program code stored in the memory 601 to run a program corresponding to the executable program code, so as to implement the various steps of the multi-convergence point detection method for inter-domain route covert hijacking described above.

[0129] To implement the above embodiments, this application also proposes a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements a multi-convergence point detection method for inter-domain route covert hijacking as described in the foregoing embodiments.

[0130] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0131] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A multi-convergence point detection method for inter-domain route covert hijacking, characterized in that, include: A unified routing index is constructed by parsing the routing table data of multiple aggregation points and storing the IP prefix, AS path and source aggregation point information in a hierarchical manner using a prefix tree data structure, forming a routing index structure that includes prefix nodes, AS path sets and source aggregation point sets. To identify routing conflict instances, the system traverses the routing entries of each aggregation point based on the unified routing index. By comparing the routing records of different source aggregation points, it detects routing conflict pairs that satisfy prefix association, AS path source AS difference, and source aggregation point difference, and generates a set of routing conflict instances. To detect covert hijacking instances, based on the conflict pairs in the set of route conflict instances, the system verifies the differences in ROA authorized status, the lack of route reachability at the conflict convergence point, and the overlap between intermediate nodes of the AS path and the conflict convergence point to determine whether covert hijacking behavior exists. Conflict pairs that meet the determination criteria are then added to the set of covert hijacking instances.

2. The method as described in claim 1, characterized in that, Building a unified routing index includes: Each node of the prefix tree contains the following data fields: IP prefix, AS path set, and source aggregation point set; where the IP prefix is ​​used to identify the routing entry, the AS path set stores all AS path information that advertises the corresponding prefix, and the source aggregation point set records the aggregation point identifier that provides the corresponding routing information. When inserting a route record into the Trie tree, if the Trie node corresponding to the current IP prefix does not yet exist, a new node is created dynamically, and the AS path and source aggregation point of the route are added to the AS path set and source aggregation point set of the new node, respectively. If the node already exists, only its AS path set and source aggregation point set are updated.

3. The method as described in claim 1, characterized in that, Identify instances of routing conflicts, including: The formation of the candidate parent node set involves: starting from the root node of the Trie tree, matching the binary bits of the IP prefix bit by bit, recording all intermediate nodes containing valid routing records, and adding the finally matched node to the candidate parent node set to support conflict detection in parent-child prefix relationships.

4. The method as described in claim 1, characterized in that, Detect instances of covert hijacking, including: The criteria for determining ROA authorization status conflicts include: Matching ROA records and The length does not exceed the maximum length limit of the ROA, and Match with the legitimate source AS recorded in the ROA, and at the same time The matched ROA records contain multiple records whose length exceeds the maximum length limit. The source AS does not match the legitimate source recorded in the ROA.

5. The method as described in claim 1, characterized in that, The method further includes: Routing table data is obtained from BGP data collectors in multiple geographic regions, including route-views2, wide, and amsix collection points published by RouteViews, to ensure that the routing index covers the routing announcement behavior of different regions.

6. The method as described in claim 3, characterized in that, Identifying routing conflict instances also includes: Extract key information for the current route entry, including: extract the IP prefix, AS path, and source aggregation point information of the route entry being traversed.

7. The method as described in claim 4, characterized in that, Detecting instances of covert hijacking also includes: Representing and resolving conflicting route pairs includes: representing the conflicting pairs in the set of route conflict instances as p1: V1...(M1)...O1 and p2: V2...(M2)...O2; where p1 and p2 are the two conflicting IP prefixes, V1 and V2 are the corresponding source aggregation points, O1 and O2 are the corresponding source ASs, and M1 and M2 represent intermediate AS nodes existing in the AS path.

8. A multi-convergence point detection device for inter-domain route covert hijacking, characterized in that, include: The routing index building module is used to build a unified routing index. By parsing the routing table data of multiple aggregation points, it stores the IP prefix, AS path and source aggregation point information in a hierarchical manner using a prefix tree data structure, forming a routing index structure that includes prefix nodes, AS path sets and source aggregation point sets. The routing conflict identification module is used to identify routing conflict instances. Based on the unified routing index, it traverses the routing entries of each aggregation point, and by comparing the routing records of different source aggregation points, it detects routing conflict pairs that satisfy prefix association, AS path source AS difference, and source aggregation point difference, and generates a set of routing conflict instances. The covert hijacking detection module is used to detect covert hijacking instances. Based on the conflict pairs in the route conflict instance set, it verifies the differences in ROA authorized status, the lack of route reachability of the conflict aggregation point, and the overlap between the intermediate nodes of the AS path and the conflict aggregation point to determine whether covert hijacking behavior exists, and adds the conflict pairs that meet the judgment conditions to the covert hijacking instance set.

9. An electronic device, comprising: processor; The memory stores executable instructions; when the processor executes the instructions, it implements the multi-convergence point detection method for covert hijacking of inter-domain routes as described in any one of claims 1-7.

10. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, it implements a multi-convergence point detection method for inter-domain route covert hijacking as claimed in any one of claims 1-7.

Images