Route hijacking detection method and equipment for BGP (Border Gateway Protocol) route and medium

Abstract

The invention provides a routing hijacking detection method and device for BGP routing and a medium, and relates to the technical field of routing hijacking, and the method comprises the steps: building a routing space-time stable database based on BGP routing notification data obtained by a global distributed monitoring node, and the routing space-time stable database comprises an IP prefix mapping table and an ASPATH mapping table; when a BGP routing notification A is received, the A is analyzed to obtain a specific information set corresponding to the A, and the specific information set comprises an IP prefix, an ASN corresponding to the IP prefix and an ASN triple list obtained based on an attribute value of an ASPATH corresponding to the A; according to the method, whether the A has prefix hijacking or path hijacking or not is judged based on the IP prefix mapping table, the ASPATH mapping table and the specific information set corresponding to the A, dependence on the route origin authorization signing and issuing rate or the internet route registry is not needed, detection of the prefix hijacking and the path hijacking is supported at the same time, and the coverage range and the detection accuracy of route hijacking detection are remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of route hijacking technology, and in particular to a route hijacking detection method, device and medium for BGP routes. Background Technology

[0002] Border Gateway Protocol (BGP), as the core routing protocol between Autonomous Systems (AS), plays a crucial role in cross-domain routing decisions for the global Internet. It exchanges routing information, including IP prefixes, AS paths, and next hops, between different ASs through neighbor relationship establishment and route announcement mechanisms, and selects the optimal transmission path based on path vector algorithms. Due to the distributed architecture of the Internet, BGP follows the "path reachability first" principle, defaulting to trusting routing information sent by neighboring nodes, and lacks mandatory authentication and information verification mechanisms. This creates a potential vulnerability for route hijacking attacks. Statistics show that approximately 99% of cross-domain data transmission on the global Internet relies on the BGP protocol, and its protocol characteristics directly affect the stability and security of the entire network.

[0003] Routing hijacking is a malicious act by attackers to illegally alter the transmission path of data packets by forging routing information, tampering with path attributes, or exploiting protocol vulnerabilities. It primarily includes prefix hijacking and path hijacking. Prefix hijacking involves attackers forging routing information with IP prefixes that do not belong to them and announcing it to the network, causing traffic from the target IP prefix to be misdirected. Path hijacking, on the other hand, misleads routing decisions by altering the autonomous system path sequence in the routing information, thereby changing the data transmission path. Routing hijacking poses a serious threat to network service availability and data security.

[0004] In existing technologies, the legitimacy of the IP prefix and origin autonomous system in BGP route advertisements is typically verified using route origin authorization data in the Resource Public Key Infrastructure or route claims in the Internet Routing Registry in order to detect the existence of route hijacking.

[0005] However, the above method also has the following technical problems: Public Key Infrastructure (PKI) verifies the relationship between IP prefixes and autonomous systems using digital certificates. However, the global route origin authorization issuance rate is low; currently, only a small number of IPv4 / IPv6 prefixes have valid route origin authorization records, resulting in a large number of route advertisements being unable to be effectively verified. Furthermore, the Internet Routing Registry lacks a mandatory automated verification mechanism, and data coordination between different registries is poor, often leading to declaration conflicts, outdated information, or failure to update in a timely manner with network topology changes, easily causing false positives or false negatives. Moreover, the above methods can only detect prefix hijacking, not path hijacking. Therefore, the accuracy of path hijacking detection results obtained using the above methods is low. Summary of the Invention

[0006] To address the aforementioned technical problems, the technical solution adopted by this invention is as follows: According to a first aspect of the present invention, a method for detecting route hijacking in BGP routing is provided, the method comprising the following steps: S1. Based on BGP route advertisement data obtained from globally distributed monitoring nodes, a route spatiotemporal stability database is constructed and periodically updated at fixed time intervals. The route spatiotemporal stability database includes an IP prefix mapping table and an AS_PATH mapping table. The IP prefix mapping table includes several IP prefixes, the ASN corresponding to each IP prefix, and the relevant time information corresponding to each IP prefix. The AS_PATH mapping table includes several ASN triples and the relevant time information corresponding to each ASN triple. The relevant time information includes the first occurrence time, the most recent occurrence time, and the cumulative occurrence duration. The ASN triple is obtained by performing a sliding window operation with a length of 3 and a step size of 1 on the attribute value of AS_PATH.

[0007] S2. When a BGP route advertisement A is received, A is parsed to obtain the specific information set B={B1, B2, B3} corresponding to A; B1 is the IP prefix corresponding to A, B2 is the ASN corresponding to B1; B3 is a list of ASN triples obtained based on the attribute value of AS_PATH corresponding to A, and the list of ASN triples includes several ASN triples.

[0008] S3. When B1 is included in the IP prefix mapping table, if the ASN corresponding to B1 in the IP prefix mapping table is inconsistent with B2, or if the relevant time information corresponding to B1 does not meet the preset spatiotemporal stability judgment condition, then it is determined that A has prefix hijacking.

[0009] S4. When the AS_PATH mapping table includes all ASN triples in B3, if there are ASN triples in B3 whose corresponding time information does not meet the preset spatiotemporal stability judgment conditions, then it is determined that A has path hijacking.

[0010] According to a second aspect of the present invention, a non-transitory computer-readable storage medium is provided, wherein a computer program is stored in the storage medium, and the computer program is loaded and executed by a processor to implement the aforementioned method.

[0011] According to a third aspect of the present invention, an electronic device is provided, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the aforementioned method.

[0012] The present invention has at least the following beneficial effects: This invention provides a method, device, and medium for detecting route hijacking in BGP routing. The method constructs a route spatiotemporal stability database based on BGP route advertisement data obtained from globally distributed monitoring nodes, and periodically updates the database at fixed time intervals. The route spatiotemporal stability database includes an IP prefix mapping table and an AS_PATH mapping table. The IP prefix mapping table includes several IP prefixes, the ASN corresponding to each IP prefix, and relevant time information for each IP prefix. The AS_PATH mapping table includes several ASN triples and relevant time information for each ASN triple. When a BGP route advertisement A is received, the method... A is parsed to obtain B1, B2, and B3, where B1 is the IP prefix corresponding to A, B2 is the ASN corresponding to B1, and B3 is a list of ASN triples obtained based on the attribute value of A's corresponding AS_PATH. When the IP prefix mapping table includes B1, if the ASN corresponding to B1 in the IP prefix mapping table is inconsistent with B2, or if the relevant time information corresponding to B1 does not meet the preset spatiotemporal stability judgment condition, then A is determined to have prefix hijacking. When the AS_PATH mapping table includes all ASN triples in B3, if there is an ASN triple in B3 whose corresponding time information does not meet the preset spatiotemporal stability judgment condition, then A is determined to have path hijacking. It can be seen that this invention performs route hijacking detection through a self-built route spatiotemporal stability database, without relying on route origin authorization issuance rate or the Internet route registry, and simultaneously supports the detection of both prefix hijacking and path hijacking, significantly improving the coverage and accuracy of route hijacking detection. Attached Figure Description

[0013] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0014] Figure 1 This is a flowchart of a route hijacking detection method for BGP routing provided in an embodiment of the present invention. Detailed Implementation

[0015] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0016] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar tasks and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that comprises a series of steps or units is not necessarily limited to those explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0017] Embodiments of the present invention provide a route hijacking detection method for BGP routing, the method comprising the following steps, such as... Figure 1 As shown: S1. Based on BGP route advertisement data obtained from globally distributed monitoring nodes, construct a route spatiotemporal stability database and periodically update the database at fixed time intervals. The route spatiotemporal stability database includes an IP prefix mapping table and an AS_PATH mapping table. The IP prefix mapping table includes several IP prefixes, the ASN corresponding to each IP prefix, and the relevant time information for each IP prefix. The AS_PATH mapping table includes several ASN triples and the relevant time information for each ASN triple. The relevant time information includes the first occurrence time, the most recent occurrence time, and the cumulative occurrence duration. The ASN triples are obtained by performing a sliding window operation with a length of 3 and a step size of 1 on the attribute value of AS_PATH. For example, when the attribute value of AS_PATH is [AS100, AS200, AS300, AS400], the number of ASN triples obtained based on the attribute value of AS_PATH is 2, namely (AS100, AS200, AS300) and (AS200, AS300, AS400).

[0018] Optional, the fixed time interval is 1 hour.

[0019] Specifically, the AS_PATH attribute value is an ordered list of autonomous system numbers of type AS_SEQUENCE, including ASN1, ASN2, ..., ASN. i ..., ASN n ;ASN i Let ASN be the i-th autonomous system number in the ordered list of autonomous system numbers, where 1 ≤ i ≤ n, and n is the number of autonomous system numbers in the ordered list of autonomous system numbers. nThe corresponding autonomous system is the originating autonomous system; the originating autonomous system is the autonomous system that first declares a certain IP prefix; it can be understood as: ASN. n The corresponding autonomous system is the autonomous system that first announces the IP prefix in the BGP route advertisement corresponding to its ordered list of autonomous system numbers.

[0020] Specifically, AS_SEQUENCE is of type AS_PATH, indicating that the corresponding AS_PATH attribute value is an ordered list of autonomous system numbers traversed on the route to the destination, recording the autonomous system numbers of all autonomous systems traversed in the route in order.

[0021] Specifically, the ASN corresponding to the IP prefix is ​​the Autonomous System Number (ASN) in the AS_PATH attribute value corresponding to the originating Autonomous System. It can be understood that the ASN corresponding to the IP prefix is ​​the rightmost ASN in the AS_PATH attribute value corresponding to the IP prefix. The attribute values ​​of the IP prefix and its corresponding AS_PATH originate from the same BGP route advertisement.

[0022] Specifically, the IP prefix is ​​the address portion of the IP address corresponding to its network portion, expressed in the format of "IP address / mask length", for example: 192.168.1.0 / 24.

[0023] Specifically, AS_PATH is an attribute in the BGP routing protocol used to record the sequence of autonomous systems that the routing information passes through. Autonomous systems are also known as autonomous regions (AS).

[0024] Specifically, the autonomous system number serves as the unique identifier for the autonomous system.

[0025] Specifically, the globally distributed monitoring nodes are monitoring nodes deployed in multiple geographical locations around the world, continuously collecting BGP route advertisements to obtain BGP route advertisement data. The BGP route advertisement data is a collection or record of multiple route advertisements.

[0026] Specifically, for each globally distributed monitoring node, a data snapshot is generated at fixed time intervals. This data snapshot includes the BGP route advertisement data obtained by the globally distributed monitoring node within that fixed time interval.

[0027] Furthermore, after obtaining the first data snapshot of all globally distributed monitoring nodes, each BGP route advertisement in each data snapshot is parsed to obtain the attribute values ​​of IP prefix and AS_PATH, and a route spatiotemporal stability database is constructed based on the obtained attribute values ​​of all IP prefix and AS_PATH.

[0028] Furthermore, after the spatiotemporal stability database is constructed, each new data snapshot of all globally distributed monitoring nodes is obtained, and each BGP route advertisement in each new data snapshot is parsed to obtain the new IP prefix and AS_PATH attribute values. Based on all the obtained new IP prefix and AS_PATH attribute values, the spatiotemporal stability database is incrementally updated.

[0029] Through the above steps, the "initial full construction + subsequent incremental update" approach is adopted to build and continuously update the routing spatiotemporal stability database based on data snapshots generated by globally distributed monitoring nodes. This significantly reduces computational and storage overhead, improves system efficiency, and supports precise statistics on spatiotemporal attributes such as the first occurrence time, most recent occurrence time, and cumulative occurrence duration of IP prefixes and ASN triples, providing a reliable basis for judging the spatiotemporal stability of IP prefixes and ASN triples.

[0030] Specifically, the globally distributed monitoring nodes include the following six types of monitoring nodes, each of which performs the BGP route advertisement data collection task in a specific way: Basic operator international routing monitoring node: The enterprise-side platform realizes the localization of overseas routing data through the data acquisition subsystem; the department-side platform connects to the generated international routing data MRT file via FTP to collect international routing data from basic operators, including IPv4 / IPv6 BGPUpdate messages and RIB data; Domestic switching center monitoring nodes: Use dedicated route acquisition probe equipment to collect routing data from new domestic Internet switching centers, including IPv4 / IPv6 BGPUpdate messages and RIB data; specifically, establish BGPSession between the route security probe equipment and the four ministry-side switching centers respectively, and use TCP ports to transmit BGPUpdate messages. International open-source library monitoring node via FTP: Using FTP, routing data from international open-source libraries is collected via MRT files from the European Internet Information Centre RIPE (Routing Information Service, RIS service) and the University of Oregon (RouteViews project), including IPv4 / IPv6 BGPUpdate messages and RIB data. WebSocket-based international open-source library monitoring node: Uses WebSocket to collect network routing data from the RIPENCCRIS project, including new and deregistered IPv4 / IPv6 real-time update information; Domestic routing monitoring nodes of basic operators: Using dedicated routing acquisition probe equipment, domestic routing data of basic operators are collected through remote peer-to-peer connections and third-party relays, including IPv4 / IPv6 BGPUpdate messages and RIB data; International self-built monitoring nodes: Using dedicated route acquisition probe equipment, international routing data of key countries or regions is collected through remote peer-to-peer connections and third-party relays, including IPv4 / IPv6 BGPUpdate messages and RIB data; specifically, the dedicated route acquisition probe equipment establishes BGPSession on the international network and uses TCP ports to transmit BGPUpdate messages.

[0031] S2. When a BGP route advertisement A is received, A is parsed to obtain the specific information set B={B1, B2, B3} corresponding to A; B1 is the IP prefix corresponding to A, B2 is the ASN corresponding to B1; B3 is a list of ASN triples obtained based on the attribute value of AS_PATH corresponding to A, and the list of ASN triples includes several ASN triples.

[0032] Specifically, the difference between the number of Autonomous System Numbers in the AS_PATH attribute value corresponding to A and the number of ASN triples in B3 is 2.

[0033] S3. When B1 is included in the IP prefix mapping table, if the ASN corresponding to B1 in the IP prefix mapping table is inconsistent with B2, or if the relevant time information corresponding to B1 does not meet the preset spatiotemporal stability judgment condition, then it is determined that A has prefix hijacking.

[0034] Specifically, the preset criteria for determining spatiotemporal stability are either meeting the first criterion or meeting the second criterion.

[0035] Furthermore, the first determination condition is: LT≥t1, where LT is the cumulative occurrence duration and t1 is the first preset duration; those skilled in the art know that the first preset duration is set by those skilled in the art according to actual needs, such as 100 days, 150 days, 300 days, which will not be elaborated here.

[0036] Furthermore, the second determination condition is: t2≤△t1≤t3, LT≥t4 and △t2≤△t; t2 is the second preset duration, △t1 is the interval between the first occurrence time and the most recent occurrence time, t3 is the third preset duration, t4 is the fourth preset duration, △t2 is the interval between the most recent occurrence time and the current time, and △t is the preset interval duration; wherein, t3<t1; t4<△t1; △t<t2; those skilled in the art know that the second preset duration, the third preset duration, the fourth preset duration, and the preset interval duration are set by those skilled in the art according to actual needs, for example: the second preset duration is 30 days, the third preset duration is 60 days; when the interval between the first occurrence time and the most recent occurrence time is 50 days, the fourth preset duration is 40 days; the preset interval duration is 2 days or 3 days, which will not be elaborated here.

[0037] Specifically, when the relevant time information meets the first judgment condition, it means that the IP prefix or ASN triple corresponding to the relevant information has appeared for a long time and has spatiotemporal stability; when the relevant time information meets the second judgment condition, it means that the IP prefix or ASN triple corresponding to the relevant information has appeared frequently recently and has spatiotemporal stability.

[0038] Specifically, step S3 also includes: when the IP prefix mapping table includes B1, if the ASN corresponding to B1 in the IP prefix mapping table is the same as B2, and the relevant time information corresponding to B1 meets the preset spatiotemporal stability judgment condition, then it is determined that A does not have prefix hijacking.

[0039] Through the above steps, when the IP prefix mapping table includes B1, it indicates that B1 has a historical declaration record, which can be used to determine whether A is subject to prefix hijacking. If the ASN corresponding to B1 in the IP prefix mapping table is inconsistent with B2, it indicates that the current declaration subject does not match the historical subject, and prefix hijacking exists. If the relevant time information corresponding to B1 does not meet the preset spatiotemporal stability judgment condition, it indicates that B1 has neither been declared stably for a long time nor has it been declared continuously in the recent period, and does not have spatiotemporal stability. This indicates that the current declaration behavior deviates from the historical normal pattern, and A is judged to be subject to prefix hijacking. By introducing the first and second judgment conditions, it supports the identification of both long-term stable IP prefix declarations and recently continuously declared IP prefixes, which can effectively avoid misjudgments caused by routing policy adjustments or intermittent deployments, thereby improving the detection accuracy of routing hijacking.

[0040] Specifically, when B1 is not included in the IP prefix mapping table, the presence of prefix hijacking in A is determined based on Resource Public Key Infrastructure (RPKI) Route Authorization (ROA) data and Internet Routing Registry (IRR) data; this includes: RPKI-based ROA data verification (B1, B (2，AS)The legitimacy of (B1, B) is verified to obtain the first detection result; the validity of (B1, B) is verified based on IRR data. (2，AS) The validity of (B1, B) is determined to obtain the second test result; if the first test result or the second test result determines (B1, B) (2，AS) If A is illegal, then prefix hijacking is determined to exist in A; otherwise, prefix hijacking is determined not to exist in A, and B... (2，AS) This is the autonomous system corresponding to B2.

[0041] Through the above steps, when B1 is not included in the IP prefix mapping table, it means that no historical announcement record of B1 has been observed. It is impossible to determine whether A has prefix hijacking based on the data in the IP prefix mapping table. At this time, it is determined whether A has prefix hijacking based on the ROA data and IRR data of RPKI. The determination of whether BGP route advertisement has prefix hijacking based on the multi-source information verification system not only makes up for the blind spot of not being able to determine whether newly announced IP prefixes have prefix hijacking based on the route spatiotemporal stability database, but also avoids the risk of false alarms or false negatives caused by relying solely on ROA data or IRR data of RPKI. This is conducive to improving the coverage and accuracy of route hijacking detection.

[0042] Specifically, RPKI ROA data is acquired through RPKI data collection nodes deployed in multiple geographical locations globally. This includes: acquiring raw ROA data published by RPKI; performing structured parsing on the compressed ROA raw data based on its corresponding ROA signature certificate, converting it into a recognizable standardized text representation; extracting the Autonomous System Number, authorized route prefix, maximum prefix length, and trust anchor identifier from the recognizable standardized text representation to form a structured ROA record; encapsulating this ROA record into a standard format data object, using JSON as the standard format; generating a globally unique serialized identifier based on all fields of the ROA record using a hash algorithm; subsequently, verifying the ROA signature certificate level by level according to the RPKI trust chain, starting from the trust anchor root certificate, completing end-to-end digital signature validity verification, and marking ROA records that fail verification as "untrusted"; finally, deduplicating and aggregating duplicate ROA records from multiple RPKI data collection nodes, retaining the most recent timestamp and verified valid ROA records to obtain RPIK's ROA data.

[0043] Specifically, IRR data is acquired through IRR data collection nodes deployed in multiple geographical locations globally. This includes acquiring raw IRR data published by major international internet routing registries (including RADB, APNIC IRR, JPIRR, etc.); decompressing and parsing the compressed IRR data (supporting multiple compression formats such as ZIP, TAR, GZ, etc.) and converting it into a recognizable standardized text representation; extracting various IRR objects from this recognizable standardized text representation, including: AS-BLOCK, AS-SET, AUT-NUM, ROUTE, INET6NUM, MNTNER, ORGANISATION, ROLE, IRT, KEY-CERT, PEERING-SET, RTR-SET, etc.; obtaining the unique attribute fields for each type of IRR object to form a structured IRR record; and encapsulating this IRR record. The data objects are in a standard format, using JSON. The specific formats of various IRR objects are differentiated, and semantic alignment and standardization of fields are performed on similar IRR objects from different mainstream international internet routing registries to ensure that the same logical entities use unified data fields. Based on the entire content of the data objects in this standard format, a globally unique serialization identifier is generated using a hash algorithm. Finally, redundant, duplicate, corrupted, or conflicting IRR objects discovered during processing are cleaned, and objects with inconsistent declarations within the same mainstream international internet routing registry or across different mainstream international internet routing registries are classified and marked to obtain IRR data.

[0044] Specifically, raw IRR data is collected daily using FTP, including: IPv4 Routing Registration Data Table Collection: Collect IPv4 registration information from the Open Routing Data Registry, including basic information such as ASN and ASN broadcast routing prefix data; IPv6 Routing Registration Data Table Collection: Collect IPv6 registration information from the Open Routing Data Registry, including basic information such as ASN and ASN broadcast routing prefix data; AUT-NUM Table Data Collection: Collect AUT-NUM table information from the Open Routing Data Registry, including basic information such as the organization to which the AUT-NUM belongs, its country, its city, and its registration time; AS-SET Table Data Acquisition: Collect AS-SET table information from the Open Routing Data Registry, including interconnection information between the autonomous system networks of each organization and other networks, such as interconnection business relationship types and interconnection members.

[0045] Specifically, the ROA raw data is obtained by running RPKI dependent software and using the RRDP or RYSNC protocol at a custom frequency, based on the source route authentication information issued by the route owner in its resource allocation authority.

[0046] Specifically, Whois / ASN data from IANA / RIR is collected via FTP, including basic information such as the organization to which the ASN belongs, network name, country, and city.

[0047] Specifically, the geographic location information of IP addresses in RIPENCC is collected via FTP.

[0048] In another specific embodiment, when the IP prefix mapping table includes B1, if the ASN corresponding to B1 in the IP prefix mapping table is inconsistent with B2, or the relevant time information corresponding to B1 does not meet the preset spatiotemporal stability judgment condition, then it is determined whether A has prefix hijacking based on the ROA data and IRR data of RPKI.

[0049] Through the above steps, when it is determined from the IP prefix mapping table that the current advertised subject of B1 does not match the historical subject or that B1 does not have spatiotemporal stability, the ROA data and IRR data of RPKI are further used to determine whether A has prefix hijacking; the fusion of multi-source data to determine whether BGP routes have prefix hijacking is beneficial to improving the detection accuracy of route hijacking.

[0050] In another specific embodiment, the following steps are included after step S2: When the IP prefix mapping table includes the parent prefix of B1, if the ASN corresponding to the parent prefix is ​​the same as that of B2, and the relevant time information corresponding to the parent prefix meets the preset spatiotemporal stability judgment condition, then it is determined that A does not have prefix hijacking.

[0051] Specifically, the parent prefix of B1 is an IP prefix whose mask length is less than that of B1 and whose address range includes B1's IP prefix.

[0052] When the IP prefix mapping table includes the parent prefix of B1, if the ASN corresponding to the parent prefix is ​​inconsistent with B2, or if the relevant time information corresponding to the parent prefix does not meet the preset spatiotemporal stability judgment condition, then it is determined that A has prefix hijacking.

[0053] When the parent prefix of B1 is not included in the IP prefix mapping list, the presence of prefix hijacking in A is determined based on the ROA and IRR data of RPKI.

[0054] In another specific embodiment, when the IP prefix mapping table includes the parent prefix of B1, if the ASN corresponding to the parent prefix is ​​inconsistent with B2, or if the relevant time information corresponding to the parent prefix does not meet the preset spatiotemporal stability judgment condition, then the ROA data and IRR data of RPKI are used to determine whether A has prefix hijacking.

[0055] Through the above steps, when B1 is not directly recorded in the IP prefix mapping table, it can be determined whether A is subject to prefix hijacking by verifying the historical declaration behavior of its parent prefix. Specifically, if the IP prefix mapping table records the parent prefix of B1 and the parent prefix of B1 is declared stably over a long period of time or continuously declared recently by the autonomous system corresponding to B2, then B1 is determined to be a legitimate sub-prefix, and A is not subject to prefix hijacking. Otherwise, it can be directly determined that A is subject to prefix hijacking, or further determined by combining the ROA data and IRR data of RPKI. This avoids misjudgments caused by fine-grained network partitioning (such as splitting / 24 into / 26), and helps to improve the detection accuracy of route hijacking.

[0056] In another specific embodiment, the following steps are included after step S2: When the IP prefix mapping table includes a sub-prefix of B1, if the ASN corresponding to the sub-prefix is ​​the same as that of B2, and the relevant time information corresponding to the sub-prefix meets the preset spatiotemporal stability judgment condition, then it is determined that A does not have prefix hijacking.

[0057] Specifically, the subprefix of B1 is an IP prefix whose mask length is greater than that of B1 and whose address range is completely contained within B1.

[0058] When the IP prefix mapping table includes a sub-prefix of B1, if the ASN corresponding to the sub-prefix is ​​inconsistent with that of B2, or if the relevant time information corresponding to the sub-prefix does not meet the preset spatiotemporal stability judgment condition, then it is determined that A has a prefix hijacking.

[0059] When the subprefix of B1 is not included in the IP prefix mapping list, the presence of prefix hijacking in A is determined based on the ROA and IRR data of RPKI.

[0060] In another specific embodiment, when the IP prefix mapping table includes a sub-prefix of B1, if the ASN corresponding to the sub-prefix is ​​inconsistent with B2, or if the relevant time information corresponding to the sub-prefix does not meet the preset spatiotemporal stability judgment condition, then the ROA data and IRR data of RPKI are used to determine whether A has a prefix hijacking.

[0061] Through the above steps, when B1 is not directly recorded in the IP prefix mapping table, it can be determined whether A is subject to prefix hijacking by verifying the historical declaration behavior of its sub-prefixes. Specifically, if the IP prefix mapping table records the sub-prefix of B1 and the sub-prefix of B1 is declared stably over a long period of time or continuously declared recently by the autonomous system corresponding to B2, then B1 is determined to be a legitimate parent prefix, and A is not subject to prefix hijacking. Otherwise, it can be directly determined that A is subject to prefix hijacking, or further determined by combining the ROA data and IRR data of RPKI. This avoids misjudgments caused by route aggregation or summarization and helps improve the detection accuracy of route hijacking.

[0062] S4. When the AS_PATH mapping table includes all ASN triples in B3, if there are ASN triples in B3 whose corresponding time information does not meet the preset spatiotemporal stability judgment conditions, then it is determined that A has path hijacking.

[0063] Through the above steps, AS_PATH is decomposed into ASN triples using a sliding window, and the relevant time information corresponding to each ASN triple is recorded in the AS_PATH mapping table. This allows it to determine whether the autonomous system path corresponding to B3 is composed of legitimate path segments that have been stable for a long time or recently. If all ASN triples in B3 belong to the AS_PATH mapping table, but there are ASN triples that do not meet the preset spatiotemporal stability judgment conditions, it indicates that the autonomous system path corresponding to B3 deviates significantly from the historical normal pattern, and path hijacking can be quickly identified. Based solely on real route observation data, it is possible to effectively identify covert path hijacking behavior implemented by attackers through splicing, forging, or abnormally reusing autonomous system path segments, significantly improving the coverage, timeliness, and practicality of route hijacking detection.

[0064] Specifically, after determining that path hijacking exists in A, a route hijacking alarm based on path tampering is generated for A.

[0065] Specifically, step S4 also includes: when the AS_PATH mapping table includes all ASN triples in B3, if the relevant time information corresponding to all ASN triples in B3 meets the preset spatiotemporal stability judgment condition, then it is determined that A does not have path hijacking.

[0066] Specifically, step S4 also includes: when the AS_PATH mapping table does not completely include all ASN triples in B3, existing technology can be used to determine whether path hijacking exists in A.

[0067] Through the above steps, a route spatiotemporal stability database is constructed based on BGP route advertisement data obtained from globally distributed monitoring nodes, and is periodically updated at fixed time intervals. The route spatiotemporal stability database includes an IP prefix mapping table and an AS_PATH mapping table. The IP prefix mapping table includes several IP prefixes, the ASN corresponding to each IP prefix, and the relevant time information for each IP prefix. The AS_PATH mapping table includes several ASN triples and the relevant time information for each ASN triple. When a BGP route advertisement A is received, A is parsed to obtain B1, B2, and B3, where B1 is the IP prefix corresponding to A, B2 is the ASN corresponding to B1, and B3 is the AS_PATH based on the A_PATH. The ATH attribute value yields a list of ASN triples. When the IP prefix mapping table includes B1, if the ASN corresponding to B1 in the IP prefix mapping table is inconsistent with B2, or if the relevant time information corresponding to B1 does not meet the preset spatiotemporal stability judgment condition, then A is determined to have prefix hijacking. When the AS_PATH mapping table includes all ASN triples in B3, if there is an ASN triple in B3 whose corresponding relevant time information does not meet the preset spatiotemporal stability judgment condition, then A is determined to have path hijacking. Route hijacking detection is performed through a self-built route spatiotemporal stability database, without relying on the route origin authorization issuance rate or the Internet route registry. It also supports the detection of prefix hijacking and path hijacking, significantly improving the coverage and accuracy of route hijacking detection.

[0068] The present invention also provides a specific embodiment, which differs from the above embodiment in that, after determining that prefix hijacking exists in A, the following steps are also included: S10. When B1 is included in the IP prefix mapping table, the ASN corresponding to B1 in the IP prefix mapping table is used as the key ASN corresponding to A.

[0069] S20. If the key ASN corresponding to A is consistent with the specified ASN corresponding to A, then it is determined that there is a relay relationship between upstream and downstream of A and the first noise reduction label BQ1 corresponding to A is determined as the first label; otherwise, it is determined that there is no relay relationship between upstream and downstream of A and BQ1 is determined as the second label; where the specified ASN corresponding to A is the ASN adjacent to B2 in the attribute value of AS_PATH corresponding to A; it can be understood as: the second to last ASN from left to right in the attribute value of AS_PATH corresponding to A.

[0070] Specifically, the first label indicates that prefix-based route hijacking alerts do not need to be generated; the second label indicates that prefix-based route hijacking alerts need to be generated.

[0071] Through the above steps, due to the common inconsistencies between IP prefix attribution and route origin announcements, such as CDN and cloud service providers announcing on behalf of customers, the legitimate behavior of upstream networks broadcasting downstream IPs is often misjudged as prefix hijacking. Therefore, if the key ASN corresponding to A is consistent with the designated ASN corresponding to A, it is determined that A has a broadcast relationship between upstream and downstream, which is a legitimate behavior and was misjudged as prefix hijacking. Thus, the first noise reduction label corresponding to A is determined to be the first label.

[0072] S30. If at least one of the preset sister ASN relationship tables contains both the key ASN corresponding to A and B2, then the second noise reduction label BQ2 corresponding to A is determined to be the first label; otherwise, BQ2 is determined to be the second label.

[0073] Specifically, each preset sister ASN relationship table has a corresponding organizational entity; the preset sister ASN relationship table includes the autonomous system numbers of all autonomous systems owned by its corresponding organizational entity.

[0074] Specifically, the preset sister ASN relationship table is obtained through publicly available autonomous system registration information, which includes the autonomous system name and the organization name of the autonomous system. The autonomous system registration information is merged into a single string, and preset common stop words are removed to update the autonomous system registration information. Information pairs are obtained, and the length of the common subsequence of the information pair is calculated using the longest common subsequence algorithm. Each information pair includes two updated autonomous system registration information entries. If the length of the common subsequence corresponding to an information pair is not less than the preset common subsequence length, then the two autonomous systems corresponding to the two updated autonomous system registration information entries in that information pair are considered to belong to the same organizational entity. Further, the preset sister ASN relationship table is determined based on the length of the common subsequence corresponding to the information pair and the preset common subsequence length. For example, the autonomous system number corresponding to the updated autonomous system registration information in several information pairs that include the same updated autonomous system registration information and whose corresponding common subsequence lengths are all not less than the preset common subsequence length is used as an autonomous system number in a preset sister ASN relationship table to construct such a table.

[0075] Through the above steps, since a large organization (such as a telecom operator or multinational corporation) typically deploys multiple Autonomous Systems (AS) in different regions and uses multiple Autonomous Domain Networks (which are "sister" networks) to conduct corresponding business, during the route announcement process, with changes in networks and services, there may be situations where IP prefixes are used for route announcements from different originating ASs, which may lead to changes in the originating AS number and be misjudged as prefix hijacking. Therefore, if at least one of the preset sister ASN relationship tables includes both the key ASN corresponding to A and B2, it is determined that the key ASN corresponding to A and B2 belong to the same organization entity's ASN and have been misjudged as prefix hijacking, thus determining that the second noise reduction label corresponding to A is the first label.

[0076] Specifically, when B1 is not included in the IP prefix mapping table, BQ1 and BQ2 are determined as the second label.

[0077] S40. If there is a preset IP prefix that is the same as B1 among all preset IP prefixes and there is a preset ASN that is the same as B2 among several preset ASNs corresponding to the preset IP prefix, then determine BQ3 corresponding to A as the first label; otherwise, determine BQ3 as the second label.

[0078] Specifically, the preset IP prefix is ​​the IP prefix corresponding to anycast address, and the preset ASN corresponding to the preset IP prefix is ​​the autonomous system number of the autonomous system that legally declares the preset IP prefix.

[0079] Through the above steps, since there are a large number of anycast behaviors in the DNS scenario, and multiple autonomous systems can legally declare the same IP prefix, if there is a preset IP prefix that is the same as B1 among all preset IP prefixes and there is a preset ASN that is the same as B2 among several preset ASNs corresponding to the preset IP prefix, then B1 is determined to be the IP prefix corresponding to the anycast address, and B2 is the autonomous system number of the autonomous system that legally declares B1. It was mistakenly judged as prefix hijacking, thus determining that the third noise reduction label corresponding to A is the first label.

[0080] S50. If the mask length corresponding to B1 is the specified mask length and B2 belongs to the preset private ASN list, then determine the fourth noise reduction label BQ4 corresponding to A as the first label; otherwise, determine BQ4 as the second label.

[0081] Specifically, the mask length is specified as 32.

[0082] Specifically, the preset private ASN list includes several preset private ASNs; the private ASN is the autonomous system number of the autonomous system corresponding to the known DDoS protection service system.

[0083] Through the above steps, since DDoS attack protection is usually achieved through BGP FlowSpec, the / 32 detailed route hijacking method is usually used to achieve fine-grained control of network traffic, thereby diverting network attack traffic and being mistakenly identified as prefix hijacking. Therefore, when the mask length corresponding to B1 is 32 and B2 is the autonomous system number of the autonomous system corresponding to the known DDoS protection service system, it is mistakenly judged as prefix hijacking, thus determining that the fourth noise reduction label corresponding to A is the first label.

[0084] S60. When BQ1, BQ2, BQ3, and BQ4 are all second labels, determine that there is no misjudgment and generate a prefix-based route hijacking alarm for A; otherwise, determine that there is a misjudgment and determine that A does not have prefix hijacking.

[0085] Through the above steps, only when the first, second, third, and fourth noise reduction labels corresponding to the BGP route advertisement are all the second label is it determined that there is no false alarm, and a prefix-based route hijacking alarm corresponding to the BGP route advertisement is generated. This effectively addresses a large number of "legitimate abnormal" routing behaviors caused by the frequent adjustments to routing policies of the Global Autonomous System (such as changes in business cooperation, topology optimization), IP address block reallocation, AS number migration, network merging or splitting, and other dynamic resource migrations. By using key ASNs and designated ASNs, preset sister ASN relationship tables, preset IP prefixes and their corresponding preset ASNs and specified mask lengths and private ASNs, noise generated by normal network changes is accurately identified and filtered, avoiding misjudging legitimate declarations as hijacking, significantly reducing invalid alarms, significantly lowering the false alarm rate, and improving the detection accuracy of route hijacking.

[0086] In one specific embodiment, after generating a route hijacking alarm, the route hijacking alarm is sent immediately; the route hijacking alarm includes prefix-based route hijacking alarms and path tampering-based route hijacking alarms.

[0087] In one specific embodiment, after generating several route hijacking alarms, the several route hijacking alarms are merged according to resource association relationships to generate at least one comprehensive alarm and send it.

[0088] Specifically, route hijacking alerts provide detailed information on the hijacking time, the hijacking and hijacked ASNs, the countries of the hijacking and hijacked ASNs, the type of hijacking, the route prefixes involved, and the number of affected IPs.

[0089] By merging the aforementioned route hijacking alarms according to resource association, alarm storms can be effectively reduced. Multiple alarms with related rows can be merged under the main alarm information, allowing for a quick understanding of the key information of the alarms.

[0090] The present invention also provides a specific embodiment, which differs from the above embodiment in that: the relevant time information includes a spatiotemporal stability score.

[0091] Furthermore, the preset spatiotemporal stability determination condition is that the spatiotemporal stability score is not less than the preset spatiotemporal stability threshold.

[0092] Specifically, the preset spatiotemporal stability threshold ranges from 0.7 to 1; those skilled in the art will know that the specific value of the preset spatiotemporal stability threshold is set by those skilled in the art according to actual needs, for example: 0.75, 0.8, which will not be elaborated here.

[0093] Specifically, the e-th ASN triple V in the AS_PATH mapping table e The corresponding spatiotemporal stability score F e Meets the following conditions: ; ; 1 ≤ e ≤ f, where f is the number of ASN triples in the AS_PATH mapping table; K be For the b-th historical time period L b Chinese V e Spatial stability score; 1≤b≤h, where h is the number of historical time periods; W b For L b The weights of Q; be For L b V was detected in the middle e The number of globally distributed monitoring nodes; p is the preset number of nodes; L b-1 Earlier than L b W b-1 <W b L b-1 For the (b-1)th historical time period, W b-1 For L b-1 The weight.

[0094] Specifically, when the AS_PATH attribute value in the BGP route advertisement obtained by the globally distributed monitoring nodes includes V e1 V e2 and V e3 And V e1 With V e2 Adjacent to and located in V e2 Left side, V e3 With V e2 Adjacent to and located in V e2 On the right, it is confirmed that the globally distributed monitoring node has detected V. e , where V e =(V e1 V e2 V e3 Ve1 For V e The first ASN, V e2 For V e The second ASN, V e3 It is the 3rd ASN in V.

[0095] Specifically, p < f.

[0096] Specifically, W b Meets the following conditions: W b =2 b / 3 ×b.

[0097] Specifically, W b Used to represent L b The importance of W is determined by the fact that data from historical periods closer to the current time point better highlight recent trends; therefore, setting W... b =2 b / 3 ×b, where, if h=7, when b=1, W b When W ≈1.26 and b=2, b When b=3, W ≈3.18 b When ≈6, b=4, W b When W ≈10.08 and b=5, b When W ≈15.85 and b=6, b When =24 and b=7, W b ≈35.28, to ensure that recent observations have a greater impact.

[0098] Specifically, L b-1 The end time and L b The start time points are consistent; L b The start time point and L b The time interval between the end times is consistent with the fixed time interval; L h The end time point is the time point of the most recent update of the routing spatiotemporal stability database; L h This refers to the h-th historical time period.

[0099] Specifically, the value of h is set by those skilled in the art according to actual needs, such as 168 or 720, which will not be elaborated here.

[0100] Through the above steps, based on the number of globally distributed monitoring nodes that detected the ASN triplet in each historical time period and the weight of each historical time period, the spatiotemporal stability score corresponding to the ASN triplet is comprehensively calculated. Historical time periods closer to the current time are assigned higher weights. The more globally distributed monitoring nodes that detected the ASN triplet, the stronger the consistency of the ASN triplet in the spatial dimension. The more recent the historical time period in which the ASN triplet was detected, the higher the activity of the ASN triplet in the temporal dimension. Therefore, the larger the spatiotemporal stability score, the stronger the stability of the corresponding ASN triplet in the spatiotemporal dimension. Furthermore, when the spatiotemporal stability score is not less than a preset spatiotemporal stability threshold, it indicates that the ASN triplet corresponding to the spatiotemporal stability score is stable in the spatiotemporal dimension, is reliable, and belongs to a stable and reliable normal routing path segment. By comparing the spatiotemporal stability score with the preset spatiotemporal stability threshold, highly stable normal routing paths and abnormal routing paths can be effectively distinguished, thus providing a reliable basis for high-precision path hijacking detection.

[0101] Specifically, the y-th IP prefix U in the IP prefix mapping table y The corresponding spatiotemporal stability score Z y Meets the following conditions: ; ; 1 ≤ y ≤ q, where q is the number of IP prefixes in the IP prefix mapping table; R by For L b Middle U y Spatial stability score; H by For L b U was detected in China y The number of globally distributed monitoring nodes corresponding to the target route announcement; U y The corresponding target route advertisement is the last ASN and U in the attribute value of AS_PATH. y The BGP route advertisement with the same ASN.

[0102] Through the above steps, based on the number of globally distributed monitoring nodes that detected the target route advertisement corresponding to the IP prefix within each historical time period and the weight of each historical time period, the spatiotemporal stability score corresponding to the IP prefix is ​​comprehensively calculated. Historical time periods closer to the current time are assigned higher weights. A larger number of globally distributed monitoring nodes that detected the target route advertisement corresponding to the IP prefix indicates stronger spatial consistency between the IP prefix and the declared combination of the autonomous system corresponding to its ASN. A more recent historical time period for detecting the target route advertisement corresponding to the IP prefix indicates stronger consistency between the IP prefix and the autonomous system corresponding to its ASN. The higher the activity of the declaration combination composed of the system in the time dimension, the larger the spatiotemporal stability score, indicating that the declaration combination composed of its corresponding IP prefix and the autonomous system corresponding to the ASN of that IP prefix is ​​more stable in the spatiotemporal dimension. Furthermore, when the spatiotemporal stability score is not less than the preset spatiotemporal stability threshold, it means that the declaration made by the IP prefix corresponding to the spatiotemporal stability score by its corresponding origin autonomous system is stable in the spatiotemporal dimension and belongs to normal declaration. By comparing the spatiotemporal stability score with the preset spatiotemporal stability threshold, legitimate stable routes and potential hijacking behavior can be effectively distinguished, providing a reliable basis for high-precision prefix hijacking detection.

[0103] The present invention also provides a specific embodiment, which differs from the above embodiment in that the following steps are included after step S2: S01, Traverse B3, when B 3j When the autonomous domain relationships between the three ASNs in the diagram violate the valley-free principle, then B... 3j As the key triplet corresponding to A; B 3j Let be the j-th ASN triplet in B3, 1≤j≤m, where m is the number of ASN triplets in B3.

[0104] In one specific embodiment, autonomous domain relationships are business interconnection relationships between autonomous systems, including: P2C (Provider-to-Customer), C2P (Customer-to-Provider), P2P (Peer-to-Peer), and S2S (Sibling-to-Sibling).

[0105] Specifically, the valley-free rule states that an AS path must not contain a "P2C followed by C2P" relationship sequence, as this constitutes a "valley" that violates business logic; for example: if B 3j1 The corresponding autonomous system and B 3j2 The corresponding autonomous domain relationship between autonomous systems is P2C, B3j2 The corresponding autonomous system and B 3j3 The corresponding autonomous domain relationship between autonomous systems is C2P, thus, B 3j1 B 3j2 and B 3j3 The corresponding autonomous systems' autonomous domain relationships form a P2C→C2P relationship sequence, indicating that the routing path first goes down to the customer and then up to another supplier, forming a valley, which violates the valley-free principle; among them, B 3j1 For B 3j The first ASN, B 3j2 For B 3j The second ASN, B 3j3 For B 3j The third ASN in the series.

[0106] S02. When the AS_PATH mapping table in the routing spatiotemporal stability database includes all the key triples corresponding to A, if there are key triples whose corresponding time information does not meet the preset spatiotemporal stability judgment conditions, then it is determined that A has a route leak.

[0107] Specifically, step S02 also includes: If the AS_PATH mapping table in the routing spatiotemporal stability database does not fully include all the key triples corresponding to A, it is determined that A has a routing leak.

[0108] Specifically, step S02 also includes: When the AS_PATH mapping table in the routing spatiotemporal stability database includes all the key triples corresponding to A, if the relevant time information corresponding to all key triples meets the preset spatiotemporal stability judgment conditions, then it is determined that A does not have routing leakage.

[0109] Through the above steps, for each ASN triplet in the ASN triplet list corresponding to A, if the autonomous system relationship between the three ASNs in the ASN triplet violates the valley-free principle, then the ASN triplet is designated as the critical triplet corresponding to A. Subsequently, a comprehensive judgment is made in conjunction with the routing spatiotemporal stability database: if the AS_PATH mapping table in the routing spatiotemporal stability database includes all critical triplets corresponding to A, and if there are critical triplets whose corresponding time information does not meet the preset spatiotemporal stability judgment conditions, then A is determined to have a route leak; if the AS_PATH mapping table in the routing spatiotemporal stability database does not completely include all critical triplets corresponding to A, then A is determined to have a route leak; if the AS_PATH mapping table in the routing spatiotemporal stability database includes A, then A is determined to have a route leak. If all key triples correspond to a given key triple and the relevant time information of all key triples meets the preset spatiotemporal stability judgment condition, then it is determined that A does not have a route leakage. Specifically, when the relevant time information of a key triple meets the preset spatiotemporal stability judgment condition, it indicates that the key triple is stable in the spatiotemporal dimension and is trustworthy. Therefore, even if it violates the valley-free principle, it is considered a long-term legitimate routing behavior. By integrating the valley-free principle and spatiotemporal stability assessment, high-precision detection of BGP route leakage is achieved. This fully considers the "theoretically illegal but actually stable" paths caused by the complexity of business strategies, undisclosed peer relationships, or historical configurations in actual Internet operation. This avoids misjudging such truly existing stable declarations as leaks, improving the detection accuracy of route leakage.

[0110] Embodiments of the present invention also provide a non-transitory computer-readable storage medium that can be disposed in an electronic device to store a computer program related to implementing a method in the method embodiments, the computer program being loaded and executed by the processor to implement the method provided in the above embodiments.

[0111] Embodiments of the present invention also provide an electronic device, including: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method provided in the above embodiments.

[0112] Embodiments of the present invention also provide a computer program product including program code, which, when the program product is run on an electronic device, causes the electronic device to perform the steps of the methods described above in various exemplary embodiments of the present invention.

[0113] While specific embodiments of the invention have been described in detail by way of examples, those skilled in the art should understand that the examples are for illustrative purposes only and are not intended to limit the scope of the invention. Those skilled in the art should also understand that various modifications can be made to the embodiments without departing from the scope and spirit of the invention.

Claims

1. A method for detecting route hijacking in BGP routing, characterized in that, The method includes the following steps: S1. Based on BGP route advertisement data obtained from globally distributed monitoring nodes, a route spatiotemporal stability database is constructed and periodically updated at fixed time intervals. The route spatiotemporal stability database includes an IP prefix mapping table and an AS_PATH mapping table. The IP prefix mapping table includes several IP prefixes, the ASN corresponding to each IP prefix, and the relevant time information corresponding to each IP prefix. The AS_PATH mapping table includes several ASN triples and the relevant time information corresponding to each ASN triple. The relevant time information includes the first occurrence time, the most recent occurrence time, and the cumulative occurrence duration. The ASN triples are obtained by performing a sliding window operation with a length of 3 and a step size of 1 on the attribute values ​​of AS_PATH. S2. When a BGP route advertisement A is received, A is parsed to obtain the specific information set B={B1, B2, B3} corresponding to A; B1 is the IP prefix corresponding to A, B2 is the ASN corresponding to B1; B3 is a list of ASN triples obtained based on the attribute value of AS_PATH corresponding to A, and the list of ASN triples includes several ASN triples. S3. When B1 is included in the IP prefix mapping table, if the ASN corresponding to B1 in the IP prefix mapping table is inconsistent with B2, or if the relevant time information corresponding to B1 does not meet the preset spatiotemporal stability judgment condition, then it is determined that A has prefix hijacking. S4. When the AS_PATH mapping table includes all ASN triples in B3, if there are ASN triples in B3 whose corresponding time information does not meet the preset spatiotemporal stability judgment conditions, then it is determined that A has path hijacking.

2. The route hijacking detection method for BGP routing according to claim 1, characterized in that, The preset criteria for determining spatiotemporal stability are either meeting the first criterion or meeting the second criterion. The first determination condition is: LT≥t1, where LT is the cumulative occurrence duration and t1 is the first preset duration; The second determination condition is: t2≤△t1≤t3, LT≥t4 and △t2≤△t; t2 is the second preset duration, △t1 is the interval duration between the first occurrence time and the most recent occurrence time, t3 is the third preset duration, t4 is the fourth preset duration, △t2 is the interval duration between the most recent occurrence time and the current time, and △t is the preset interval duration; where t3<t1; t4<△t1; △t<t2.

3. The route hijacking detection method for BGP routing according to claim 1, characterized in that, Step S3 further includes: when the IP prefix mapping table includes B1, if the ASN corresponding to B1 in the IP prefix mapping table is consistent with B2, and the relevant time information corresponding to B1 meets the preset spatiotemporal stability judgment condition, then it is determined that A does not have prefix hijacking.

4. The route hijacking detection method for BGP routing according to claim 1, characterized in that, Step S4 also includes: when the AS_PATH mapping table includes all ASN triples in B3, if the relevant time information corresponding to all ASN triples in B3 meets the preset spatiotemporal stability judgment condition, then it is determined that A does not have path hijacking.

5. The route hijacking detection method for BGP routing according to claim 1, characterized in that, The AS_PATH attribute value is an ordered list of autonomous system numbers of type AS_SEQUENCE, including ASN1, ASN2, ..., ASN. i ..., ASN n ;ASN i Let ASN be the i-th autonomous system number in the ordered list of autonomous system numbers, where 1 ≤ i ≤ n, and n is the number of autonomous system numbers in the ordered list of autonomous system numbers. n The corresponding autonomous system is the origin autonomous system.

6. The route hijacking detection method for BGP routing according to claim 5, characterized in that, The ASN corresponding to the IP prefix is ​​the Autonomous System Number corresponding to the origin Autonomous System in the attribute value of the AS_PATH corresponding to the IP prefix; whereby the attribute value of the IP prefix and its corresponding AS_PATH comes from the same BGP route advertisement.

7. The route hijacking detection method for BGP routing according to claim 1, characterized in that, The difference between the number of Autonomous System Numbers in the AS_PATH attribute value corresponding to A and the number of ASN triples in B3 is 2.

8. The route hijacking detection method for BGP routing according to claim 1, characterized in that, The fixed time interval is 1 hour.

9. A non-transitory computer-readable storage medium, characterized in that, The storage medium stores a computer program, which is loaded and executed by a processor to implement the route hijacking detection method for BGP routing as described in any one of claims 1-8.

10. An electronic device, comprising: A processor, a memory, and a computer program stored in the memory and executable on the processor, characterized in that, when the processor executes the computer program, it implements the route hijacking detection method for BGP routing as described in any one of claims 1-8.

Images