BGP anomalous route identification method and apparatus, device and medium

Abstract

Disclosed in the present application are a BGP anomalous route identification method and apparatus, a device and a medium. The method comprises: acquiring from a border router of each AS a plurality of pieces of network traffic data and a plurality of route update messages whose AS paths have a target AS as the origin AS within a current time period; on the basis of route announcement data or route withdrawal data of each route update message, determining an anomalous IP prefix and a normal IP prefix of the target AS; on the basis of a destination IP address of each piece of network traffic data, the anomalous IP prefix and the normal IP prefix, determining indicator data of the anomalous IP prefix and indicator data of the normal IP prefix within the current time period; on the basis of the indicator data of the anomalous IP prefix and the indicator data of the normal IP prefix within the current time period, determining a degree of anomaly impact; and, on the basis of the degree of anomaly impact and a set threshold, determining whether an anomalous route is present in the target AS within the current time period. The method can improve the accuracy of identifying BGP anomalous routes.

Description

A method, apparatus, device, and medium for identifying abnormal BGP routes.

[0001] Cross-reference to related applications

[0002] This application claims priority to Chinese Patent Application No. 202411629851.2, filed on November 14, 2024, entitled "A BGP Abnormal Route Identification Method, Apparatus, Device and Medium", the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application relates to the field of network information security, and in particular to a method, apparatus, device and medium for identifying abnormal BGP routes. Background Technology

[0004] In the vast network architectures of carriers, the Border Gateway Protocol (BGP) is not only a key protocol for achieving route reachability and optimal routing between Autonomous Systems (AS), but its security is also the cornerstone for ensuring the stable operation of the entire Internet and the secure transmission of data. With the rapid development of network technology, the security issues of the BGP protocol have gradually become prominent, becoming a focus of attention for carriers and network security experts.

[0005] The BGP protocol exchanges routing information through the Transmission Control Protocol (TCP). While this mechanism ensures the reliability of data transmission, it also exposes BGP to the risk of exploitation by malicious attackers. Attackers may forge BGP update messages to inject false routing information into the network, misleading legitimate traffic to maliciously controlled paths, thereby carrying out attacks such as route hijacking, data theft, and service disruption. Furthermore, the leakage of BGP paths may also expose the network topology, providing attackers with targets and strategies for their attacks.

[0006] Currently, control plane signaling exchanged via the BGP protocol, specifically route update messages, is typically used for identifying abnormal routes. However, due to the extreme complexity of network configuration, relying solely on these control plane messages for abnormal route identification results in low accuracy. Summary of the Invention

[0007] This application provides a method, apparatus, device, and medium for identifying abnormal BGP routes, in order to improve the accuracy of identifying abnormal BGP routes.

[0008] In a first aspect, embodiments of this application provide a BGP abnormal route identification method, including:

[0009] Obtain multiple network traffic data within the current time period from the boundary routers of each Autonomous System (AS), as well as multiple route update messages with the source AS as the destination AS along the AS path;

[0010] Based on the route advertisement data or route withdrawal data of each route update message, determine the abnormal Internet Protocol (IP) prefix and normal IP prefix of the target AS;

[0011] Based on the destination IP address of each network traffic data and the abnormal IP prefix, determine the indicator data of the abnormal IP prefix in the current time period; and based on the destination IP address of each network traffic data and the normal IP prefix, determine the indicator data of the normal IP prefix in the current time period.

[0012] Based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the normal IP prefix in the current time period, the abnormal impact degree of the abnormal IP prefix is ​​determined, wherein the abnormal impact degree is used to characterize the degree of impact of the abnormal IP prefix on network traffic in the current time period.

[0013] The abnormal impact level is compared with a set threshold, and based on the comparison result, it is determined whether there is abnormal routing in the target AS within the current time period.

[0014] In this embodiment, multiple network traffic data points within the current time period and multiple route update messages with the source AS as the target AS are obtained from the border routers of each AS. Based on the route advertisement data or route withdrawal data of each route update message, the abnormal IP prefix and normal IP prefix of the target AS are determined to improve the accuracy of identifying abnormal and normal IP prefixes of the target AS. Furthermore, based on the destination IP address, abnormal IP prefix, and normal IP prefix of each network traffic data point, this application determines the indicator data of the abnormal IP prefix and the indicator data of the normal IP prefix within the current time period. Based on the indicator data of the abnormal IP prefix and the indicator data of the normal IP prefix within the current time period, the abnormal impact degree of the abnormal IP prefix is ​​determined, thereby more accurately characterizing the degree of impact of the abnormal IP prefix on network traffic within the current time period. This application compares the abnormal impact degree with a set threshold and determines whether there are abnormal routes in the target AS within the current time period based on the comparison results, improving the accuracy of identifying abnormal BGP routes and reducing the cost of manual intervention.

[0015] In one possible design, determining the abnormal and normal IP prefixes of the target AS based on the route advertisement data or route withdrawal data of each route update message includes:

[0016] The announcement time of each route advertisement data belonging to the same IP prefix and the withdrawal time of each route withdrawal data are sorted from earliest to latest to determine the interruption period of each IP prefix;

[0017] Based on the interruption time period of each IP prefix belonging to the target AS, determine the number of IP prefixes in the target AS that are in an interrupted state within each sub-time period of the current time period, wherein the current time period includes multiple sub-time periods;

[0018] The outage rate of the target AS in each sub-time period is determined based on the number of IP prefixes in the target AS that are in an outage state and the total number of IP prefixes in the target AS.

[0019] For each sub-time period, if the interruption rate of the target AS within the sub-time period is greater than a set probability threshold, then the IP prefixes in the target AS that are in an interrupted state within the sub-time period are taken as the abnormal IP prefixes, and the IP prefixes in the target AS that are not interrupted within the sub-time period are taken as the normal IP prefixes.

[0020] In this application embodiment, the interruption period of each IP prefix is ​​determined based on the announcement time of each route advertisement data belonging to the same IP prefix and the withdrawal time of each route withdrawal data, to reflect the interruption status of each IP prefix. Furthermore, based on the interruption period of each IP prefix belonging to the target AS, the number of IP prefixes in the target AS that are in an interrupted state within each sub-period of the current time period is determined. Therefore, based on the number of IP prefixes in the target AS that are in an interrupted state within each sub-period and the total number of IP prefixes in the target AS, the interruption rate of the target AS within each sub-period is determined, to reflect the interruption degree of the target AS within each sub-period. This application determines the abnormal and normal IP prefixes of the target AS based on the interruption rate of the target AS within each sub-period and a set probability threshold, improving the accuracy of identifying abnormal and normal IP prefixes of the target AS.

[0021] In one possible design, determining the abnormal and normal IP prefixes of the target AS based on the route advertisement data or route withdrawal data of each route update message includes:

[0022] Based on the target AS and the established correspondence, the registered IP prefixes of the target AS are determined, wherein the correspondence is the correspondence between each AS and each registered IP prefix;

[0023] For the IP prefix of the route advertisement data or route withdrawal data of each route update message, if the IP prefix does not exist in the registered IP prefixes of the target AS, and the AS path of the route advertisement data or route withdrawal data of the route update message does not satisfy the set AS business relationship, then the IP prefix is ​​determined to be the abnormal IP prefix.

[0024] If the IP prefix exists in the registered IP prefixes of the target AS, or if the IP prefix does not exist in the registered IP prefixes of the target AS, and the AS path of the route advertisement data or route withdrawal data of the route update message satisfies the set AS business relationship, then the IP prefix is ​​determined to be the normal IP prefix.

[0025] In this embodiment, based on the target AS and the set correspondence, the registered IP prefix of the target AS is determined. For the IP prefix of the route advertisement data or route withdrawal data of each route update message, based on whether there is an IP prefix among the registered IP prefixes of the target AS, and whether the AS path of the route update message meets the set AS business relationship, it is determined whether the IP prefix is ​​a hijacked IP prefix, that is, the abnormal IP prefix and normal IP prefix of the target AS are determined, thereby improving the accuracy of identifying the abnormal IP prefix and normal IP prefix of the target AS.

[0026] In one possible design, determining the indicator data of the abnormal IP prefix within the current time period based on the destination IP address of each network traffic data and the abnormal IP prefix includes:

[0027] Based on the destination IP address of each network traffic data and the abnormal IP prefix, determine the network traffic data corresponding to the abnormal IP prefix in the current time period;

[0028] Based on the network traffic data corresponding to the abnormal IP prefix within the current time period, determine the index value of at least one set traffic index for the abnormal IP prefix.

[0029] Based on the value of at least one set traffic metric of the abnormal IP prefix, determine the metric data of the abnormal IP prefix within the current time period.

[0030] In this embodiment of the application, based on the destination IP address and abnormal IP prefix of each network traffic data, the network traffic data corresponding to the abnormal IP prefix in the current time period is determined. Based on the network traffic data corresponding to the abnormal IP prefix in the current time period, the index value of at least one set traffic index of the abnormal IP prefix is ​​determined, thereby obtaining the index data of the abnormal IP prefix in the current time period and improving the accuracy of the index data of the abnormal IP prefix in the current time period.

[0031] In one possible design, determining the indicator data of the normal IP prefix within the current time period based on the destination IP address of each network traffic data and the normal IP prefix includes:

[0032] Based on the destination IP address of each network traffic data and the normal IP prefix, determine the network traffic data corresponding to the normal IP prefix in the current time period;

[0033] Based on the network traffic data corresponding to the normal IP prefix within the current time period, determine the index value of at least one set traffic index for the normal IP prefix.

[0034] Based on the indicator value of at least one set traffic indicator of the normal IP prefix, determine the indicator data of the normal IP prefix within the current time period.

[0035] In this embodiment of the application, based on the destination IP address and normal IP prefix of each network traffic data, the network traffic data corresponding to the normal IP prefix in the current time period is determined. Based on the network traffic data corresponding to the normal IP prefix in the current time period, the index value of at least one set traffic index of the normal IP prefix is ​​determined, thereby obtaining the index data of the normal IP prefix in the current time period and improving the accuracy of the index data of the normal IP prefix in the current time period.

[0036] In one possible design, determining the abnormal impact of the abnormal IP prefix based on the indicator data of the abnormal IP prefix within the current time period and the indicator data of the normal IP prefix within the current time period includes:

[0037] Based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the abnormal IP prefix in the historical time period, the first abnormal impact degree is determined.

[0038] Based on the indicator data of the abnormal IP prefix in the current time period, the indicator data of the normal IP prefix in the current time period, the indicator data of the abnormal IP prefix in the historical time period, and the indicator data of the normal IP prefix in the historical time period, the second abnormal impact degree is determined.

[0039] The abnormality impact is determined based on the first abnormality impact, the second abnormality impact, and their respective weights.

[0040] In this embodiment, a first degree of anomaly is determined based on the indicator data of abnormal IP prefixes in the current time period and the indicator data of abnormal IP prefixes in historical time periods. This degree characterizes the change in the indicator data of abnormal IP prefixes in historical time periods and the indicator data of abnormal IP prefixes in the current time period. Furthermore, a second degree of anomaly is determined based on the indicator data of abnormal IP prefixes in the current time period, the indicator data of normal IP prefixes in the current time period, the indicator data of abnormal IP prefixes in historical time periods, and the indicator data of normal IP prefixes in historical time periods. This degree characterizes the change in the correlation between network traffic of abnormal IP prefixes and normal IP prefixes in historical time periods and the correlation between network traffic of abnormal IP prefixes and normal IP prefixes in the current time period. This application determines the degree of anomaly based on the first degree of anomaly, the second degree of anomaly, and their respective weights, thereby more accurately characterizing the degree of influence of abnormal IP prefixes on network traffic in the current time period.

[0041] In one possible design, the first anomaly impact includes some or all of the following: traffic impact, connection success rate impact, and connection quantity impact:

[0042] If the first anomaly impact includes the traffic impact, the traffic impact is determined in the following way: based on the network traffic of the abnormal IP prefix in the current time period and the network traffic of the abnormal IP prefix in historical time periods, the traffic impact is determined;

[0043] If the first anomaly impact includes the connection success rate impact, the connection success rate impact is determined in the following way: based on the Transmission Control Protocol (TCP) connection success rate of the abnormal IP prefix in the current time period and the TCP connection success rate of the abnormal IP prefix in historical time periods, the connection success rate impact is determined.

[0044] If the first anomaly impact includes the connection quantity impact, the connection quantity impact is determined in the following way: based on the number of TCP connections of the abnormal IP prefix in the current time period and the number of TCP connections of the abnormal IP prefix in historical time periods, the connection quantity impact is determined.

[0045] In this embodiment of the application, since the first anomaly impact includes some or all of the traffic impact, connection success rate impact, and connection quantity impact, the traffic impact can be determined based on the network traffic of the abnormal IP prefix in the current time period and the network traffic of the abnormal IP prefix in the historical time period. The connection success rate impact can be determined based on the TCP connection success rate of the abnormal IP prefix in the current time period and the TCP connection success rate of the abnormal IP prefix in the historical time period. The connection quantity impact can be determined based on the number of TCP connections of the abnormal IP prefix in the current time period and the number of TCP connections of the abnormal IP prefix in the historical time period, thereby improving the accuracy of the determined first anomaly impact.

[0046] In one possible design, determining the second anomaly impact based on the indicator data of the abnormal IP prefixes within the current time period, the indicator data of the normal IP prefixes within the current time period, the indicator data of the abnormal IP prefixes within historical time periods, and the indicator data of the normal IP prefixes within historical time periods includes:

[0047] Based on the network traffic of the abnormal IP prefixes within M historical time periods and the network traffic of the normal IP prefixes within M historical time periods, a first correlation degree is determined, where M is a positive integer greater than 1. The first correlation degree is used to characterize the degree of correlation between the network traffic of the abnormal IP prefixes and the normal IP prefixes within the historical time periods.

[0048] Based on the network traffic of the abnormal IP prefix in the current time period, the network traffic of the normal IP prefix in the current time period, the network traffic of the abnormal IP prefix in M-1 historical time periods, and the network traffic of the normal IP prefix in M-1 historical time periods, a second correlation is determined. The second correlation is used to characterize the degree of correlation between the network traffic of the abnormal IP prefix and the normal IP prefix in the current time period.

[0049] The second anomaly impact degree is determined based on the first correlation and the second correlation.

[0050] In this embodiment, a first correlation is determined based on the network traffic of abnormal IP prefixes within M historical time periods and the network traffic of normal IP prefixes within M historical time periods to characterize the correlation between the network traffic of abnormal IP prefixes and normal IP prefixes within the historical time periods. A second correlation is determined based on the network traffic of abnormal IP prefixes within the current time period, the network traffic of normal IP prefixes within the current time period, the network traffic of abnormal IP prefixes within M-1 historical time periods, and the network traffic of normal IP prefixes within M-1 historical time periods to characterize the correlation between the network traffic of abnormal IP prefixes and normal IP prefixes within the current time period. Furthermore, a second abnormality impact is determined based on the first and second correlations to more accurately characterize the changes in correlation between the historical time periods and the current time period.

[0051] In one possible design, determining whether there are abnormal routes in the target AS within the current time period based on the comparison results includes:

[0052] If the abnormal impact is greater than or equal to the set threshold, then it is determined that there is an abnormal route in the target AS during the current time period.

[0053] If the degree of abnormal impact is less than the set threshold, it is determined that there are no abnormal routes in the target AS during the current time period.

[0054] In this embodiment of the application, based on the degree of abnormal impact and a set threshold, it is determined whether there are abnormal routes in the target AS within the current time period, thereby improving the accuracy of identifying abnormal BGP routes and reducing the cost of manual intervention.

[0055] Secondly, embodiments of this application provide a BGP abnormal route identification device, comprising:

[0056] The acquisition module is used to acquire multiple network traffic data within the current time period from the border routers of each Autonomous System (AS), as well as multiple route update messages with the source AS as the destination AS in the AS path.

[0057] The first determining module is used to determine the abnormal Internet Protocol (IP) prefix and normal IP prefix of the target AS based on the route advertisement data or route withdrawal data of each route update message;

[0058] The second determining module is used to determine the indicator data of the abnormal IP prefix in the current time period based on the destination IP address of each network traffic data and the abnormal IP prefix; and to determine the indicator data of the normal IP prefix in the current time period based on the destination IP address of each network traffic data and the normal IP prefix.

[0059] The third determining module is used to determine the abnormal impact degree of the abnormal IP prefix based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the normal IP prefix in the current time period, wherein the abnormal impact degree is used to characterize the degree of impact of the abnormal IP prefix on network traffic in the current time period.

[0060] The comparison module is used to compare the anomaly impact degree with a set threshold, and determine whether there is an abnormal route in the target AS within the current time period based on the comparison result.

[0061] Thirdly, this application provides an electronic device, comprising:

[0062] Memory, used to store program instructions;

[0063] A processor is configured to invoke program instructions stored in the memory and execute the steps of the method described in any one of the first aspects according to the obtained program instructions.

[0064] Fourthly, this application provides a computer-readable storage medium storing a computer program, the computer program including program instructions, which, when executed by a computer, cause the computer to perform the method described in any one of the first aspects.

[0065] Fifthly, this application provides a computer program product comprising: computer program code, which, when run on a computer, causes the computer to perform the method described in any one of the first aspects.

[0066] The technical effects of aspects two through five and any one of their designs can be found in the technical effects of the corresponding designs in aspect one, and will not be repeated here. Attached Figure Description

[0067] Figure 1 is a schematic diagram of the application scenario provided in the embodiments of this application;

[0068] Figure 2 is a flowchart of a BGP abnormal route identification method provided in an embodiment of this application;

[0069] Figure 3 is a detailed flowchart of a BGP abnormal route identification method provided in an embodiment of this application;

[0070] Figure 4 is a flowchart of a method for determining indicator data of abnormal IP prefixes within the current time period provided in an embodiment of this application;

[0071] Figure 5 is a flowchart of a method for determining the index data of normal IP prefixes within the current time period provided in an embodiment of this application;

[0072] Figure 6 is a flowchart of a method for determining abnormal IP prefixes and normal IP prefixes of a target AS according to an embodiment of this application;

[0073] Figure 7 is a flowchart of another method for determining the abnormal IP prefix and normal IP prefix of a target AS provided in an embodiment of this application;

[0074] Figure 8 is a flowchart of a method for determining the anomalous impact of an abnormal IP prefix provided in an embodiment of this application;

[0075] Figure 9 is a flowchart of a method for determining the second anomaly influence degree provided in an embodiment of this application;

[0076] Figure 10 is a schematic diagram of a BGP abnormal route identification device provided in an embodiment of this application;

[0077] Figure 11 is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0078] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. Unless otherwise specified, the embodiments and features in the embodiments of this application can be arbitrarily combined with each other. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than that shown here.

[0079] The terms "first" and "second" in the specification, claims, and accompanying drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the term "comprising" and any variations thereof are intended to cover non-exclusive protection. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices. The term "multiple" in this application can mean at least two, for example, two, three, or more, and the embodiments of this application do not impose limitations.

[0080] The data collection, dissemination, and use in this application all comply with relevant national laws and regulations.

[0081] Before introducing the BGP abnormal route identification method provided in the embodiments of this application, the technical background of the embodiments of this application will be described in detail below for ease of understanding.

[0082] In the vast network architectures of carriers, BGP is not only a key protocol for achieving inter-AS routing reachability and optimal routing, but its security is also the cornerstone for ensuring the stable operation of the entire Internet and secure data transmission. With the rapid development of network technology, the security issues of the BGP protocol have gradually become prominent, becoming a focus of attention for carriers and network security experts.

[0083] The BGP protocol exchanges routing information via TCP. While this mechanism ensures reliable data transmission, it also exposes BGP to the risk of exploitation by malicious attackers. Attackers may forge BGP update messages to inject false routing information into the network, misleading legitimate traffic into maliciously controlled paths, thereby carrying out attacks such as route hijacking, data theft, and service disruption. Furthermore, the leakage of BGP paths may expose the network topology, providing attackers with targets and strategies for their attacks.

[0084] Currently, BGP anomaly route identification methods typically utilize control plane signaling exchanged by the BGP protocol, i.e., route update messages, for anomaly route identification. However, due to the extreme complexity of network configuration, it is unknown whether route changes, when identified solely through these control plane messages, actually affect data transmission on the data plane. Furthermore, capturing real-world routing anomaly events is extremely difficult, relying primarily on publicly reported major events for acquisition and labeling, resulting in a very limited number of such events. Consequently, BGP anomaly route identification methods cannot be sufficiently validated based on real-world routing anomaly events, leading to low accuracy in identifying BGP anomaly routes.

[0085] To address the aforementioned problems, this application proposes a method, apparatus, device, and medium for identifying abnormal BGP routes, thereby improving the accuracy of identifying abnormal BGP routes.

[0086] Referring first to Figure 1, which is a schematic diagram of an application scenario according to an embodiment of this application, it includes three AS11s and a server 12. Each AS11 may include one or more routers 111 and border routers 112. Border routers 112 may also be referred to as BGP routers. Within each AS11, border routers 112 and other routers 111 implement the routing policy of the AS11 and maintain connectivity with border routers 112 in adjacent AS11s. AS11s share routing information with other AS11s by exchanging routing messages between border routers 112 using BGP. Routing information can be shared within or between AS11s by establishing connections from border routers 112 to one of their BGP peers to exchange BGP updates. The process of exchanging data between border routers 112 is called "peering." In a peering session, two networks directly connect and exchange data. An internal BGP peering session involves directly connecting border routers 112 and internal routers 111 within a single AS11, or connecting only internal routers 111. External BGP peering sessions involve directly connecting border routers 112 in adjacent AS11s. Border routers 112 can exchange route update messages. Server 12 connects to the border routers 112 of each AS11, obtains network traffic data and route update messages for AS paths originating from AS11 within the current time period, and determines whether there are any abnormal routes in the target AS11 within the current time period based on the network traffic data and route update messages.

[0087] In this embodiment of the application, as an optional implementation, server 12 obtains multiple network traffic data within the current time period from the border router 112 of each AS11, as well as multiple route update messages whose source AS is the target AS11 in the AS path; based on the route advertisement data or route withdrawal data of each route update message, it determines the abnormal IP prefix and normal IP prefix of the target AS11; based on the destination IP address and abnormal IP prefix of each network traffic data, it determines the indicator data of the abnormal IP prefix within the current time period; and based on the destination IP address and normal IP prefix of each network traffic data, it determines the indicator data of the normal IP prefix within the current time period; based on the indicator data of the abnormal IP prefix and the indicator data of the normal IP prefix within the current time period, it determines the abnormal impact degree of the abnormal IP prefix, wherein the abnormal impact degree is used to characterize the degree of influence of the abnormal IP prefix on network traffic within the current time period; it compares the abnormal impact degree with a set threshold, and determines whether there is an abnormal route in the target AS11 within the current time period based on the comparison result.

[0088] The technical solution provided in this application embodiment will be described below with reference to Figure 2, which shows a flowchart of a BGP abnormal route identification method:

[0089] Step 201: Obtain multiple network traffic data within the current time period from the border routers of each AS, as well as multiple route update messages with the source AS as the destination AS in the AS path.

[0090] The current time period can be set according to actual conditions. For example, the current time period is 10 seconds. An AS (Internet Service Provider) refers to the entirety of all IP (Internet Protocol) segments and routers under the jurisdiction of one or more entities, which implement a common routing policy for the Internet. In addition to their IP address attributes, IP segments can also have physical location attributes and ISP attributes. The Internet is composed of many independently developed ASs; governments, Internet Service Providers (ISPs), universities, and enterprises can all operate their own ASs. Each AS is assigned a globally unique number, called the AS number. ASs share routing information through the BGP (Border Gateway Protocol): each AS is responsible for advertising its IP prefix to neighboring ASs, spreading it globally to the Internet, enabling communication between any two globally routable IP prefixes on the Internet.

[0091] In this embodiment of the application, multiple routing update messages with the source AS as the destination AS of the AS path are obtained from the border router of each AS. This includes: for each AS, collecting routing update messages sent by the border router of the AS where the monitoring probe is located to external ASs within the current time period, and collecting routing update messages sent by other ASs received by the border router of the AS where the monitoring probe is located within the current time period; and determining multiple routing update messages with the source AS as the destination AS of the AS path from the collected routing update messages.

[0092] In this embodiment, based on the update type, routing update messages are divided into announce and withdraw types. An announce type routing update message indicates that the border router has received routing announcement data for a specific IP prefix. The announce type routing update message includes routing announcement data, which includes information such as the AS path, IP prefix, and announcement time. A withdraw type routing update message indicates that the border router has received routing withdrawal data for a specific IP prefix. The withdraw type routing update message includes routing withdrawal data, which includes information such as the AS path, IP prefix, and withdrawal time.

[0093] The AS path (AS_PATH) includes the AS numbers corresponding to each AS traversed by the BGP route. The AS numbers recorded in the AS path are arranged sequentially according to the order of the ASs traversed from the local AS to the source AS (Origin AS). The rightmost AS number in the AS path represents the Origin AS number in the BGP route, and the remaining AS numbers represent the AS numbers corresponding to the ASs traversed by the BGP route. For example, if the AS path of a BGP route is 100, 200, 300, it means that the BGP route originates from AS300 and is forwarded through AS200 and AS100 in sequence. AS300 is the source AS.

[0094] The IP prefix is ​​a user-specified IP prefix, such as the IP prefix that needs to be monitored in real time; it can also be any one of the IP prefixes in the target AS.

[0095] Step 202: Based on the route advertisement data or route withdrawal data of each route update message, determine the abnormal IP prefix and normal IP prefix of the target AS.

[0096] The target AS includes multiple IP prefixes.

[0097] Step 203: Based on the destination IP address and abnormal IP prefix of each network traffic data, determine the indicator data of abnormal IP prefixes in the current time period, and based on the destination IP address and normal IP prefix of each network traffic data, determine the indicator data of normal IP prefixes in the current time period.

[0098] Network traffic data includes information such as source IP address, destination IP address, source port, destination port, and transport protocol. Metric data includes TCP connection success rate, number of TCP connections, and network traffic.

[0099] Step 204: Based on the indicator data of abnormal IP prefixes in the current time period and the indicator data of normal IP prefixes in the current time period, determine the degree of abnormal impact of abnormal IP prefixes.

[0100] Among them, the anomaly impact degree is used to characterize the degree of impact of abnormal IP prefixes on network traffic in the current time period.

[0101] Step 205: Compare the abnormal impact level with the set threshold, and determine whether there are abnormal routes in the target AS within the current time period based on the comparison result.

[0102] The threshold can be set according to the actual situation.

[0103] Optionally, based on the comparison results, determine whether there are abnormal routes in the target AS within the current time period, including:

[0104] If the impact of the anomaly is greater than or equal to the set threshold, it is determined that there is an abnormal route in the target AS within the current time period.

[0105] If the impact of the anomaly is less than the set threshold, it is determined that there are no abnormal routes in the target AS within the current time period.

[0106] In this embodiment, multiple network traffic data points within the current time period and multiple route update messages with the source AS as the target AS are obtained from the border routers of each AS. Based on the route advertisement data or route withdrawal data of each route update message, the abnormal IP prefix and normal IP prefix of the target AS are determined to improve the accuracy of identifying abnormal and normal IP prefixes of the target AS. Furthermore, based on the destination IP address, abnormal IP prefix, and normal IP prefix of each network traffic data point, this application determines the indicator data of the abnormal IP prefix and the indicator data of the normal IP prefix within the current time period. Based on the indicator data of the abnormal IP prefix and the indicator data of the normal IP prefix within the current time period, the abnormal impact degree of the abnormal IP prefix is ​​determined, thereby more accurately characterizing the degree of impact of the abnormal IP prefix on network traffic within the current time period. This application compares the abnormal impact degree with a set threshold and determines whether there are abnormal routes in the target AS within the current time period based on the comparison results, improving the accuracy of identifying abnormal BGP routes and reducing the cost of manual intervention.

[0107] The specific steps of the BGP abnormal route identification method provided above will be explained in detail below, as shown in Figure 3:

[0108] Step 301: Obtain multiple network traffic data within the current time period from the border routers of each AS, as well as multiple route update messages with the source AS as the destination AS in the AS path.

[0109] In this embodiment, different data sources may have different time records and time zones, so it is necessary to align their data record times. NTP (Network Time Protocol) access can be performed on the border router that collects routing update messages and the border router that collects network traffic data. The timestamps of the multiple data sources are flattened according to their clock differences to ensure that network traffic data and routing update messages of the same time period are collected.

[0110] Step 302: Based on the route advertisement data or route withdrawal data of each route update message, determine the abnormal IP prefix and normal IP prefix of the target AS.

[0111] In this embodiment, the abnormal and normal IP prefixes of a target AS caused by a route interruption event can be determined based on the route advertisement data or route withdrawal data of each route update message; similarly, the abnormal and normal IP prefixes of a target AS caused by a route hijacking event can be determined based on the route advertisement data or route withdrawal data of each route update message. The target AS includes multiple IP prefixes, and the number of abnormal IP prefixes in the target AS can be one or more. The number of normal IP prefixes in the target AS can also be one or more. For example, if the target AS includes three IP prefixes, namely IP prefix 1, IP prefix 2, and IP prefix 3, if IP prefix 1 is an abnormal IP prefix, then IP prefix 2 and IP prefix 3 are normal IP prefixes. If IP prefix 1 and IP prefix 2 are abnormal IP prefixes, then IP prefix 3 is a normal IP prefix.

[0112] In this embodiment, route hijacking refers to an AS announcing false BGP routes, that is, an AS announcing IP prefixes that do not belong to itself, hijacking network traffic, causing Internet service interruption or data theft. Route interruption refers to an AS losing almost all its routes within a period of time, resulting in its unreachability, such as through active cancellation or link failure.

[0113] Step 303: Based on the destination IP address and abnormal IP prefix of each network traffic data, determine the indicator data of abnormal IP prefixes in the current time period.

[0114] Figure 4 is a flowchart of a method for determining indicator data of abnormal IP prefixes within the current time period provided by an embodiment of this application. As shown in Figure 4, step 303 above includes at least the following steps 401-403:

[0115] Step 401: Based on the destination IP address and abnormal IP prefix of each network traffic data, determine the network traffic data corresponding to the abnormal IP prefix in the current time period.

[0116] In this embodiment, the IP prefix represents the set of network addresses published by the target AS. Unless otherwise specified, in this embodiment, the IP prefix is ​​represented by the IP address plus a mask number of bits, i.e.:

[0117] ABCD / X

[0118] Where ABCD represents the IP address, and X represents the number of bits in the mask. For example, the IP prefix 10.10.0.0 / 16 represents all network addresses from 10.10.10.0.0 to 10.10.255.255; 10.10.10.0 / 24 represents all network addresses from 10.10.10.0 to 10.10.10.255.

[0119] For example, if the abnormal IP prefix is ​​10.10.0.0 / 16, the destination IP address of the first network traffic data is 10.10.10.0.0, the destination IP address of the second network traffic data is 10.10.11.0.0, and the destination IP address of the third network traffic data is 10.10.10.0.1, then the destination IP addresses of the first and third network traffic data belong to the abnormal IP prefix, while the destination IP address of the second network traffic data does not belong to the abnormal IP prefix. Therefore, the network traffic data corresponding to the abnormal IP prefix are the first and third network traffic data.

[0120] Step 402: Based on the network traffic data corresponding to the abnormal IP prefixes within the current time period, determine the value of at least one set traffic indicator for the abnormal IP prefixes.

[0121] Among them, traffic metrics can be set as TCP connection success rate, network traffic, number of TCP connections, etc.

[0122] In this embodiment, the TCP connection success rate metric for abnormal IP prefixes can be determined based on the TCP_FLAG (TCP flag) in the network traffic data corresponding to the abnormal IP prefixes within the current time period. The TCP_FLAG is used to indicate a specific state during a TCP session.

[0123] Step 403: Based on the indicator value of at least one set traffic indicator for the abnormal IP prefix, determine the indicator data of the abnormal IP prefix in the current time period.

[0124] Step 304: Based on the destination IP address and normal IP prefix of each network traffic data, determine the indicator data of the normal IP prefix within the current time period.

[0125] Figure 5 is a flowchart of a method for determining the index data of normal IP prefixes within the current time period provided by an embodiment of this application. As shown in Figure 5, step 304 above includes at least the following steps 501-503:

[0126] Step 501: Based on the destination IP address and normal IP prefix of each network traffic data, determine the network traffic data corresponding to the normal IP prefix in the current time period.

[0127] Step 502: Based on the network traffic data corresponding to the normal IP prefix within the current time period, determine the indicator value of at least one set traffic indicator for the normal IP prefix.

[0128] Step 503: Based on the indicator value of at least one set traffic indicator for normal IP prefixes, determine the indicator data for normal IP prefixes within the current time period.

[0129] Since the method for determining the indicator data of normal IP prefixes in the current time period is the same as the method for determining the indicator data of abnormal IP prefixes in the current time period, the specific implementation process for determining the indicator data of normal IP prefixes in the current time period can be found in the above-mentioned specific implementation process for determining the indicator data of abnormal IP prefixes in the current time period, and will not be elaborated here.

[0130] Step 305: Based on the indicator data of abnormal IP prefixes in the current time period and the indicator data of normal IP prefixes in the current time period, determine the degree of abnormal impact of abnormal IP prefixes.

[0131] Specifically, based on the indicator data of abnormal IP prefixes within the current time period and the indicator data of normal IP prefixes within the current time period, the degree of abnormal impact of abnormal IP prefixes is determined, including:

[0132] Based on the indicator data of abnormal IP prefixes in the current time period, the indicator data of normal IP prefixes in the current time period, the indicator data of abnormal IP prefixes in historical time periods, and the indicator data of normal IP prefixes in historical time periods, the abnormal impact of abnormal IP prefixes is determined.

[0133] Among them, the anomaly impact degree is used to characterize the degree of impact of abnormal IP prefixes on network traffic in the current time period.

[0134] Step 306: Determine whether the abnormal impact is greater than or equal to the set threshold. If yes, proceed to step 307; otherwise, proceed to step 308.

[0135] Step 307: Determine if there are abnormal routes in the target AS within the current time period.

[0136] Step 308: Determine that there are no abnormal routes in the target AS within the current time period.

[0137] In this embodiment, abnormal routes for each AS are identified based on routing update messages and network traffic data within the current time period, and abnormal routing event information is recorded. This abnormal routing event information includes event information, impact information, and anomaly impact. Event information includes the attacker AS, victim AS, anomaly type, start and end times, and abnormal IP prefix. Impact information includes traffic impact, connection success rate impact, connection quantity impact, and secondary anomaly impact. The abnormal routing event information is added to a routing event database. After a period of accumulation, once a certain scale is reached, it can be directly applied to the training and validation of current BGP abnormal routing identification methods, addressing the need for comparison between different methods and continuous iterative improvement of performance.

[0138] In this embodiment of the application, based on the route advertisement data or route withdrawal data of each route update message, the abnormal IP prefix and normal IP prefix of the target AS caused by the route interruption event are determined. Figure 6 is a flowchart of a method for determining the abnormal IP prefix and normal IP prefix of a target AS provided in this embodiment of the application. As shown in Figure 6, the above step 302 includes at least the following steps 601-604:

[0139] Step 601: Sort the announcement time of each route announcement data belonging to the same IP prefix and the withdrawal time of each route withdrawal data from early to late to determine the interruption period of each IP prefix.

[0140] The interruption period of the IP prefix refers to the period during which the IP prefix is ​​in an interrupted state from the time the IP prefix is ​​withdrawn until the time the IP prefix is ​​announced.

[0141] For example, the withdrawal time of IP prefix 1 is 2024-03-03 22:08:10, and the announcement time of IP prefix 1 is 2024-03-03 22:08:12. Therefore, the interruption period of IP prefix 1 is from 22:08:10 to 22:08:12.

[0142] Below are examples of route advertisement data and route withdrawal data for the IP prefix 1.0.204.0 / 24 of AS23969:

[0143] "1.0.204.0 / 24":{ / / IP prefix

[0144] “country”:[“A”], / / IP prefix belongs to country A

[0145] "as":["23969"], / / IP prefix belongs to AS23969

[0146] “paths”:{

[0147] “2914 38040 23969”:{ / / AS path

[0148] “n_appearance”:1,

[0149] “n_announces”:3,

[0150] “announce_events”:{ / / announce_events}

[0151] “23969”:[

[0152] "2024-03-03 22:07:43",

[0153] "2024-03-03 22:08:12",

[0154] "2024-03-03 22:08:13"]}}, / / Announcement time

[0155] “6939 38040 23969”:{ / / AS path

[0156] “n_appearance”:0,

[0157] “n_announces”:1,

[0158] “announce_events”:{ / / announce_events}

[0159] “23969”:[

[0160] "2024-03-03 22:08:12"]}}}, / / Announcement time

[0161] "withdraw_events":["2024-03-03 22:08:10"],} / / Withdraw_events

[0162] As shown above, the IP prefix 1.0.204.0 / 24 of AS23969 corresponds to 4 route advertisement data entries and 1 route withdrawal data entry. The first route advertisement data entry includes the IP prefix 1.0.204.0 / 24, the advertisement time 2024-03-03 22:07:43, and the AS path 2914 38040 23969. The second route advertisement data entry includes the IP prefix 1.0.204.0 / 24, the advertisement time 2024-03-03 22:08:12, and the AS path 2914 38040 23969. The third route advertisement data entry includes the IP prefix 1.0.204.0 / 24, the advertisement time 2024-03-03 22:08:13, and the AS path 2914 3804023969. The fourth route announcement data includes the IP prefix 1.0.204.0 / 24, the announcement time 2024-03-03 22:08:12, and the AS path 693938040 23969. The route withdrawal data includes the IP prefix 1.0.204.0 / 24, the withdrawal time 2024-03-03 22:08:10, and the AS paths 693938040 23969 and 2914 38040 23969. Since this IP prefix was withdrawn at 2024-03-03 22:08:10 and announced at 2024-03-03 22:08:12, the interruption period for this IP prefix is ​​from 2024-03-03 22:08:10 to 2024-03-03 22:08:12.

[0163] Step 602: Based on the interruption time period of each IP prefix belonging to the target AS, determine the number of IP prefixes in the target AS that are in an interrupted state within each sub-time period of the current time period.

[0164] Within the same AS, at least one IP prefix is ​​included. The current time period includes multiple sub-time periods. The number of sub-time periods can be set according to actual needs. For example, the current time period can include 10 sub-time periods. The duration of each sub-time period can be set according to actual needs; that is, the durations of each sub-time period can be the same, different, or some sub-time periods can have the same duration.

[0165] For example, the target AS includes three IP prefixes: IP prefix 1, IP prefix 2, and IP prefix 3. The set time period is from 1:00:00 to 1:01:00. The set time period is divided into four sub-time periods: sub-time period 1 is from 1:00:00 to 1:00:15, sub-time period 2 is from 1:00:15 to 1:00:30, sub-time period 3 is from 1:00:30 to 1:00:45, and sub-time period 4 is from 1:00:45 to 1:01:00. If the interruption period for IP prefix 1 is from 1:00:15 to 1:00:30, the interruption period for IP prefix 2 is from 1:00:15 to 1:00:45, and the interruption period for IP prefix 3 is from 1:00:00 to 1:00:30, then the number of IP prefixes in the target AS that are in an interrupted state in sub-time period 1 is determined to be 1, the number of IP prefixes in the target AS that are in an interrupted state in sub-time period 2 is 3, the number of IP prefixes in the target AS that are in an interrupted state in sub-time period 3 is 1, and the number of IP prefixes in the target AS that are in an interrupted state in sub-time period 4 is 0.

[0166] Step 603: Determine the outage rate of the target AS in each sub-time period based on the number of IP prefixes in the target AS that are in an outage state and the total number of IP prefixes in the target AS.

[0167] Specifically, for each sub-time period, the outage rate of the target AS is determined based on the ratio of the number of IP prefixes in the target AS that are in an outage state to the total number of IP prefixes in the target AS within the sub-time period.

[0168] Alternatively, the interruption rate p of the target AS in the j-th sub-time period can be determined using the following formula. j :

[0169] Among them, a j Let be the number of IP prefixes in the target AS that are in an interrupted state during the j-th sub-time period, and let a be the total number of IP prefixes in the target AS.

[0170] For example, a target AS includes four IP prefixes: IP prefix 1, IP prefix 2, IP prefix 3, and IP prefix 4. If IP prefix 1, IP prefix 2, and IP prefix 3 are in an interrupted state in a certain sub-time period, then the number of IP prefixes in an interrupted state in the target AS in that sub-time period is determined to be 3. Therefore, the interruption rate of the target AS in that sub-time period is 3 / 4 = 0.75.

[0171] Step 604: For each sub-time period, if the interruption rate of the target AS in the sub-time period is greater than the set probability threshold, then the IP prefixes in the target AS that are in an interrupted state in the sub-time period are regarded as abnormal IP prefixes, and the IP prefixes in the target AS that are not interrupted in the sub-time period are regarded as normal IP prefixes.

[0172] The probability threshold can be set according to the actual situation; for example, the probability threshold can be set to 0.9.

[0173] For example, the set time period includes sub-time period 1, sub-time period 2, sub-time period 3, and sub-time period 4. If the set probability threshold is 0.7, the interruption rate of the target AS in sub-time period 1 is 0.25, the interruption rate of the target AS in sub-time period 2 is 0.75, the interruption rate of the target AS in sub-time period 3 is 0.5, and the interruption rate of the target AS in sub-time period 4 is 0. Then, it is determined that the interruption rate of the target AS in sub-time period 2 (0.75) is greater than the set probability threshold of 0.7. The IP prefixes in the target AS in the interrupted state in sub-time period 2 are regarded as abnormal IP prefixes, and the IP prefixes in the target AS in the uninterrupted state in sub-time period 2 are regarded as normal IP prefixes.

[0174] Optionally, based on the route advertisement data or route withdrawal data of each route update message, the abnormal IP prefix and normal IP prefix of the target AS caused by the route hijacking event are determined. Figure 7 is a flowchart of another method for determining the abnormal IP prefix and normal IP prefix of the target AS provided in an embodiment of this application. As shown in Figure 7, the above step 302 includes at least the following steps 701-703:

[0175] Step 701: Based on the target AS and the set correspondence, determine the registered IP prefix of the target AS.

[0176] The correspondence is between each AS and each registered IP prefix.

[0177] Step 702: For the IP prefix of the route advertisement data or route withdrawal data of each route update message, if there is no IP prefix among the registered IP prefixes of the target AS, and the AS path of the route advertisement data or route withdrawal data of the route update message does not meet the set AS business relationship, then the IP prefix is ​​determined to be an abnormal IP prefix.

[0178] If the target AS does not have an IP prefix among its registered IP prefixes, the target AS will be marked as MOAS (Multi-Source AS), indicating that the IP prefix is ​​an IP prefix created by the target AS. However, since multiple creations may also be a sign of malicious activity or operator error, it is necessary to determine whether the IP prefix is ​​an abnormal IP prefix based on the AS path and the established AS business relationship.

[0179] In this embodiment, the connections between ASs are determined by the economic and technical business contracts that define traffic exchange, i.e., the so-called commercial relationships between ASs. AS commercial relationships can include customer-to-provider (C2P), peer-to-peer (P2P), sibling-to-sibling (S2S), and hybrid relationships. The AS path indicates the AS path traversed during the transmission of a route update message. Based on the AS path, the ASs that the BGP route passes through sequentially during transmission can be determined. Specifically, route update messages must satisfy the valley-free principle during transmission. The valley-free principle specifies the conditions that the commercial relationships traversed by the route update message during transmission must meet. For example, routes from customers can be sent to operators, customers, and peers; routes from peers or operators can only be sent to customers.

[0180] Step 703: If the target AS has an IP prefix among its registered IP prefixes, or if the target AS does not have an IP prefix among its registered IP prefixes, and the AS path of the route advertisement data or route withdrawal data in the route update message satisfies the set AS business relationship, then the IP prefix is ​​determined to be a normal IP prefix.

[0181] Below is an example of a route update message for AS65003:

[0182] "103.94.12.0 / 22":{ / / IP prefix

[0183] “n_hijacks”:1, / / Number of hijacks

[0184] “asn”:[

[0185] "131578"], / / Hijacked AS

[0186] "hijacks":{ / / hijacking

[0187] "65003":{ / / Hijacking AS

[0188] “23724 4847 131578 650003”:[ / / AS path

[0189] [

[0190] "2024-03-01 00:01:57",

[0191] [2024-03-01 00:01:58] / / Announcement time

[0192] ]}},

[0193] "valleyfree":{ / / valleyfree principle}

[0194] “131578”:{

[0195] "23724 4847 131578":false},

[0196] “650003”:{

[0197] "23724 4847 131578 650003":false}}}

[0198] As shown above, AS65003 corresponds to two route advertisement data. The first route advertisement data includes the IP prefix 103.94.12.0 / 22, the advertisement time 2024-03-01 00:01:57, and the AS path 23724 4847 131578 650003. The second route advertisement data includes the IP prefix 103.94.12.0 / 22, the advertisement time 2024-03-01 00:01:58, and the AS path 23724 4847 131578 650003. Since the IP prefix belongs to AS131578 and not to AS65003, and the AS path 23724 4847 131578 650003 does not meet the set AS business relationship, it is determined that AS65003 has hijacked an IP prefix belonging to AS131578, that is, the IP prefix is ​​an abnormal IP prefix.

[0199] In this embodiment, after determining the abnormal and normal IP prefixes of the target AS, abnormal routing events are recorded. The abnormal types of these events include route hijacking events and route interruption events. The main recorded fields for a route hijacking event include: the victim AS (i.e., the hijacked AS), the attacker AS, the hijacked IP prefix (the routing prefix corresponding to the victim AS), the detected IP prefix (the IP prefix initiated by the attacker AS), the abnormality type, and the event start and end times. In a route hijacking event, the attacker AS typically initiates a routing prefix identical to that of the victim AS, or a sub-prefix of the victim AS, to hijack the victim AS's network traffic. The main recorded fields for a route interruption event include the interrupted AS, the affected IP prefixes, the abnormality type, and the event start and end times. Assuming an AS advertises 10 IP prefixes, if 9 of these IP prefixes are revoked, the affected IP prefixes for that AS are the revoked IP prefixes.

[0200] In this embodiment of the application, the abnormal impact of abnormal IP prefixes is determined based on the indicator data of abnormal IP prefixes within the current time period and the indicator data of normal IP prefixes within the current time period. Figure 8 is a flowchart of a method for determining the abnormal impact of abnormal IP prefixes provided in this embodiment of the application. As shown in Figure 8, step 305 above includes at least the following steps 801-803:

[0201] Step 801: Determine the first degree of impact of abnormal IP prefixes based on the indicator data of abnormal IP prefixes in the current time period and the indicator data of abnormal IP prefixes in the historical time periods.

[0202] The current time period is adjacent to the historical time period. For example, the current time period is 2:00:00-2:00:10, and the historical time period is 1:59:50-2:00:00. The first anomaly impact includes some or all of the impact of traffic, connection success rate, and connection quantity.

[0203] If the first anomaly impact includes traffic impact, the traffic impact is determined as follows: based on the network traffic of the abnormal IP prefix in the current time period and the network traffic of the abnormal IP prefix in historical time periods, the traffic impact is determined.

[0204] Optionally, the traffic impact is determined based on the network traffic of abnormal IP prefixes in the current time period and the network traffic of abnormal IP prefixes in historical time periods, including:

[0205] Calculate the network traffic of abnormal IP prefixes in the current time period and the first difference between the network traffic of abnormal IP prefixes in the historical time period; use the ratio of the first difference to the network traffic of abnormal IP prefixes in the historical time period as the traffic impact degree.

[0206] Among them, the network traffic of abnormal IP prefixes in the current time period is the average network traffic of abnormal IP prefixes in the current time period, and the network traffic of abnormal IP prefixes in the historical time period is the average network traffic of abnormal IP prefixes in the historical time period.

[0207] Optionally, the traffic impact T of the anomalous IP prefix can be determined using the following formula:

[0208] Among them, Y M+1 Y represents the network traffic with abnormal IP prefixes during the (M+1)th time period. M This represents the network traffic with abnormal IP prefixes during the Mth time period.

[0209] If the first anomaly impact includes the connection success rate impact, the connection success rate impact is determined as follows: based on the TCP connection success rate of the abnormal IP prefix in the current time period and the TCP connection success rate of the abnormal IP prefix in historical time periods, the connection success rate impact is determined.

[0210] Optionally, the impact of connection success rate can be determined based on the TCP connection success rate of abnormal IP prefixes in the current time period and the TCP connection success rate of abnormal IP prefixes in historical time periods, including:

[0211] Calculate the TCP connection success rate of abnormal IP prefixes in the current time period and the second difference between the TCP connection success rate of abnormal IP prefixes in the historical time period; use the ratio of the second difference to the TCP connection success rate of abnormal IP prefixes in the historical time period as the connection success rate influence.

[0212] Among them, the TCP connection success rate of abnormal IP prefixes in the current time period is the average TCP connection success rate of abnormal IP prefixes in the current time period, and the TCP connection success rate of abnormal IP prefixes in the historical time period is the average TCP connection success rate of abnormal IP prefixes in the historical time period.

[0213] Optionally, the traffic impact F of the anomalous IP prefix can be determined using the following formula:

[0214] Among them, F M+1 F represents the TCP connection success rate for abnormal IP prefixes within the (M+1)th time period. M This represents the TCP connection success rate for abnormal IP prefixes within the Mth time period.

[0215] If the first anomaly impact includes the connection quantity impact, the connection quantity impact is determined as follows: based on the number of TCP connections with abnormal IP prefixes in the current time period and the number of TCP connections with abnormal IP prefixes in historical time periods, the connection quantity impact is determined.

[0216] Optionally, the impact of connection count is determined based on the number of TCP connections with abnormal IP prefixes in the current time period and the number of TCP connections with abnormal IP prefixes in historical time periods, including:

[0217] Calculate the third difference between the number of TCP connections for abnormal IP prefixes in the current time period and the number of TCP connections for abnormal IP prefixes in historical time periods; use the ratio of the third difference to the number of TCP connections for abnormal IP prefixes in historical time periods as the connection quantity impact.

[0218] The number of TCP connections for abnormal IP prefixes in the current time period is the average number of TCP connections for abnormal IP prefixes in the current time period, and the number of TCP connections for abnormal IP prefixes in the historical time period is the average number of TCP connections for abnormal IP prefixes in the historical time period.

[0219] Optionally, the traffic impact G of the anomalous IP prefix can be determined using the following formula:

[0220] Among them, G M+1 G represents the number of TCP connections with abnormal IP prefixes during the (M+1)th time period. M This represents the number of TCP connections with abnormal IP prefixes within the Mth time period.

[0221] Step 802: Based on the indicator data of abnormal IP prefixes in the current time period, the indicator data of normal IP prefixes in the current time period, the indicator data of abnormal IP prefixes in historical time periods, and the indicator data of normal IP prefixes in historical time periods, determine the second abnormality impact degree.

[0222] Specifically, based on the indicator data of abnormal IP prefixes in the current time period, the indicator data of normal IP prefixes in the current time period, the indicator data of abnormal IP prefixes in M ​​historical time periods, and the indicator data of normal IP prefixes in M ​​historical time periods, a second abnormality impact degree is determined, where M is a positive integer greater than 1. Figure 9 is a flowchart of a method for determining the second abnormality impact degree provided by an embodiment of this application. As shown in Figure 9, it includes at least the following steps 901-903:

[0223] Step 901: Determine the first relevance based on the network traffic of abnormal IP prefixes within M historical time periods and the network traffic of normal IP prefixes within M historical time periods.

[0224] The first correlation is used to characterize the correlation between network traffic with abnormal IP prefixes and normal IP prefixes within a historical time period.

[0225] Alternatively, the first relevance r1 can be calculated using the following formula:

[0226] Among them, X i For network traffic with abnormal IP prefixes during the i-th time period, Y represents the average network traffic of abnormal IP prefixes over M time periods. i For the network traffic with normal IP prefixes during the i-th time period, Let i be the average network traffic of normal IP prefixes over M time periods, where i ranges from [1, M] and M is a positive integer greater than 1. The abnormal IP prefixes can be determined based on the network traffic within M time periods and the number of time periods M. It can be determined based on the network traffic of normal IP prefixes within M time periods and the number of time periods M.

[0227] Step 902: Determine the second relevance based on the network traffic of abnormal IP prefixes in the current time period, the network traffic of normal IP prefixes in the current time period, the network traffic of abnormal IP prefixes in M-1 historical time periods, and the network traffic of normal IP prefixes in M-1 historical time periods.

[0228] The second correlation is used to characterize the degree of correlation between network traffic with abnormal IP prefixes and normal IP prefixes within the current time period.

[0229] Alternatively, the second relevance r2 can be calculated using the following formula:

[0230] Among them, X i For network traffic with abnormal IP prefixes during the i-th time period, Y represents the average network traffic of abnormal IP prefixes over M time periods, specifically the average network traffic of abnormal IP prefixes in the current time period and the average network traffic of abnormal IP prefixes over M-1 historical time periods. i For the network traffic with normal IP prefixes during the i-th time period, This represents the average network traffic of normal IP prefixes over M time periods, specifically the average network traffic of normal IP prefixes in the current time period and the average network traffic of normal IP prefixes over M-1 historical time periods. The value of i ranges from [2, M+1], where M is a positive integer greater than 1. The number of time periods (M) can be determined based on the network traffic of abnormal IP prefixes in the current time period, the network traffic of abnormal IP prefixes in M-1 historical time periods, and the number of time periods (M). It can be determined based on the network traffic of normal IP prefixes in the current time period, the network traffic of normal IP prefixes in M-1 historical time periods, and the number of time periods M.

[0231] Step 903: Determine the second anomaly impact degree based on the first and second relevance degrees.

[0232] Optionally, a second anomalous influence degree is determined based on the first relevance degree and the second relevance degree, including: using the ratio between the second relevance degree and the first relevance degree as the second anomalous influence degree.

[0233] Alternatively, the second anomaly impact R can be calculated using the following formula:

[0234] Where r1 is the first relevance and r2 is the second relevance.

[0235] Step 803: Determine the degree of abnormality based on the first degree of abnormality, the second degree of abnormality, and their respective weights.

[0236] The weights corresponding to the first and second anomaly impacts can be set according to actual circumstances. In this embodiment, since some larger anomaly impacts indicate a greater degree of anomaly, and some smaller anomaly impacts indicate a greater degree of anomaly, it is necessary to make isotropic adjustments to the first and second anomaly impacts to ensure that larger anomaly impacts indicate a greater degree of anomaly.

[0237] In this embodiment of the application, if the first abnormality impact degree includes traffic impact degree, connection success rate impact degree and connection quantity impact degree, the abnormality impact degree S of the abnormal IP prefix can be determined by the following formula: S=ω1*T+ω2*F+ω3*G+ω4*R;

[0238] Where T is the impact of traffic, F is the impact of connection success rate, G is the impact of number of connections, R is the impact of the second anomaly, ω1 is the weight corresponding to the impact of traffic, ω2 is the weight corresponding to the impact of connection success rate, ω3 is the weight corresponding to the impact of number of connections, and ω4 is the weight corresponding to the impact of the second anomaly.

[0239] Based on the same technical concept, this application provides an exemplary BGP abnormal route identification device, as shown in Figure 10. The device includes:

[0240] The acquisition module 101 is used to acquire multiple network traffic data within the current time period from the border routers of each Autonomous System (AS), as well as multiple route update messages with the source AS as the destination AS in the AS path.

[0241] The first determining module 102 is used to determine the abnormal Internet Protocol (IP) prefix and normal IP prefix of the target AS based on the route advertisement data or route withdrawal data of each route update message.

[0242] The second determining module 103 is used to determine the indicator data of the abnormal IP prefix in the current time period based on the destination IP address of each network traffic data and the abnormal IP prefix; and to determine the indicator data of the normal IP prefix in the current time period based on the destination IP address of each network traffic data and the normal IP prefix.

[0243] The third determining module 104 is used to determine the abnormal impact degree of the abnormal IP prefix based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the normal IP prefix in the current time period, wherein the abnormal impact degree is used to characterize the degree of impact of the abnormal IP prefix on network traffic in the current time period.

[0244] The comparison module 105 is used to compare the abnormal impact degree with a set threshold, and determine whether there is an abnormal route in the target AS within the current time period based on the comparison result.

[0245] Optionally, the first determining module 102 is used to:

[0246] The announcement time of each route advertisement data belonging to the same IP prefix and the withdrawal time of each route withdrawal data are sorted from earliest to latest to determine the interruption period of each IP prefix;

[0247] Based on the interruption time period of each IP prefix belonging to the target AS, determine the number of IP prefixes in the target AS that are in an interrupted state within each sub-time period of the current time period, wherein the current time period includes multiple sub-time periods;

[0248] The outage rate of the target AS in each sub-time period is determined based on the number of IP prefixes in the target AS that are in an outage state and the total number of IP prefixes in the target AS.

[0249] For each sub-time period, if the interruption rate of the target AS within the sub-time period is greater than a set probability threshold, then the IP prefixes in the target AS that are in an interrupted state within the sub-time period are taken as the abnormal IP prefixes, and the IP prefixes in the target AS that are not interrupted within the sub-time period are taken as the normal IP prefixes.

[0250] Optionally, the first determining module 102 is used to:

[0251] Based on the target AS and the established correspondence, the registered IP prefixes of the target AS are determined, wherein the correspondence is the correspondence between each AS and each registered IP prefix;

[0252] For the IP prefix of the route advertisement data or route withdrawal data of each route update message, if the IP prefix does not exist in the registered IP prefixes of the target AS, and the AS path of the route advertisement data or route withdrawal data of the route update message does not satisfy the set AS business relationship, then the IP prefix is ​​determined to be the abnormal IP prefix.

[0253] If the IP prefix exists in the registered IP prefixes of the target AS, or if the IP prefix does not exist in the registered IP prefixes of the target AS, and the AS path of the route advertisement data or route withdrawal data of the route update message satisfies the set AS business relationship, then the IP prefix is ​​determined to be the normal IP prefix.

[0254] Optionally, the second determining module 103 is used to:

[0255] Based on the destination IP address of each network traffic data and the abnormal IP prefix, determine the network traffic data corresponding to the abnormal IP prefix in the current time period;

[0256] Based on the network traffic data corresponding to the abnormal IP prefix within the current time period, determine the index value of at least one set traffic index for the abnormal IP prefix.

[0257] Based on the value of at least one set traffic metric of the abnormal IP prefix, determine the metric data of the abnormal IP prefix within the current time period.

[0258] Optionally, the second determining module 103 is used to:

[0259] Based on the destination IP address of each network traffic data and the normal IP prefix, determine the network traffic data corresponding to the normal IP prefix in the current time period;

[0260] Based on the network traffic data corresponding to the normal IP prefix within the current time period, determine the index value of at least one set traffic index for the normal IP prefix.

[0261] Based on the indicator value of at least one set traffic indicator of the normal IP prefix, determine the indicator data of the normal IP prefix within the current time period.

[0262] Optionally, the third determining module 104 is used to:

[0263] Based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the abnormal IP prefix in the historical time period, the first abnormal impact degree is determined.

[0264] Based on the indicator data of the abnormal IP prefix in the current time period, the indicator data of the normal IP prefix in the current time period, the indicator data of the abnormal IP prefix in the historical time period, and the indicator data of the normal IP prefix in the historical time period, the second abnormal impact degree is determined.

[0265] The abnormality impact is determined based on the first abnormality impact, the second abnormality impact, and their respective weights.

[0266] Optionally, the first anomaly impact includes some or all of the traffic impact, connection success rate impact, and connection quantity impact, and the third determining module 104 is used to:

[0267] If the first anomaly impact includes the traffic impact, the traffic impact is determined in the following way: based on the network traffic of the abnormal IP prefix in the current time period and the network traffic of the abnormal IP prefix in historical time periods, the traffic impact is determined;

[0268] If the first anomaly impact includes the connection success rate impact, the connection success rate impact is determined in the following way: based on the Transmission Control Protocol (TCP) connection success rate of the abnormal IP prefix in the current time period and the TCP connection success rate of the abnormal IP prefix in historical time periods, the connection success rate impact is determined.

[0269] If the first anomaly impact includes the connection quantity impact, the connection quantity impact is determined in the following way: based on the number of TCP connections of the abnormal IP prefix in the current time period and the number of TCP connections of the abnormal IP prefix in historical time periods, the connection quantity impact is determined.

[0270] Optionally, the third determining module 104 is used to:

[0271] Based on the network traffic of the abnormal IP prefixes within M historical time periods and the network traffic of the normal IP prefixes within M historical time periods, a first correlation degree is determined, where M is a positive integer greater than 1. The first correlation degree is used to characterize the degree of correlation between the network traffic of the abnormal IP prefixes and the normal IP prefixes within the historical time periods.

[0272] Based on the network traffic of the abnormal IP prefix in the current time period, the network traffic of the normal IP prefix in the current time period, the network traffic of the abnormal IP prefix in M-1 historical time periods, and the network traffic of the normal IP prefix in M-1 historical time periods, a second correlation is determined. The second correlation is used to characterize the degree of correlation between the network traffic of the abnormal IP prefix and the normal IP prefix in the current time period.

[0273] The second anomaly impact degree is determined based on the first correlation and the second correlation.

[0274] Optionally, the comparison module 105 is used to:

[0275] If the abnormal impact is greater than or equal to the set threshold, then it is determined that there is an abnormal route in the target AS during the current time period.

[0276] If the degree of abnormal impact is less than the set threshold, it is determined that there are no abnormal routes in the target AS during the current time period.

[0277] Based on the same inventive concept, this application provides an electronic device that can realize the function of the BGP abnormal route identification device discussed above. Referring to FIG11, the device includes a processor 1111 and a memory 1112, wherein the memory 1112 is used to store program instructions.

[0278] The processor 1111 calls the program instructions stored in the memory, and executes the program instructions to achieve the following steps:

[0279] Obtain multiple network traffic data within the current time period from the boundary routers of each Autonomous System (AS), as well as multiple route update messages with the source AS as the destination AS along the AS path;

[0280] Based on the route advertisement data or route withdrawal data of each route update message, determine the abnormal Internet Protocol (IP) prefix and normal IP prefix of the target AS;

[0281] Based on the destination IP address of each network traffic data and the abnormal IP prefix, determine the indicator data of the abnormal IP prefix in the current time period; and based on the destination IP address of each network traffic data and the normal IP prefix, determine the indicator data of the normal IP prefix in the current time period.

[0282] Based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the normal IP prefix in the current time period, the abnormal impact degree of the abnormal IP prefix is ​​determined, wherein the abnormal impact degree is used to characterize the degree of impact of the abnormal IP prefix on network traffic in the current time period.

[0283] The abnormal impact level is compared with a set threshold, and based on the comparison result, it is determined whether there is abnormal routing in the target AS within the current time period.

[0284] The processor 1111 calls the program instructions stored in the memory and executes the program instructions to implement the BGP abnormal route identification method provided in the above embodiment.

[0285] Based on the same inventive concept, embodiments of this application provide a computer-readable storage medium. The computer program product includes computer program code, which, when executed on a computer, causes the computer to perform any of the BGP abnormal route identification methods discussed above. Since the principle by which the above-described computer-readable storage medium solves the problem is similar to that of the BGP abnormal route identification method, the implementation of the above-described computer-readable storage medium can be found in the implementation of the method; repeated details will not be elaborated further.

[0286] Based on the same inventive concept, this application also provides a computer program product, which includes computer program code. When the computer program code is run on a computer, it causes the computer to execute any of the BGP abnormal route identification methods discussed above. Since the principle of the above computer program product in solving the problem is similar to that of the BGP abnormal route identification method, the implementation of the above computer program product can refer to the implementation of the method, and repeated details will not be described again.

[0287] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0288] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in one or more blocks of the flowchart illustrations and / or one or more blocks of the block diagrams.

[0289] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0290] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of user-operated steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0291] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for identifying abnormal routes in Border Gateway Protocol (BGP), characterized in that, include: Obtain multiple network traffic data within the current time period from the boundary routers of each Autonomous System (AS), as well as multiple route update messages with the source AS as the destination AS along the AS path; Based on the route advertisement data or route withdrawal data of each route update message, determine the abnormal Internet Protocol (IP) prefix and normal IP prefix of the target AS; Based on the destination IP address of each network traffic data and the abnormal IP prefix, determine the indicator data of the abnormal IP prefix within the current time period; as well as Based on the destination IP address and the normal IP prefix of each network traffic data, determine the indicator data of the normal IP prefix within the current time period; Based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the normal IP prefix in the current time period, the abnormal impact degree of the abnormal IP prefix is ​​determined, wherein the abnormal impact degree is used to characterize the degree of impact of the abnormal IP prefix on network traffic in the current time period. The abnormal impact level is compared with a set threshold, and based on the comparison result, it is determined whether there is abnormal routing in the target AS within the current time period.

2. The method of claim 1, wherein, The determination of the abnormal and normal IP prefixes of the target AS based on the route advertisement data or route withdrawal data of each route update message includes: The announcement time of each route advertisement data belonging to the same IP prefix and the withdrawal time of each route withdrawal data are sorted from earliest to latest to determine the interruption period of each IP prefix; Based on the interruption time period of each IP prefix belonging to the target AS, determine the number of IP prefixes in the target AS that are in an interrupted state within each sub-time period of the current time period, wherein the current time period includes multiple sub-time periods; The outage rate of the target AS in each sub-time period is determined based on the number of IP prefixes in the target AS that are in an outage state and the total number of IP prefixes in the target AS. For each sub-time period, if the interruption rate of the target AS within the sub-time period is greater than a set probability threshold, then the IP prefixes in the target AS that are in an interrupted state within the sub-time period are taken as the abnormal IP prefixes, and the IP prefixes in the target AS that are not interrupted within the sub-time period are taken as the normal IP prefixes.

3. The method of claim 1, wherein, The determination of the abnormal and normal IP prefixes of the target AS based on the route advertisement data or route withdrawal data of each route update message includes: Based on the target AS and the established correspondence, the registered IP prefixes of the target AS are determined, wherein the correspondence is the correspondence between each AS and each registered IP prefix; For the IP prefix of the route advertisement data or route withdrawal data of each route update message, if the IP prefix does not exist in the registered IP prefixes of the target AS, and the AS path of the route advertisement data or route withdrawal data of the route update message does not satisfy the set AS business relationship, then the IP prefix is ​​determined to be the abnormal IP prefix. If the IP prefix exists in the registered IP prefixes of the target AS, or if the IP prefix does not exist in the registered IP prefixes of the target AS, and the AS path of the route advertisement data or route withdrawal data of the route update message satisfies the set AS business relationship, then the IP prefix is ​​determined to be the normal IP prefix.

4. The method of claim 1, wherein, The method of determining the indicator data of the abnormal IP prefix within the current time period based on the destination IP address of each network traffic data and the abnormal IP prefix includes: Based on the destination IP address of each network traffic data and the abnormal IP prefix, determine the network traffic data corresponding to the abnormal IP prefix in the current time period; Based on the network traffic data corresponding to the abnormal IP prefix within the current time period, determine the index value of at least one set traffic index for the abnormal IP prefix. Based on the value of at least one set traffic metric of the abnormal IP prefix, determine the metric data of the abnormal IP prefix within the current time period.

5. The method of claim 1, wherein, The determination of the indicator data for the normal IP prefix within the current time period based on the destination IP address of each network traffic data and the normal IP prefix includes: Based on the destination IP address of each network traffic data and the normal IP prefix, determine the network traffic data corresponding to the normal IP prefix in the current time period; Based on the network traffic data corresponding to the normal IP prefix within the current time period, determine the index value of at least one set traffic indicator for the normal IP prefix. Based on the indicator value of at least one set traffic indicator of the normal IP prefix, determine the indicator data of the normal IP prefix within the current time period.

6. The method of claim 1, wherein, The determination of the abnormal impact of the abnormal IP prefix based on the indicator data of the abnormal IP prefix within the current time period and the indicator data of the normal IP prefix within the current time period includes: Based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the abnormal IP prefix in the historical time period, the first abnormal impact degree is determined. Based on the indicator data of the abnormal IP prefix in the current time period, the indicator data of the normal IP prefix in the current time period, the indicator data of the abnormal IP prefix in the historical time period, and the indicator data of the normal IP prefix in the historical time period, the second abnormal impact degree is determined. The abnormality impact is determined based on the first abnormality impact, the second abnormality impact, and their respective weights.

7. The method of claim 6, wherein, The first anomaly impact includes some or all of the following: traffic impact, connection success rate impact, and connection quantity impact: If the first anomaly impact includes the traffic impact, the traffic impact is determined in the following way: based on the network traffic of the abnormal IP prefix in the current time period and the network traffic of the abnormal IP prefix in historical time periods, the traffic impact is determined; If the first anomaly impact includes the connection success rate impact, the connection success rate impact is determined in the following way: based on the Transmission Control Protocol (TCP) connection success rate of the abnormal IP prefix in the current time period and the TCP connection success rate of the abnormal IP prefix in historical time periods, the connection success rate impact is determined. If the first anomaly impact includes the connection quantity impact, the connection quantity impact is determined in the following way: based on the number of TCP connections of the abnormal IP prefix in the current time period and the number of TCP connections of the abnormal IP prefix in historical time periods, the connection quantity impact is determined.

8. The method of claim 6, wherein, The determination of the second abnormal impact degree based on the indicator data of the abnormal IP prefix in the current time period, the indicator data of the normal IP prefix in the current time period, the indicator data of the abnormal IP prefix in the historical time period, and the indicator data of the normal IP prefix in the historical time period includes: Based on the network traffic of the abnormal IP prefixes within M historical time periods and the network traffic of the normal IP prefixes within M historical time periods, a first correlation degree is determined, where M is a positive integer greater than 1. The first correlation degree is used to characterize the degree of correlation between the network traffic of the abnormal IP prefixes and the normal IP prefixes within the historical time periods. Based on the network traffic of the abnormal IP prefix in the current time period, the network traffic of the normal IP prefix in the current time period, the network traffic of the abnormal IP prefix in M-1 historical time periods, and the network traffic of the normal IP prefix in M-1 historical time periods, a second correlation is determined. The second correlation is used to characterize the degree of correlation between the network traffic of the abnormal IP prefix and the normal IP prefix in the current time period. The second anomaly impact degree is determined based on the first correlation and the second correlation.

9. The method according to any one of claims 1 to 8, characterized in that, The step of determining whether there are abnormal routes in the target AS within the current time period based on the comparison results includes: If the abnormal impact is greater than or equal to the set threshold, then it is determined that there is an abnormal route in the target AS during the current time period. If the degree of abnormal impact is less than the set threshold, it is determined that there are no abnormal routes in the target AS during the current time period.

10. A BGP anomaly routing identification apparatus characterized by comprising: include: The acquisition module is used to acquire multiple network traffic data within the current time period from the border routers of each Autonomous System (AS), as well as multiple route update messages with the source AS as the destination AS in the AS path. The first determining module is used to determine the abnormal Internet Protocol (IP) prefix and normal IP prefix of the target AS based on the route advertisement data or route withdrawal data of each route update message; The second determining module is used to determine the indicator data of the abnormal IP prefix within the current time period based on the destination IP address of each network traffic data and the abnormal IP prefix. as well as Based on the destination IP address and the normal IP prefix of each network traffic data, determine the indicator data of the normal IP prefix within the current time period; The third determining module is used to determine the abnormal impact degree of the abnormal IP prefix based on the indicator data of the abnormal IP prefix in the current time period and the indicator data of the normal IP prefix in the current time period, wherein the abnormal impact degree is used to characterize the degree of impact of the abnormal IP prefix on network traffic in the current time period. The comparison module is used to compare the anomaly impact degree with a set threshold, and determine whether there is an abnormal route in the target AS within the current time period based on the comparison result.

11. An electronic device, comprising: include: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the steps of the method according to any one of claims 1-9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, the computer program including program instructions that, when executed by a computer, cause the computer to perform the method as described in any one of claims 1-9.

13. A computer program product, characterised in that, The computer program product includes: computer program code, which, when run on a computer, causes the computer to perform the method described in any one of claims 1-9.

Images