The invention discloses an inter-domain routing message data
feature extraction method and device, and the method comprises the steps: loading a routing snapshot, updating a dump file, and constructing a global real-time
routing table, an autonomous
system routing prefix table and a routing prefix autonomous
system mapping table; establishing and updating an autonomous
system country mapping table based on AS number distribution data and
IP prefix country affiliation information, and excluding ASs of which registration places are inconsistent with operation places;
processing route update data in a bucket manner according to a
fixed time interval, and extracting
route change characteristics of a prefix level and an autonomous
system level; and aggregating to generate national
granularity features, constructing a national routing
topological graph, and extracting graph structure features such as node number and
diameter. Through a three-level
granularity feature extraction and hierarchical convergence strategy, cross-domain
noise is effectively isolated, feature stability and
interpretability are improved, accurate and hierarchical input features are provided for
machine learning detection of BGP abnormal events, and the method is suitable for routing anomaly monitoring and analysis in the network space security field.