Design And Implementation Of BGP Outage Events Detection System Based On Network Topology And Service Analysis

As an infrastructure of cyberspace,Border Gateway Protocol(BGP)is a basic protocol for network interconnection and plays an important role in the operation of the Internet.BGP outage events refers to the routing events that some IP prefixes become invisible when experiencing unexpected conditions such as equipment failure,network attack,misconfiguration,natural disaster and political factors,and then causes the upper application service outage.Disruptive BGP outage events may cause the unreachability of network services in national energy,banking,transportation,national defense industry and important national infrastructure,and seriously affect social economy and people’s life.Rapid detection of BGP outage events and evaluation of their impact are of great significance to cyberspace security defense.The existing BGP outage events detection methods mainly detect BGP outage events through the feature of the route change,lack the detection and analysis of the visible state of the route,and do not analyze the topological relationship among autonomous systems and the importance of network services to determine the impact of BGP outage events.This thesis proposes a BGP interrupt events detection method based on network topology and service analysis.Firstly,the time and location of the interrupt exception are determined by extracting and detecting the route visibility feature of autonomous systems and IP prefixes;Then,the network topology analysis is used to detect the events that cause the outage anomalies of related autonomous systems and locate the root autonomous system;Finally,the importance of network services related to autonomous systems and IP prefixes is determined through network service analysis to detect the BGP outage events that affect a large number of users.Based on the above detection methods,this thesis designs and develops a BGP interrupt event detection system based on network topology and service analysis.Firstly,complete routing knowledge bases are built,including the topology of autonomous systems,IP prefixes of autonomous systems,the basic information of autonomous systems,important domain names,domain name resolution,important IP addresses,important IP prefixes and important autonomous systems;Then,the outage anomalies of the autonomous system and IP prefix are detected according to the route visibility feature;Finally,network topology and service analysis are used to evaluate the impact of BGP outage events and locate the root autonomous system.The test results show that the system implemented in this thesis can basically cover the detection results of the existing system,and effectively address the issue of missing reports in the existing system.