面向BGP安全的自治系统路由行为评估与预测技术研究

It is highly important for Internet to ensure BGP security. Unfortunately, current BGP security solutions can’t actually protect BGP from prefix hijacking and path forging attacks. Based on the observation that the inter-domain routing system is open, distributed, autonomous and business-driven, the project will assume that the autonomous system in the inter-domain routing system is rational. Under this assumption, the project will conduct the thorough research on autonomous system routing behavior evaluation and prediction technology, to improve BGP security by suppressing prefix hijacking and path forging attacks. Firstly, to accurately and comprehensively evaluate routing behavior, the project will provide the anomaly detection technique based on multi-dimensions evidences correlation and the routing behavior evaluation method based on attack consequences. Secondly, to fuse historical routing behaviors to reflect prospective behavior, the project will provide the routing behavior prediction method based on the fusion theory of single source information in time domain. Thirdly, to make routing behavior prediction quickly converge, considering the “power-law” dynamic characteristic of the originating prefix routing announcement behavior, the project will provide the originating routing behavior dynamics modeling method based on machine learning and the behavior prediction evolution mechanism based on self-adaptive adjustment window, considering the dynamic interactions between neighbor autonomous systems under the restriction of the competition-cooperation relationship, the project will provide the propagating routing announcement behavior dynamics modeling method based on evolutionary game and the behavior prediction evolution method based on interaction policy evolution. This topic research will enrich methods to solve BGP security problem.

BGP安全对于互联网可靠稳定运行至关重要。目前解决方案难以切实保障BGP安全。课题从域间路由系统开放、分布、自治和商业性的本质特性出发，假设自治系统是“理性”的。在该假设下，探索研究自治系统路由行为的评估与预测技术，以期通过抑制异常路由通告攻击的发生来改善BGP安全。研究包括拟提出基于多平面证据关联的异常检测技术和基于攻击效力的行为评估方法，以期准确、全面评估路由行为；拟提出基于时间域单源信息融合理论的行为预测方法，以期通过融合历史行为来预测未来行为；针对自治系统发起前缀可达路由行为的“幂律”动态性，拟提出基于机器学习的行为动态性建模方法和基于自适应窗口调节的行为预测演化机制，针对邻居自治系统间在竞争-合作关系约束下动态交互的特点，拟提出基于演化博弈的邻居路由转发行为动态性建模方法和基于交互策略演化的行为预测演化方法，以期实现行为预测的快速收敛。研究将丰富BGP安全问题的解决方法与手段。

BGP安全对于互联网可靠稳定运行至关重要。针对长久以来难以彻底解决的BGP安全难题，本项目另辟蹊径，从域间路由系统的开放、分布、自治和商业性的本质特性出发，对自治系统路由行为的评估和预测技术展开探索性研究，以期通过抑制异常路由通告攻击的发生来改善BGP安全。经过三年时间的研究工作，本项目在自治系统路由行为的评估、预测和动态演化方面，取得了一系列的研究成果。具体包括：①提出了基于一维卷积神经网络的前缀劫持异常检测方法、基于改进高斯核函数的更新报文激增异常检测方法和基于混合模糊综合评价的自治系统路由行为评估方法，实现了对自治系统路由行为的全面、准确评估；②提出了基于路由信任度的自治系统路由行为预测方法，通过融合自治系统的历史路由行为，实现了对其未来路由行为的较准确预测；③提出了基于Wright-Fisher的自治系统域间路由随机演化博弈模型和基于卡尔曼滤波的自治系统路由行为预测的动态演化方法，实现了自治系统路由行为预测的准确、快速收敛。本项目研究成果丰富了BGP安全问题的解决方法和手段，具有较高的理论研究价值。本项目共发表学术论文20篇，其中SCI收录4篇，IEEE Transactions论文1篇，EI收录9篇;授权国家发明专利1项，申请国家发明专利8项；获得河南省科学技术进步奖一等奖1项，软件著作权2项；培养研究生8名，其中博士生2名，硕士生6名。