基于多特征的域间路由节点安全状态评估方法

Abstract

The administrators of the AS(autonomous system) can develop a more rational strategy with the help of evaluating the secure state of the BGP(border gateway protocol) nodes. However, the existing fusion-based method is inapplicable because it needs an integrated set of abnormal inter-domain routes to ensure accurate results. In this paper, we first analyze the statistical characteristics existing in the process of exchanging routes between BGP nodes and the relationships between these characteristics, taking into account the security situation of a node. We then propose a multi-characteristics-based method for evaluating the security situation of inter-domain routing nodes that selects the average length of the routing path and the frequency of routing events as security characteristics, borrowing an idea from Cloud Model theory in transforming the values of quantitative characteristics to a qualitative concept. CSSAM, a security state awareness model, is proposed. It constructs a cloud model with a mass of numerical values of the security characteristics in the normal state, and then computes the threat probability for the system, by measuring the degree of deviation of the security characteristics from their norms. The experimental results show that the method is capable of sensing the security situation of BGP nodes.