Method and system for detecting normalization of forwarding behavior of router in core routing area

Patent metadata

Field	Value
Publication number	US-9912576-B2
Application number	US-201615099648-A
Country	US
Kind code	B2
Filing date	Apr 15, 2016
Priority date	Apr 27, 2015
Publication date	Mar 6, 2018
Grant date	Mar 6, 2018

Abstract

The present disclosure provides a method and system for detecting normalization of forwarding behavior of a router in a core routing area. The method includes: obtaining data flow received by ports of a core router; performing matching check to the data flow according to the data flow state table; if the data flow does not match the data flow state table, checking state of the data flow to calculate a state check result S(i); determining whether the data flow state table needs to be updated, if yes, updating the data flow state table; and determining whether the state check result S(i) is a trigger state, if yes, calculate state r of the forwarding behavior of the core router, and determining whether the forwarding behavior of the core router is abnormal according to the state r of the forwarding behavior of the core router, if yes, generating an alert log.

First claim

What is claimed is:

1. A method for detecting normalization of forwarding behavior of a router in a core routing area, comprising following steps:
obtaining data flow received by ports of a to-be-detected core router which are directly connected to peripheral network equipment;
generating a data flow state table initially, and performing matching check to the data flow according to the data flow state table;
if the data flow does not match the data flow state table, checking state of the data flow to obtain characteristic parameters of the data flow to calculate a state check result S(i);
determining whether the data flow state table needs to be updated, if yes, updating the data flow state table; and
determining whether the state check result S(i) is a trigger state, if yes, using the to-be-detected core router together with the peripheral network equipment to calculate state r of the forwarding behavior of the to-be-detected core router, and determining whether the forwarding behavior of the to-be-detected core router is abnormal according to the state r of the forwarding behavior of the to-be-detected core router, if yes, generating an alert log.

2. The method of claim 1 , wherein the data flow state table comprises: source network segment address, destination network segment address, input port, inquiry port, output port, the state check result S(i), and timer.

3. The method of claim 1 , wherein the state check result S(i) satisfies following expressions:
S ( i )= f a ( x 1 ,x 2 )⊕ f b ( x 3 )| f a =0 +f a ( x 1 ,x 2 )⊕ f c ( x 4 )| f a =1 ,

when initially f a =0, f b =1, f c =0.

4. The method of claim 1 , wherein the state r of the forwarding behavior of the core router satisfies a following expression:

r
=

∑
n

j
=
0

⁢

p
⁡

(
j
)

,

and p(j) represents a port state corresponding to port j of the core router, and j=0, 1, 2, . . . , n, p(j) is initially equal to zero, and p(j) is obtained according to determination of the state check result S(i).

5. The method of claim 4 , further comprising:
when r≠0, determining the forwarding behavior of the core router is abnormal.

6. The method of claim 1 , further comprising:
when one of following conditions is satisfied, updating the data flow state table:
1) storing a new entry corresponding a update entry for the data flow state table which is generated in step S 3 ;
2) synchronization with dynamic change of a routing table being needed;
3) number of stored entry list of the data flow state table reaching a upper limit or timer being overdue.

7. A system for detecting normalization of forwarding behavior of a router in a core routing area, comprising: one or more hardware processor coupled to a memory, wherein the memory stores an obtaining module, a determining module and a processing module, wherein:
the obtaining module is configured to obtain port states P(j) of each to-be-detected router in the core routing area, one router in the core routing area being a peripheral network equipment to another router in the core routing area, data-flow matching check is performed to all peripheral network equipment, by using the method of claim 1 , to generate the port states of a router whose forwarding behavior is abnormal, allowing the obtaining module to obtain;
the determining module is configured to calculate state r(k) of the forwarding behavior of each to-be-detected router in the core routing area, and determine whether r(k) is equal to zero, and if no, determine the forwarding behavior of a router k is abnormal; and
the processing module is configured to calculate state R of the forwarding behavior in the core routing area, and determine whether abnormal forwarding behavior exists in the core routing area according to the state R of the forwarding behavior, and if yes, generate an alert log.

8. The system of claim 7 , wherein the state r(k) of the forwarding behavior of each to-be-detected router satisfies a following expression:

r
⁡

(
k
)

=

∑
n

j
=
0

⁢

P
k

⁡

(
j
)

,

and P k (j) represents a port state corresponding to port j of the k-th to-be-detected router, and j=0, 1, 2, . . . , n, and r(k) is initially equal to zero.

9. The system of claim 7 , wherein the state R of the forwarding behavior in the core routing area satisfies a following expression:

R
=

∑
m

k
=
1

⁢

r
⁡

(
k
)

,

k=1, 2, . . . , m, and m is number of the core router in the core routing area, and initially, R=0, if R after calculation is not equal to zero, the abnormal forwarding behavior existing in the core routing area is determined and the alert log is generated.

10. A non-transitory computer-readable storage medium having stored therein instructions that, when executed by a processor of a device, causes the device to perform a method for detecting normalization of forwarding behavior of a router in a core routing area, wherein the method comprises following steps:
obtaining data flow received by ports of a to-be-detected core router which are directly connected to peripheral network equipment;
generating a data flow state table initially, and performing matching check to the data flow according to the data flow state table;
if the data flow does not match the data flow state table, checking state of the data flow to obtain a state check result S(i) by obtaining characteristic parameters of the data flow;
determining whether the data flow state table needs to be updated, if yes, updating the data flow s

Assignees

• Univ Tsinghua

Inventors

• Xu Ke
• Yang Fan
• Shen Meng
• Chen Wenlong
• Zhao Youjian

Classifications

• H04L45/38

  Flow based routing · CPC title

• H04L12/4625

  Single bridge functionality, e.g. connection of two networks over a single bridge · CPC title

• H04L47/2483

  involving identification of individual flows · CPC title

• H04L45/28

  using route fault recovery · CPC title

• H04L45/021 Primary

  Ensuring consistency of routing table updates, e.g. by using epoch numbers · CPC title