【摘要】 针对传统基于BGP路由表或更新报文的路由事件识别方法由于路由更新报文噪声以及路由表采集时间间隔的限制,在路由事件识别精度和时间粒度方面存在一定局限性的问题,基于下一跳路由变化矩阵进行路由事件识别,通过BGP路由表和更新报文信息构建细粒度的路由状态变化矩阵,利用矩阵分解方法实现短时隙大规模路由事件的识别,并加以条件限制规避了影响范围较小的本地前缀事件.由于所处理的数据超过1TB,因此构建了近实时批处理的数据分析框架,并通过将此方法运用于已知的路由事件中,实验结果验证了该方法的有效性.更多还原

【Abstract】 As traditional methods for identifying BGP(border gateway protocol)events based on BGP RIB(routing information base)or update have limitation in accuracy of routing events identification and time granularity because the exist of noise in BGP update and the limitation of RIB collection time interval,a next-hop change matrix was constructed to identify BGP routing events,and RIB and update message of BGP were combined to build a new routing change matrix with small granularity.Non-negative matrix factorization was used to identify large-scale BGP routing events in short time interval and constraint was added to avoid local prefix events with small affected scope.A near real time batch data analyzing system with spark was built to process over 1TB data.Finally,this method was applied to some famous events and the experiments results validated the effectiveness of the method.更多还原