ConfigKG: Identify Routing Security Issues from Configurations Based on Knowledge Graph
Pengfei Li, Yujing Liu, Jinshu Su, Bo Yu · 2024
Inadequate network configurations can lead to serious security issues. Current research, however, overlooks the integrity of the network in identifying security issues from configurations. Specifically, it lacks sufficient integration of multi-level information and lacks a certain level of scalability when facing different network situations. This paper introduces ConfigKG, a general, extensible, and comprehensible framework for identifying security issues from configurations in a network. ConfigKG utilizes configuration files to create a knowledge graph, which assists in reasoning and mining network information. Through this process, ConfigKG models networks in knowledge graphs. Drawing from properly configured routing protocol scenarios, this study translates the standard network state into a series of graph-based rules that are applied across network planes. By evaluating these rules, ConfigKG can determine the network state and find errors in configurations. This article focuses solely on identifying security issues in the configuration of routing protocols, as routing security is the primary concern related to configuration problems. An experimental scenario was conducted to assess ConfigKG, which successfully constructs a knowledge graph and accurately models the network, enabling finding security issues through rule set checks. During the experiment, ConfigKG effectively identifies misconfigurations in OSPF and BGP, as well as prefix hijacking. Additionally, ConfigKG demonstrates scalability by accommodating additional mining algorithms and rule sets, allowing for customized adjustments based on detailed requirements.