# RPKI Defense Capability Simulation Method Based on Container Virtualization
## 6 Experimental Verification and Analysis
### Comparative Analysis with Other Simulation Methods  
To demonstrate the advantages of the simulation network deployment method used in this paper in the field of BGP routing protocol security research, we conducted a performance comparison with other popular simulation methods. This evaluation assessed the performance and deployment differences of various simulation technologies in the context of BGP routing protocol security research. A performance comparison with other simulation methods was conducted on a virtual machine with a four-core CPU and 8 GB of memory. This virtual machine was exclusively configured with the environment and software required for the simulation methods. We performed the comparison by creating a single network node with an identical network configuration. The startup time in the comparison results starts from reading the configuration file to create the virtual node until the node is available. A lower startup time for the  
Figure 7: Experimental results of prefix hijacking attacks in a large-scale simulation scenario. (**a**) Data plane hijacking rate; (**b**) Control plane routing jitter; (**c**) Collateral benefits from non-deploying ASes. virtual nodes indicates a faster deployment speed for the simulation method. The CPU and memory resource utilization represents the average resource usage within the first 10 s after the creation of the simulation nodes. The comparative results are illustrated in Figure 8.  
Figure 8a shows that the simulation method presented in this paper has a significant advantage in terms of startup time. This implies the faster completion of the target topology creation, which is especially beneficial for large-scale simulation deployments. For the NS3-Dce mode, the first run requires the compilation of the script to create the network, and the displayed startup time is after the compilation is completed. If it is the first run, the startup time would be longer than the time shown in the figure. In terms of CPU resource consumption, as shown in Figure 8b, our proposed method is similar to SEED and results in lower CPU resource consumption. In the single-server deployment scenario, where CPU resources are typically more constrained, a lower resource consumption is advantageous for the large-scale node simulations. Regarding memory consumption, as illustrated in Figure 8c, our method addresses how routers perform ROV verification but incurs additional memory resource consumption. However, this memory overhead still has a significant advantage over the GNS3 and NS3-Dce mode. For a comprehensive simulation of RPKI functionality, such additional overhead is deemed worthwhile. Combining the above comparisons of the simulation methods, we evaluate the various methods in terms of four aspects: virtual node simulation scale, completeness of the RPKI framework, deployment speed, and deployment difficulty. The evaluation and analysis results for each method are presented in Table 3.  
Although GNS3's Cisco IOS method, which is based on Dynamiys 0.2.17, can achieve the authenticity of the simulated network, it has poor support for the RPKI and cannot implement RPKI deployment alone. In addition, the GNS3 method requires extremely high server resources and cannot complete the creation of large-scale simulation networks. Figure 8: Comparison of the startup time and resource consumption of each simulation method. (**a**) Startup time of each simulation method; (**b**) CPU utilization of each simulation method; (**c**) Memory utilization of each simulation method.