# RPKI Defense Capability Simulation Method Based on Container Virtualization
## 4 The BGP Simulation Network Deployment
### Automated Loading Technique for Malicious BGP Attack Scenario  
Malicious attack scenarios are the most crucial part of the BGP network simulation system. To simulate prefix hijacking events in real network environments as realistically as possible, we design a set of attack deployment strategies for the random selection of an attacker and a victim. Simultaneously, to quickly reproduce simulation experiment scenarios or verify the accuracy of multiple experimental results, the selected pair of attacker and victim, along with the topology deployment configuration file, is saved to the control node. The deployment configuration file is stored in standard JSON format, facilitating parsing and generation by the control program.  
The logical topology of the BGP simulation network follows a three-layer structure [31], in which the first tier is the core AS and has access to the entire address space. The second-tier AS peers other ASes or provides transit services to other ASes. The third-tier AS, also referred to as the edge AS or stub AS, needs to peer with higher-tier ASes to connect to the internet. On the internet, most stub ASes are responsible for carrying traffic with source or destination addresses located within their own AS [17]. Therefore, the selected victim and attacker in the attack strategy are from stub ASes. Additionally, to be more consistent with actual incidents of malicious hijacking on the internet, we ensure that the shortest path taken by the attackers to the victims consists of no fewer than four hops, guaranteeing traversal through all the levels of the ASes.  
Following the above rules for generating attacker and victim pairs, the CA must generate ROA information for the IP address prefixes held by the victims. In response to the issue that an excessively large number of ROAs needs to be generated in the simulation environment, this paper designs a batch ROA authorization management algorithm to achieve automated IP prefix authorization in the simulation network. The purpose of the batch ROA authorization management algorithm is to update all the ROA information to the corresponding virtual CA nodes for use by the virtual RP nodes. The pseudocode description of the specific algorithm is shown in Algorithm 1. The inputs of the algorithm  
Figure 3: Simulation scenario construction process.  
include the operations to be performed, such as adding or deleting ROAs, and all the ROA information, where ROA information includes the IP prefix, ASN, and optionally the maximum prefix length. The output represents the result of the operation on the input ROA information. The algorithm first iterates through the ROA information and filters the maximum prefix length to ensure that the ROA information is in the correct format. If the ROA information is correct, it then performs the corresponding operations to publish or withdraw the ROA.  
```
1:roa \(\leftarrow\) a list of ROA information, include IP prefix, length, max length, asn.
2:operation \(\leftarrow\) string for roa operation, include adding or deleting.
3:Input:result \(\leftarrow\) roa operation result
4:forroa in roas do
5:ifexist maxlength then
6:if maxlength < length then
7:result \(\leftarrow\) maxlength invalid
8:else
9:update(roa, operation) // perform corresponding operation
10:result \(\leftarrow\) successs
11:endif
12:endfor
13:return result
```  
**Algorithm 1** Batch ROA Management  
Once the BGP simulation network topology has converged, and all the ROAs are synchronized from the CA, the simulation program proceeds to initiate malicious attack scenarios on the BGP simulation network. For the simulation of prefix hijacking attacks, we control the attacking AS to simulate the hijacking of the victim's legitimate IP prefix address via the normal BGP announcement method, thus completing a simulated prefix hijacking attack.