# RPKI Defense Capability Simulation Method Based on Container Virtualization
## 1 Introduction  
The Border Gateway Protocol (BGP) is the core routing protocol of the internet. However, because of its early design and lack of inherent security mechanisms, the BGP currently faces numerous security threats. As the scale and complexity of the internet increase, the security issues of the BGP become more prominent [1]. Ensuring the security and detection within BGP networks has become a critical component of network intrusion detection [2; 3; 4] and situational awareness [5; 6]. By implementing effective security defenses and detection measures [7; 8], we can enhance the overall security of the internet and ensure the stable operation of the network. To address the security concerns associated with the BGP, the Resource Public Key Infrastructure (RPKI) has been introduced as an enhancement mechanism [9; 10; 11; 12]. The RPKI employs digital signatures to validate the authorization of IP address holders, ensuring the trustworthiness of the published routing information [11; 12]. In recent years, there has been a notable increase in the number of autonomous systems (ASes) issuing Route Origin Authorizations (ROAs) for the IP prefixes they hold [11]. Consequently, to advance the research on the effectiveness of the RPKI defenses in BGP networks and enhance protocol security [9; 13], it is imperative to construct a network scenario that can be deployed on a large scale and closely approximates real-world conditions, facilitating the security evaluation of BGP environments deployed with the RPKI. Owing to the lack of a corresponding security protection mechanism, the BGP is often vulnerable to anomalous route announcement attacks [14; 15; 16; 17]. Anomalous route announcement attacks against the BGP can be broadly categorized into two types: prefix hijacking and route leakage. According to the statistics presented in [18], prefix hijacking attacks are more likely to be maliciously induced than route leakage. Additionally, the frequency of prefix hijacking attacks is relatively high, and the RPKI has been currently shown to be effective in mitigating such attacks [16; 17]. In recent years, relevant research has further explored defenses against BGP hijacking attacks [9; 19; 20; 21; 22]. [PERSON] et al. [9] conducted a thorough investigation into the adoption of the RPKI and Route Origin Validation (ROV) and analyzed the impact of a partial adoption on BGP security. Therefore, exploring the defensive effect of the RPKI against prefix hijacking in BGP simulation network environments contributes to an in-depth investigation of BGP security and promotes the further development of the RPKI. Simulations of BGP networks have garnered research attention. For simple network topologies, simulation tools such as GNS3 [23; 24] can be utilized for deployment. However, these tools are designed primarily for emulating specific functionalities of various commercial routers, and they incur substantial hardware resource consumption that renders them impractical for large-scale simulation deployments. Furthermore, the deployment approach lacks flexibility, and the installation of different network environments is intricate, thus hindering the swift deployment of target topology networks. Consequently, researchers have increasingly turned to container virtualization technology for BGP network simulation [20; 25], as it allows for a more efficient utilization of system resources and offers faster startup times. However, the simulation methods do not fully exploit the advantages of container virtualization technology, and the number of deployed virtual nodes remains relatively low. With respect to the RPKI simulation, only the ROV technique on the router side has been implemented thus far. Although the approach can accomplish basic simulation tasks, it is challenging to achieve a simulation environment that is closer to the real internet. Therefore, it is necessary to explore a new BGP network simulation method that offers large-scale implementation, high simulation fidelity, and flexible scalability.