# RPKI Defense Capability Simulation Method Based on Container Virtualization
## 5 Data Collection and Effectiveness Evaluation Strategy for Simulation Result  
To measure the security defense effect of the RPKI and conduct a security analysis under partially deployed conditions, this paper designs and implements a data acquisition and analysis technique as illustrated in Figure 4. This technique injects the data collection scripts into the targeted virtual nodes to perform accessibility tests at both the control plane and data plane levels, thereby measuring the route propagation that occurs after an attack. For the post attack results, we collect critical data in the following two aspects:  
1. Control Plane: The most obvious manifestation of prefix hijacking at the control level is the change in the virtual router routing table entries, which is also an intuitive demonstration of whether the RPKI works. Therefore, we use the data collection program in the virtual router to record the routing table entries at a certain time after the network topology reaches convergences. By searching for the hijacked prefixes and comparing them, we can access the ROV activation status and determine the security defense provided by the RPKI. To this end, the routing jitter Flapi index is defined as the number of changes in the routing table's best entries for ASi during a single hijacking event.  
\[\text{Flap}_{\text{i}}=\text{Entry}_{\text{i}}^{\text{I2}}-\text{Entry}_{\text {i}}^{\text{I1}}(\text{I2}>\text{t1}) \tag{1}\]  
In the above formula, Entryi = {entry1, entry2,..., entryN} represents the set of detailed routing entries for ASi at time t. Flapi is the set difference in routing table entries between two moments, indicating the routing instability caused by the impact of prefix hijacking on the routing node ASi. The Flapi index allows us to assess the degree of routing instability in the simulated network topology. A higher index value suggests a greater malicious impact of the hijacking attack, resulting in a less stable network environment.  
2. Data Plane: According to the experimental results in [6], the RPKI also has an effect on the data plane. Although an AS deploying the RPKI will never use the BGP route announcements with an invalid ROV state, the AS may still forward announcements to an AS that does not adopt the RPKI because of more specific routing rules. Therefore, it is necessary to assess the impact of prefix hijacking on the data plane and uniformly quantify the results. The specific formula is described as follows:  
\[\text{Result}(\text{A})=\begin{cases}\text{H}_{\text{i}}(\text{S})\\ \text{C}_{\text{i}}(\text{S})\\ \text{D}_{\text{i}}(\text{S})\end{cases} \tag{2}\]  
Suppose that A is the set of all ASes, and that \(S\) is the set of ASes deploying the RPKI in the current network environment. \(\text{H}_{\text{i}}(\text{S})\) means that when the AS deploying the RPKI is S, the data traffic of AS\({}_{\text{i}}\) is hijacked by malicious attacks. \(\text{C}_{\text{i}}(\text{S})\) indicates that AS\({}_{\text{i}}\) is successfully connected to the prefix address held by the legitimate ASes, whereas \(\text{D}_{\text{i}}(\text{S})\) means that AS\({}_{\text{i}}\) is not connected to the prefix address announced by any AS. These three parameters can effectively measure the harm caused by prefix hijacking attacks on the BGP network when the RPKI is partially deployed. To assess  
Figure 4: Implementation framework of data acquisition and analysis.  
the benefits of routers that have deployed the RPKI over undeployed ASes, we also define \(\text{B}_{\text{i}}(\text{S})\) as follows:  
\[\text{B}_{\text{i}}(\text{S})=\text{C}_{\text{i}}(\text{A}-\text{S})+\text{D}_{ \text{i}}(\text{A}-\text{S}) \tag{3}\]  
Finally, the data collected based on the above technology are processed via a data analysis program to obtain experimental data and charts. In the following, the collection and analysis strategy proposed in this section is used to analyze and evaluate the results of the simulation experiments on BGP malicious attacks.