Multi-Source Collaborative Identification of AS Border Routers via Cyberspace Mapping Engines

Accurate identification of Autonomous System (AS) border routers—including vendor, model, and firmware version—is critical for routing security assessment and inter-domain traffic engineering. Existing fingerprinting techniques rely primarily on initial TTL (iTTL) signatures or SNMPv3 probing, yet both suffer from structural blind spots: iTTL signatures cannot distinguish Cisco IOS from Huawei VRP , while SNMPv3 achieves only 15–18% response rates due to widespread port filtering. This paper proposes a multi-source collaborative identification framework that systematically introduces cyberspace mapping engines (FOFA, Shodan, Censys, ZoomEye) as a third fingerprint source, complementing LFP and SNMPv3 through a unified three-level model matching pipeline and a Weighted Confidence Fusion Algorithm (WCFA) with context-aware dynamic weight adjustment. Experiments on 1,500 border routers across three geographic regions demonstrate that the tri-source fusion raises vendor identification coverage from approximately 65% to 79.4%, and WCFA achieves 91.3% resolution accuracy on 188 conflicting cases—a 7.6 percentage-point improvement over simple priority-based arbitration. Nearly half of covered routers receive model-level identification, and over one quarter obtain complete vendor-model-firmware triplets.